Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1
Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
CVE-2026-33541 is a medium severity vulnerability in miraheze's TSPortal platform prior to version 34. The issue involves uncontrolled resource consumption due to a flaw in the validation logic that allowed attackers to create arbitrary user records in the database even when validation failed. This could lead to excessive database growth and potentially cause a denial of service (DoS). The vulnerability has been fixed in version 34 of TSPortal.
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Versions starting in 2.1.5 and prior to 2.5.2 have Denial of Service (DoS) vulnerability in the Stirling-PDF watermark functionality (`/api/v1/security/add-watermark` endpoint). The vulnerability allows authenticated users to cause resource exhaustion and server crashes by providing extreme values for the `fontSize` and `widthSpacer` parameters. Version 2.5.2 patches the issue.
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base (All versions < V26.10). The affected application contains denial-of-service (DoS) vulnerability. The remote operation mode is susceptible to a resource exhaustion condition when subjected to a high volume of requests. Sending multiple requests can exhaust resources, preventing parameterization and requiring a reset or reboot to restore functionality.
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.
Security Fix(es):
* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data. This is a milder variant of CVE-2026-27571. That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable websockets if not required for project deployment.
CVE-2026-33332 is a medium-severity vulnerability in the Python-based UI framework NiceGUI versions prior to 3.9.0. It involves improper input validation of a user-controlled query parameter in the app.add_media_file() and app.add_media_files() routes. This parameter affects how files are read during streaming, allowing attackers to bypass chunked streaming and force the server to load entire media files into memory simultaneously. Exploiting this can cause excessive memory consumption, degraded performance, or denial of service, especially with large files and concurrent requests. No authentication or user interaction is required to exploit this vulnerability. The issue has been patched in NiceGUI version 3.
CVE-2026-29772 is a medium-severity vulnerability in the Astro web framework versions prior to 10.0.0. The issue arises from the Server Islands POST handler, which parses the entire request body as JSON without enforcing any size limits. This allows an attacker to send a crafted payload containing many small JSON objects, causing approximately 15 times memory amplification in the V8 JavaScript engine heap. As a result, a single unauthenticated request can exhaust the server's memory and crash the process, leading to denial of service. The vulnerable endpoint is /_server-islands/[name], which is registered on all Astro SSR apps using the Node standalone adapter, regardless of component usage. The vulnerability has been patched in Astro version 10.0.0.
Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service. Version 0.89.3 contains a patch.
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
CVE-2026-33483 is a high-severity vulnerability in WWBN AVideo versions up to 26.0 involving an unauthenticated PHP endpoint that allows remote attackers to write unlimited data to temporary files without size or rate limits. This flaw enables trivial disk space exhaustion, resulting in denial of service (DoS) of the entire server hosting the video platform. The vulnerable endpoint, aVideoEncoderChunk.json.php, lacks authentication, framework protections, and cleanup mechanisms, making exploitation straightforward. No user interaction or privileges are required, and the attack surface is fully remote. A patch addressing this issue is available in commit 33d1bae6c731ef1682fcdc47b428313be073a5d1. Organizations using affected versions should prioritize applying the patch to prevent service disruption. The vulnerability impacts confidentiality and integrity minimally but severely affects availability.
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 used an unbounded ConcurrentHashMap cache with no eviction policy in its DefaultHtmlErrorResponseBodyProvider. If the application throws an exception whose message may be influenced by an attacker, (for example, including request query value parameters) it could be used by remote attackers to cause an unbounded heap growth and OutOfMemoryError, leading to DoS. This issue has been fixed in version 4.10.7.
Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM (Out-of-Memory) vulnerability in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an attacker-controlled 4-byte length prefix to allocate memory, with ServerMaxMessageSize allowing single allocations of up to ~2 GiB. A compromised implant or an attacker with valid credentials can exploit this by sending fabricated length prefixes over concurrent yamux streams (up to 128 per connection), forcing the server to attempt allocating ~256 GiB of memory and triggering an OS OOM kill. This crashes the Sliver server, disrupts all active implant sessions, and may degrade or kill other processes sharing the same host. The same pattern also affects all implant-side readers, which have no upper-bound check at all. The issue was not fixed at the the time of publication.
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the `next-resume: 1` header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing `maxPostponedStateSize` in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior. In applications using the App Router with Partial Prerendering capability enabled (via `experimental.ppr` or `cacheComponents`), an attacker could send oversized `next-resume` POST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service. This is fixed in version 16.1.7 by enforcing size limits across all postponed-body buffering paths and erroring when limits are exceeded. If upgrading is not immediately possible, block requests containing the `next-resume` header, as this is never valid to be sent from an untrusted client.
CVE-2026-1376 is a high-severity vulnerability affecting IBM i version 7.6, where improper allocation of resources during failed authentication attempts can lead to a denial of service (DoS). This flaw stems from CWE-770, which involves allocation of resources without proper limits or throttling. An unauthenticated remote attacker can exploit this by repeatedly attempting failed logins, causing resource exhaustion and service disruption. The vulnerability does not impact confidentiality or integrity but severely affects availability. No user interaction or privileges are required to exploit this issue, and no known exploits are currently reported in the wild. Organizations relying on IBM i 7.6 systems should prioritize mitigation to prevent potential DoS attacks. The vulnerability has a CVSS v3.1 base score of 7.
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit. This vulnerability is fixed in 2.2.4.
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.
Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted for signing. When parsing a Mach-O binary, Quill reads several size and count fields from the LC_CODE_SIGNATURE load command and embedded code signing structures (SuperBlob, BlobIndex) and uses them to allocate memory buffers without validating that the values are reasonable or consistent with the actual file size. Affected fields include DataSize, DataOffset, and Size from the load command, Count from the SuperBlob header, and Length from individual blob headers. An attacker can craft a minimal (~4KB) malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files. This vulnerability is fixed in 0.7.1.
CVE-2026-31960 is a medium-severity vulnerability in Anchore's Quill tool (versions before 0.7.1) that causes unbounded memory consumption during the Apple notarization process. Quill reads the entire HTTP response body from Apple's notarization service without size limits, which can lead to out-of-memory crashes if an attacker controls the response content. Exploitation requires the ability to intercept or modify HTTPS traffic, which is generally prevented by TLS certificate validation but possible in environments with TLS interception proxies or compromised certificate authorities. The impact is limited to availability, causing denial of service on the Quill client or library during notarization. There is no impact on confidentiality or integrity. The vulnerability is fixed in version 0.7.1.