AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms.
This release of Red Hat AMQ Broker 7.14.0 includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* (CVE-2026-1605) jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests
* (CVE-2026-33870) netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values
* (CVE-2026-33871) netty-codec-http2: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood
* (CVE-2026-33871) netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood
* (CVE-2026-24281) zookeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing
* (CVE-2026-24308) zookeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values
* (CVE-2026-32642) artemis-server: Apache Artemis and Apache ActiveMQ Artemis: Unauthorized address creation due to incorrect authorization during JMS topic subscription.
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily inoperable.
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1
allows attackers to consume excessive amounts of disk space via network interface.
Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).
This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.
This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout requests.
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.
CVE-2026-33459 is a medium severity vulnerability in Elastic Kibana affecting versions 8.15.0, 9.0.0, and 9.3.0. It involves uncontrolled resource consumption (CWE-400) via the automatic import feature, where an authenticated user can submit requests with excessively large input values. Concurrent exploitation can destabilize backend services, causing denial of service and making the deployment unavailable to all users. There is no official patch or remediation level currently provided by the vendor.
CVE-2026-32288 is a medium severity vulnerability in the Go standard library's archive/tar package. The tar.Reader component can consume an unbounded amount of memory when processing malicious tar archives with many sparse regions encoded using the old GNU sparse map format. This can lead to denial of service due to excessive memory use. The vulnerability affects Go versions up to 1.26.0-0. No patch or official remediation is currently available, and no exploits have been reported in the wild.
CVE-2026-35406 is a medium severity vulnerability in aardvark-dns versions 1.16.0 through 1.17.0. It involves uncontrolled resource consumption where a truncated TCP DNS query followed by a connection reset causes the server to enter an unrecoverable infinite error loop at 100% CPU usage. This results in a denial of service condition. The issue is fixed in version 1.17.1.
Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes.
Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.
Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TLS handshake by exploiting protocol downgrades to TLS 1.0 or TLS 1.1, interrupting service availability.
Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for any user-supplied binary string that starts with "Elixir.", before verifying whether the referenced module exists. Because Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries, an attacker who can submit values to any resource attribute or argument of type :module can exhaust this table and crash the entire BEAM VM, taking down the application. This issue has been patched in version 3.22.0.
CVE-2026-31935 is a high-severity vulnerability in the OISF Suricata network IDS/IPS/NSM engine. It involves uncontrolled resource consumption caused by flooding crafted HTTP2 continuation frames, which can exhaust memory and typically cause the Suricata process to be terminated by the operating system. This issue affects Suricata versions prior to 7.0.15 and versions from 8.0.0 up to but not including 8.0.4. The vulnerability has been patched in versions 7.