CWE-400: Uncontrolled Resource Consumption vulnerabilities

pypdf versions prior to 6.21.2 contain a vulnerability where an attacker can craft a PDF that repeatedly references the same nonexistent indirect object. This causes repeated full-file recovery loads and long runtimes when accessing certain file parts such as pages. The issue is fixed in version 6.21.2.

Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated API users can bypass the configured maximum attachment file size by uploading base64-encoded files via the API. This bypass allows uploading files larger than the intended limit, potentially exhausting disk space and causing a denial of service. The issue is fixed in version 2.13.2.

Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated users can bypass the maximum attachment file size limit when using the server-side 'Download external file' feature. This allows storing files larger than intended, potentially exhausting disk space and causing a denial of service. The issue is fixed in version 2.13.2.

CVE-2026-108359 is a high-severity vulnerability in PHPOffice PhpSpreadsheet affecting multiple versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The vulnerability arises from the Ods::processTableRow function accepting an unbounded table:number-rows-repeated attribute in ODS files, allowing an attacker to cause uncontrolled resource consumption. This can lead to substantial CPU and memory usage, potentially terminating the PHP worker process. The issue is fixed in the specified versions.

A resource consumption vulnerability exists in the py-pdf fpdf2 library versions 2.5.0 through 2.8.7. The issue arises from nested SVG <use> references that cause exponential growth in memory and CPU usage during PDF generation, potentially leading to MemoryError and job failures. This flaw is fixed in version 2.8.8.

A vulnerability in graphql-core versions from 3.0.0 up to but not including 3.2.12 and from 3.3.0a1 up to but not including 3.3.0rc1 allows an unauthenticated remote attacker to cause excessive CPU consumption during the validation phase. This is due to the OverlappingFieldsCanBeMerged rule repeatedly comparing fields and recursively re-comparing flattened inline fragments without proper memoization, leading to quadratic or worse CPU usage. The issue is fixed in versions 3.2.12 and 3.3.0rc1.

CVE-2026-75508 is a high-severity vulnerability in graphql-core, a Python port of GraphQL.js. The flaw exists in versions from 3.2.3 up to but not including 3.2.12 and from 3.3.0a3 up to but not including 3.3.0rc1. It involves uncontrolled resource consumption due to the parser's max_tokens limit counting only non-comment tokens, while comment tokens are still retained in memory. This allows an unauthenticated remote attacker to exhaust worker memory by sending a comment-padded GraphQL document before depth or complexity controls are applied. The issue is fixed in versions 3.2.12 and 3.3.0rc1.

A resource consumption vulnerability exists in open-telemetry opentelemetry-python prior to version 1.45.1. The TraceState.from_header function parses W3C tracestate headers using an unbounded optional-whitespace regular expression, which can cause excessive CPU usage due to quadratic backtracking when processing malformed headers with long runs of spaces or tabs. This can degrade availability by occupying synchronous workers or delaying asynchronous event loop requests. The vulnerability does not expose or modify telemetry data and does not allow code execution. It is fixed in version 1.45.1.

A vulnerability in the python-pillow Pillow library prior to version 13.0.0 allows crafted multi-frame MPO or DCX images to cause uncontrolled memory consumption. This occurs because later frames can declare sizes that exceed limits without triggering decompression bomb checks, leading to potential denial of service via memory exhaustion. The issue is resolved in version 13.0.0.

A vulnerability in the python-pillow Pillow library versions 5.1.0 through 12.x allows an attacker to cause uncontrolled resource consumption. The PdfParser.linearize_page_tree() function treats a PDF /Pages graph as a tree without tracking duplicate indirect references, leading to exponential expansion of page references when processing a crafted PDF. This results in disproportionate CPU usage during the append operation. The issue is fixed in version 13.0.0.

A resource consumption vulnerability exists in python-pillow Pillow versions prior to 13.0.0. The SpiderImageFile.seek() function can reparse a later SPIDER stack frame and replace the image size without rerunning the decompression bomb check, allowing an attacker to declare very large image dimensions. This can cause excessive memory allocation, potentially consuming multiple gigabytes of memory. The issue is fixed in version 13.0.0.

A vulnerability in the BmpRleDecoder component of the python-pillow Pillow library allows crafted BMP files to cause uncontrolled memory allocation. This occurs due to unbounded growth in the delta escape and absolute mode branches during decoding, leading to a severe memory amplification denial-of-service (DoS). The flaw affects all versions before 13.0.0. A fix is available in version 13.0.0 that caps memory growth and rejects out-of-bounds deltas.

CVE-2026-114144 is a high-severity vulnerability in the BinaryMuse toml-node library prior to version 5.0.1. The vulnerability arises because the toml.parse() function converts unbounded long integer strings to BigInt before checking if they fit within the TOML 64-bit integer range. This conversion of very long integer strings consumes super-linear CPU time and blocks the Node.js event loop synchronously, enabling a denial of service (DoS) attack via a crafted TOML document. The issue is fixed in version 5.0.1.

Django REST framework versions prior to 3.18.2 have an uncontrolled resource consumption vulnerability in the DefaultContentNegotiation.get_accept_list method. An unauthenticated attacker can exploit this by sending requests with many distinct media types containing large quoted parameter values, causing excessive CPU usage and denial of service. The issue is fixed in version 3.18.2.

Apache Traffic Server contains a vulnerability (CVE-2026-111817) related to uncontrolled resource consumption. The server can stall a chunked transfer when it removes trailers, waiting indefinitely for trailer bytes that have already been dropped, causing the connection to time out. This issue affects specific versions where trailer dropping is enabled by default or manually enabled. The vulnerability has a medium severity score and can lead to denial of service by exhausting resources.

Apache Traffic Server versions 9.2.15, 10.1.4, and 10.2.0 have a vulnerability where the server writes an unthrottled diagnostic log line for every internal @ header stripped from a request. This can lead to uncontrolled resource consumption when a request contains many such headers, causing excessive log data generation. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.

CVE-2026-111805 is a high-severity vulnerability in Apache Traffic Server that allows an attacker to exhaust an HTTP/1.1 origin's worker pool by sending a truncated HTTP/2 Content-Length value. This uncontrolled resource consumption can lead to denial of service conditions. The issue affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.

CVE-2026-110803 is an improper locking vulnerability in Vaadin Framework 8 where a session lock is not released if a non-numeric v-uiId request parameter causes an exception. This leads to thread pool exhaustion and application denial of service. The issue affects Vaadin Framework versions 8.16.0 through 8.32.1. Vaadin Framework 7 and versions 10 and later are not affected. A fix is available in version 8.32.2.

CVE-2026-113795 is a vulnerability in the py-pdf pypdf library prior to version 6.20.0. It involves uncontrolled resource consumption caused by processing crafted PDF streams with many filters or multiple filters that handle large data volumes. This can lead to excessive memory usage. The issue is resolved in version 6.20.0.

A vulnerability in pypdf prior to version 6.21.0 allows an attacker to craft a PDF with a content stream containing many small operations, leading to excessive memory consumption during parsing. This uncontrolled resource consumption issue is fixed in version 6.21.0.