CWE-770: Unthrottled Resource Allocation vulnerabilities

CVE-2026-115927 is a medium severity vulnerability in the Tornado Python web framework prior to version 6.6.0. It involves uncontrolled resource consumption due to inefficient handling of HTTP/1.1 chunked transfer encoding. A remote unauthenticated attacker can send many small chunks to monopolize the event loop, stalling other connections and causing denial of service. The issue is fixed in Tornado 6.6.0.

HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

vLLM versions from 0.16.0 up to but not including 0.32.0 contain a vulnerability in the /v1/responses endpoint that allows an authenticated user to supply a malicious template in chat_template_kwargs[chat_template]. This bypasses the intended trust policy and can lead to uncontrolled CPU or memory consumption during Jinja template rendering. The issue is resolved in version 0.32.0.

vLLM versions prior to 0.32.0 contain a resource allocation vulnerability in the Phi-4 multimodal audio encoder. The default use of eager attention causes large attention matrices to be fully materialized in GPU memory when processing long audio clips. This results in quadratic GPU memory consumption, potentially leading to out-of-memory conditions that terminate the EngineCore process for all users. The issue is resolved in version 0.32.0.

CVE-2026-115911 is a vulnerability in vllm, an inference and serving engine for large language models, affecting versions from 0.19.0 up to but not including 0.32.0. Authenticated users can supply a chat template that is compiled and rendered without limits on execution time or output size, potentially causing resource exhaustion. This can block server responses or exhaust memory, leading to denial of service. The issue is fixed in version 0.32.0.

**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

CVE-2026-97200 is a high-severity vulnerability in benoitc hackney versions from 2.0.0-beta.1 up to but not including 4.9.0. It involves improper handling of highly compressed HTTP response bodies, allowing a malicious server to exhaust client memory by sending oversized or highly compressed responses. The vulnerability arises because hackney buffers the entire response body without limits and decompresses it in one step, leading to potential resource exhaustion.

CVE-2026-110499 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit versions from 0.3.6 up to but not including 1.14.0. It involves allocation of resources without limits or throttling, where an unauthenticated remote attacker can cause unbounded growth in per-connection memory and CPU usage by specifying a large SETTINGS_HEADER_TABLE_SIZE. This leads to quadratic CPU cost per connection due to the HPACK encoder table resizing and linear scanning of response headers. The issue is fixed in version 1.14.0.

CVE-2026-111101 is a high-severity vulnerability in the mtrudel bandit HTTP/1.1 chunked body reader that allows unauthenticated remote attackers to exhaust server memory and CPU by sending a request body composed of many 1-byte chunks. The chunked reader accumulates each chunk as a separate list cell and binary term without limiting the number of chunks, causing excessive memory and CPU usage. This affects bandit versions from 0.1.0 up to but not including 1.14.0. The issue is fixed in version 1.14.0.

CVE-2026-114213 is a high-severity vulnerability in mtrudel bandit's WebSocket fragment reassembly. It allows an unauthenticated remote attacker to exhaust server memory by sending a fragmented message composed of many 1-byte continuation frames. The vulnerability arises because the server keeps each non-final continuation frame as a separate list cell without limiting the number of fragments, leading to excessive memory consumption. This affects bandit versions from 1.11.0 up to but not including 1.14.0. The issue is fixed in version 1.14.0.

CVE-2026-115269 is a high-severity vulnerability in mtrudel bandit's HTTP/2 request body reader that allows an unauthenticated remote attacker to cause an infinite loop by sending specific WINDOW_UPDATE or empty SETTINGS frames. This keeps stream processes open indefinitely, potentially exhausting resources. The issue affects bandit versions from 1.4.0 up to but not including 1.14.0. A fix is available in version 1.14.0.

CVE-2026-108525 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit affecting versions from 0.3.1 up to but not including 1.14.0. It allows an unauthenticated remote attacker to exhaust server memory by sending DATA frames beyond the advertised receive window and withholding WINDOW_UPDATE frames, causing the stream process to block and queue frames until memory is depleted. The flaw arises because the implementation forwards DATA frames without checking the receive window and replenishes the window incorrectly, never responding with a flow control error. This issue is fixed in version 1.14.0.

CVE-2026-115824 is a vulnerability in Starman versions before 0.4019 for Perl that allows remote attackers to exhaust worker memory by sending chunked HTTP request bodies with unbounded chunk sizes. The chunked body decoder buffers each chunk in memory without limiting the length of the chunk-size line, enabling memory exhaustion via a single connection.

CVE-2026-115817 is a resource exhaustion vulnerability in Starman versions before 0.4019 for Perl. The flaw allows a remote attacker to stall request bodies, causing workers to be held indefinitely due to blocking reads without deadlines. This can exhaust all available workers, resulting in denial of service. Version 0.4019 fixes the issue by applying read_timeout to body data reads and adding a body_timeout limit of 300 seconds by default.

CVE-2026-115778 is a high-severity vulnerability in the Twisted event-based framework for Python. Prior to version 26.10.0rc1, the Telnet dataReceived method in twisted.conch.telnet improperly accumulates data in a subnegotiation buffer without a maximum length limit. Because Telnet option negotiation occurs before authentication, an unauthenticated attacker can send data without the expected terminator, causing uncontrolled memory growth. This can lead to memory exhaustion and process termination, affecting all services hosted by the process. The issue is fixed in version 26.10.0rc1.

CVE-2026-115776 is a high-severity vulnerability in the Twisted framework prior to version 26.10.0rc1. It involves uncontrolled resource consumption due to the IRC protocol implementation buffering all received bytes without a line feed and lacking a maximum line length limit. This allows unauthenticated connections to grow the buffer indefinitely, potentially exhausting server memory and causing denial of service by dropping all users. The issue is fixed in version 26.10.0rc1.

CVE-2026-115775 is a high-severity vulnerability in the Twisted framework prior to version 26.10.0rc1. It involves uncontrolled resource consumption due to the twisted.words.xish.domish ExpatElementStream parser allowing an unauthenticated remote peer to keep a container element open while continuously adding child elements. This causes the parser to retain an unfinished stanza as an in-memory tree without limits, potentially exhausting server memory and terminating the process. The issue is fixed in version 26.10.0rc1.

Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated API users can bypass the configured maximum attachment file size by uploading base64-encoded files via the API. This bypass allows uploading files larger than the intended limit, potentially exhausting disk space and causing a denial of service. The issue is fixed in version 2.13.2.

Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated users can bypass the maximum attachment file size limit when using the server-side 'Download external file' feature. This allows storing files larger than intended, potentially exhausting disk space and causing a denial of service. The issue is fixed in version 2.13.2.

CVE-2026-114644 is a high-severity vulnerability in the MongoDB C# Driver's BSON library affecting versions from 2.0.0 up to but not including 3.13.0. It involves uncontrolled resource consumption during deserialization of a specific BSON value type, allowing an unauthenticated remote attacker to cause unbounded memory growth and denial of service. This issue does not impact confidentiality or integrity and does not affect MongoDB server components.