CWE-770: Unthrottled Resource Allocation vulnerabilities

A resource consumption vulnerability exists in the py-pdf fpdf2 library versions 2.5.0 through 2.8.7. The issue arises from nested SVG <use> references that cause exponential growth in memory and CPU usage during PDF generation, potentially leading to MemoryError and job failures. This flaw is fixed in version 2.8.8.

CVE-2026-75508 is a high-severity vulnerability in graphql-core, a Python port of GraphQL.js. The flaw exists in versions from 3.2.3 up to but not including 3.2.12 and from 3.3.0a3 up to but not including 3.3.0rc1. It involves uncontrolled resource consumption due to the parser's max_tokens limit counting only non-comment tokens, while comment tokens are still retained in memory. This allows an unauthenticated remote attacker to exhaust worker memory by sending a comment-padded GraphQL document before depth or complexity controls are applied. The issue is fixed in versions 3.2.12 and 3.3.0rc1.

CVE-2026-115454 is a medium severity vulnerability in KNIME Business Hub prior to version 1.19.0. It involves excessive resource allocation in the remote workflow editing feature, which an authenticated attacker can exploit to exhaust server resources. This exhaustion causes intermittent unavailability of workflow execution functionality. No workaround is available, but the issue is fixed in version 1.19.0.

CVE-2026-94482 is a high-severity vulnerability in the Next.js React framework affecting versions from 13.0.0 up to but not including 15.5.28 and from 16.0.0 up to but not including 16.4.1. Crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption, leading to blocking of further request processing in the same process. Applications using the Pages Router or App Router without Server Actions are not affected. The issue is fixed in versions 15.5.28 and 16.4.1.

CVE-2026-115482 is a high-severity vulnerability in lsquic versions before 4.9.0 where the HTTP/3 implementation allows excessive memory use due to unlimited buffered header sets. This can be exploited via a QPACK amplification attack, related to the handling of header_out_dynamic_entry and es_max_header_list_size. The issue is fixed in version 4.9.0.

CVE-2026-86696 is a high-severity vulnerability in the esaml library used by handnot2. It allows an unauthenticated attacker to exhaust the Erlang VM atom table by sending unsigned LogoutResponse messages with numerous distinct status codes. This leads to a denial-of-service condition by crashing the node. The vulnerability arises because esaml converts unrecognized status codes into atoms without limits, and atoms are never reclaimed in the Erlang VM.

CVE-2026-105270 is a high-severity vulnerability in the arekinath esaml library affecting versions from 0.1.0 onward. It involves allocation of resources without limits or throttling in the esaml_binding component. An unauthenticated attacker can send a crafted SAMLResponse that causes the Erlang VM atom table to exhaust and crash the node. This occurs because the decode_response function interns every XML element, attribute, and namespace prefix as a permanent atom, which are never reclaimed. The vulnerability can be triggered before signature verification, allowing denial of service via resource exhaustion.

CVE-2026-114731 is a resource exhaustion vulnerability in Roundcube Webmail's CSS proxy component affecting versions before 1.6.20 and 1.7.5. The vulnerability allows an attacker to cause uncontrolled memory consumption by referencing a stylesheet URL from an attacker-controlled host, as the proxy reads the entire stylesheet into memory without size limits or timeouts. This can lead to denial of service due to server memory exhaustion. The issue was fixed by introducing a 5 MB size limit, streaming reads, and a read timeout in the CSS proxy.

CVE-2026-114723 is a vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. It allows bypassing ImageMagick resource limits during thumbnail generation when the system falls back to the GD library. On non-Windows platforms, the memory check was not applied, enabling crafted images with large dimensions to exhaust server memory. This issue was fixed by applying the memory check on all platforms in versions 1.6.20 and 1.7.5.

CVE-2026-96365 is a high severity vulnerability in the Drupal Webform module involving allocation of resources without limits or throttling. This flaw allows excessive resource consumption, potentially leading to denial of service. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. Fixed versions are 6.2.12 and 6.3.1.

CVE-2026-96377 is a resource allocation vulnerability in the Drupal Combined image style module. It allows excessive allocation of resources without limits or throttling, potentially leading to denial of service. The issue affects versions prior to 1.0.7. A fix is available in version 1.0.7. The vulnerability has a medium severity rating with a CVSS score of 5.3 and does not impact confidentiality or integrity, only availability.

Algorithm::UrataniTakeda versions 0.1.5 up to but not including 0.1.7 for Perl contain a vulnerability where a failure shift cache used in the search process is never cleared. This causes memory to grow with each search when processing text with many distinct characters, leading to potential memory exhaustion.

A vulnerability in the BmpRleDecoder component of the python-pillow Pillow library allows crafted BMP files to cause uncontrolled memory allocation. This occurs due to unbounded growth in the delta escape and absolute mode branches during decoding, leading to a severe memory amplification denial-of-service (DoS). The flaw affects all versions before 13.0.0. A fix is available in version 13.0.0 that caps memory growth and rejects out-of-bounds deltas.

CVE-2026-114144 is a high-severity vulnerability in the BinaryMuse toml-node library prior to version 5.0.1. The vulnerability arises because the toml.parse() function converts unbounded long integer strings to BigInt before checking if they fit within the TOML 64-bit integer range. This conversion of very long integer strings consumes super-linear CPU time and blocks the Node.js event loop synchronously, enabling a denial of service (DoS) attack via a crafted TOML document. The issue is fixed in version 5.0.1.

A vulnerability in Django REST framework versions from 3.6.4 up to but not including 3.18.2 allows remote unauthenticated clients to send highly compressed JSON request bodies that expand significantly in memory after initial size checks. This improper handling of compressed data can cause excessive memory consumption per worker, potentially leading to denial of service. The issue is fixed in version 3.18.2.

CVE-2026-113795 is a vulnerability in the py-pdf pypdf library prior to version 6.20.0. It involves uncontrolled resource consumption caused by processing crafted PDF streams with many filters or multiple filters that handle large data volumes. This can lead to excessive memory usage. The issue is resolved in version 6.20.0.