CWE-400: Uncontrolled Resource Consumption vulnerabilities

CVE-2026-113790 is a vulnerability in the py-pdf pypdf library prior to version 6.21.0. An attacker can craft a malicious PDF containing arrays or dictionaries with many elements, causing excessive memory consumption during parsing. This uncontrolled resource consumption can lead to denial of service. The issue is fixed in version 6.21.0.

CVE-2026-113789 is a vulnerability in the py-pdf pypdf library prior to version 6.21.0. It allows an attacker to craft a malicious PDF that triggers excessive memory consumption or prolonged runtimes when an application processes the document's form fields. This uncontrolled resource consumption issue is addressed in pypdf version 6.21.0.

Apache bRPC versions prior to 1.18.0 contain vulnerabilities allowing remote attackers to control file paths and cause resource exhaustion via builtin services. Attackers can create directories and overwrite files with server process privileges by manipulating the /flags service parameters. Additionally, the /pprof service allows unbounded profiling durations, causing denial of service by holding profiling resources indefinitely. These issues affect any bRPC server exposing builtin services to untrusted networks.

CVE-2026-81755 is a high-severity vulnerability in Apache bRPC versions prior to 1.18.0. It involves uncontrolled resource consumption in the streaming RPC component, where a remote attacker can send a single RPC request declaring an excessive number of streams. This causes the server to allocate excessive memory and resources, leading to denial of service. The issue is fixed in version 1.18.0 by limiting the number of streams accepted per request.

CVE-2026-78058 is an uncontrolled resource consumption vulnerability in Apache bRPC versions prior to 1.18.0 affecting the HTTP/2 receive path. It allows remote unauthenticated attackers to crash the server or cause unbounded memory growth by sending crafted HTTP/2 frames. The vulnerability arises because the server does not enforce advertised receive-side limits, leading to excessive concurrent streams, oversized header lists, unchecked control-frame acknowledgments, and HPACK dynamic table desynchronization. This affects any bRPC server or client communicating over HTTP/2 or gRPC on untrusted networks. The issue is fixed in version 1.18.0, which enforces limits on concurrent streams, header list size, and control-frame acknowledgments by default.

Apache bRPC versions before 1.18.0 have a vulnerability where the configured max_body_size limit is not consistently enforced during certain HTTP and response parsing operations. This allows a remote unauthenticated attacker to cause excessive memory buffering, potentially leading to denial of service due to memory exhaustion. The issue is fixed in version 1.18.0.

CVE-2026-41114 is an Uncontrolled Resource Consumption vulnerability in the Apache IoTDB JDBC driver affecting versions from 1.3.3 up to but not including 2.0.11. This flaw can lead to denial of service due to resource exhaustion. The issue is fixed in version 2.0.11.

The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.

CVE-2026-93441 is a high-severity vulnerability in IBM QRadar Security Information and Event Management (SIEM) that allows a remote attacker to cause a denial of service by triggering uncontrolled resource consumption. This flaw affects specific versions of QRadar from 7.4 through 7.6. The vulnerability does not impact confidentiality or integrity but can severely disrupt availability.

CVE-2026-113729 is a high-severity vulnerability in the moov-io signedxml Go library prior to version 1.4.1. The issue involves uncontrolled resource consumption caused by the ExclusiveCanonicalization function copying the entire accumulated namespace map at every nested XML element. An attacker can craft a deeply nested XML document with many unused namespace declarations, causing excessive memory allocation and potentially terminating the process. This vulnerability can be triggered through the ValidateReferences function without requiring a valid signature or authentication. The flaw is fixed in version 1.4.1.

markdown-it versions 14.1.0 through before 14.3.3 and 15.0.0 through before 15.0.3 contain a vulnerability causing uncontrolled resource consumption (CWE-400). This occurs when processing a link reference definition with an unclosed label or title, leading to quadratic time complexity in parsing. The issue has been fixed in versions 14.3.3 and 15.0.3.

ApostropheCMS versions prior to 4.33.0 and its import-export module prior to 3.7.0 contain an uncontrolled resource consumption vulnerability. The import routes invoke a middleware that allows unauthenticated users to initiate upload processes and consume resources before authentication checks occur. This flaw can lead to denial of service due to resource exhaustion. The issue is resolved in ApostropheCMS 4.33.0 and import-export 3.7.0.

ApostropheCMS versions prior to 4.33.0 and db-connect versions prior to 1.1.0 contain a vulnerability where accounts with view-draft access can submit a crafted projection exclusion path that manipulates the prototype chain, leading to deletion of shared runtime members. This causes persistent process-wide integrity and availability issues. The vulnerability affects SQLite, PostgreSQL, and multipostgres adapters but not the default MongoDB adapter. The issue is fixed in ApostropheCMS 4.33.0 and db-connect 1.1.0.

ApostropheCMS versions prior to 4.33.0 contain an uncontrolled resource consumption vulnerability in the unauthenticated Rich Text CSV conversion route. This route writes multipart uploads to the system temporary directory before validating the file extension and does not remove rejected files. Attackers can exploit this by repeatedly uploading large invalid files, consuming disk space and potentially disrupting ApostropheCMS and other services sharing the same disk partition. The issue is fixed in version 4.33.0.

ApostropheCMS versions prior to 3.7.1 of the import-export module and versions before 4.34.0 are affected by an uncontrolled resource consumption vulnerability. An authenticated user importing archives can submit data with unbounded decompressed size, entry count, and entry sizes before authorization checks, potentially causing denial of service. Extraction or parsing failures may leave residual staging and extracted artifacts without guaranteed cleanup. This issue is fixed in version 3.7.1.

CVE-2026-95108 is a resource exhaustion vulnerability in Eclipse Foundation's Eclipse ThreadX affecting versions 6.0.1 through 6.5.1.202602a. The flaw arises because the Module Manager's thread-delete dispatcher releases only one of two allocated memory blocks per user-mode thread, causing the kernel stack allocation to remain until the entire module is stopped. This leads to gradual depletion of a finite shared object pool, eventually preventing creation of new kernel objects and user-mode threads system-wide.

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose this on initial per-instance opening, and versions from 3.30.0 repeat the exposure on every acquisition. This issue is fixed in version 4.2.1.

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.

CVE-2026-112400 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 9.2.0 up to but not including 13.0.0. It involves uncontrolled resource consumption due to a flaw in GIF frame size handling during decompression bomb checks. An attacker can craft a small GIF that causes Pillow to allocate gigabytes of memory, leading to denial of service by exhausting system memory. The issue arises because the image object retains a rejected oversized frame size after a DecompressionBombError, causing subsequent operations to allocate memory based on this stale size. This flaw does not cause memory corruption but can crash or kill the process due to out-of-memory conditions. The vulnerability was introduced in version 9.2.0 and fixed in version 13.0.0.