CVE-2026-111766 is a denial-of-service vulnerability in markdown-it, a Markdown parser. It occurs in versions prior to 14.3.3 and 15.0.3 when the html option or commonmark preset is enabled. The vulnerability is triggered by attacker-controlled Markdown containing repeated unterminated inline HTML comments or similar constructs inside a paragraph. This causes the parser to perform quadratic processing, leading to event-loop blocking or an unresponsive browser main thread. The issue does not affect HTML blocks or the default HTML-disabled configuration. Fixed in versions 14.3.3 and 15.0.3.
markdown-it versions prior to 14.3.2 and 15.0.2 have a vulnerability in the smartquotes rule when the typographer option is enabled. Specially crafted Markdown input can cause quadratic processing time, leading to potential denial of service due to uncontrolled resource consumption. The default configuration with typographer disabled is not affected. This issue is fixed in versions 14.3.2 and 15.0.2.
CVE-2026-111066 is a high-severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions from 2.0.0 up to but not including 3.14.4 are affected. The flaw allows unauthenticated attackers to exhaust server file descriptors by sending specially crafted multipart requests to handlers using Request.post(). This uncontrolled resource consumption issue is fixed in version 3.14.4.
CVE-2026-12343 is a vulnerability in IBM MQ Operator where improper validation of RFH2 message header fields in queued publish/subscribe operations can allow an authenticated attacker to cause a denial of service. The flaw leads to uncontrolled resource consumption, impacting availability. A fix is available starting from version 3.4.0.
CVE-2026-108121 is a vulnerability in Koozali SME Server version 11.0rc1-215 affecting the domain creation functionality. An attacker with high privileges can inject reserved Apache configuration directives, corrupting the httpd.conf file. This corruption prevents the Apache web server from starting after a reboot, causing a denial-of-service (DoS) condition impacting the web server and its hosted virtual hosts.
CVE-2026-68498 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.16.0 onward. It involves uncontrolled resource consumption due to improper enforcement of the maxNameLength constraint when parsing JSON property names from character-based inputs (e.g., String, Reader, char[]). This allows an attacker to cause excessive memory allocation, potentially exhausting heap memory and crashing the process. Byte-input parsers are not affected. The issue arises because the name length check is delayed until after a large buffer allocation, exceeding the intended limit. No authentication is required, and the default configuration is vulnerable.
CVE-2026-77474 is a high-severity vulnerability in destructive_command_guard (dcg), a command-line safety tool that blocks destructive shell commands before AI coding agents execute them. Versions prior to 0.6.6 are affected by uncontrolled resource consumption due to recursive rescanning triggered by nested or unclosed substitution sequences like $( or $((. This leads to exponential-time processing and can cause the PreToolUse hook to hang and fail open, allowing destructive commands to proceed. The issue is fixed in version 0.6.6.
CVE-2026-111252 is a denial of service vulnerability in OpenNMS Meridian and Horizon XML parsing. It occurs due to improper restriction of recursive entity references in DTDs, allowing an authenticated user with provisioning access to supply XML documents that cause excessive entity expansion and exhaust server memory. The vulnerability affects multiple versions prior to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5. The vendor has released fixes that cap entity expansions and reject DOCTYPE declarations in requisition and foreign-source XML. These products are intended for private network installation and not direct Internet exposure.
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.
Lychee versions prior to 7.7.0 contain an uncontrolled resource consumption vulnerability in the ImagickHandler::loadPdf() function. An authenticated user can upload a crafted PDF with an oversized /MediaBox, causing excessive CPU usage during image processing. This can lead to denial of service by occupying web workers or clogging the image-processing queue. The issue is fixed in version 7.7.0.
CVE-2026-100350 is a medium severity vulnerability in the getkin kin-openapi library affecting versions >=0.145.0 and <0.146.0. It involves uncontrolled resource consumption due to repeated compilation of an invariant regular expression inside a loop over all query keys when decoding deepObject-style query parameters. This causes CPU usage to scale linearly with the number of query keys, enabling denial of service by sending requests with many junk query keys.
CVE-2026-105659 is a high-severity uncontrolled resource consumption vulnerability in the mtrudel bandit HTTP/2 implementation. It allows an unauthenticated remote attacker to keep HTTP/2 stream processes pinned indefinitely by sending a trickle of small WINDOW_UPDATE frames. This behavior causes server processes and memory to be exhausted by maintaining blocked streams and their associated resources. The vulnerability affects bandit versions from 1.4.0 up to but not including 1.13.0.
CVE-2026-59951 is a medium severity vulnerability in the modelcontextprotocol python-sdk affecting versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1. The issue involves uncontrolled resource consumption due to a Streamable HTTP server in stateful mode that never reclaims session state, allowing unlimited sessions to accumulate and consume memory. This can lead to server memory growth without bound until a restart occurs. The vulnerability is fixed in versions 1.30.0 and 2.2.0, which introduce session idle timeouts, maximum session limits, and proper session cleanup.
CVE-2026-67414 is a medium severity vulnerability in rabbitmq-server affecting versions prior to 4.0.24, 4.1.15, 4.2.10, and 4.3.4. It allows a low-privilege client to cause uncontrolled resource consumption by sending specially crafted AMQP 1.0 arrays with zero-width shared constructors after SASL authentication. This can lead to large memory allocations, triggering node-wide memory alarms and blocking message publishing.
CVE-2026-101896 is a high-severity vulnerability in the @angular/router URL parser affecting server-side rendering (SSR) in Node.js environments. Prior to fixed versions 20.3.32, 21.2.24, and 22.2.0, the router stores numeric matrix parameter names and numeric outlet names as properties on JavaScript objects. This can cause V8 to allocate large dense arrays, leading to excessive heap consumption. An unauthenticated attacker can exploit this by sending crafted requests with repeated numeric parameters, exhausting the Node.js heap and terminating the SSR worker. Pure client-side Angular applications are not affected. The issue is fixed in the specified versions.
A case sensitivity handling flaw in darylldoyle svg-sanitizer versions prior to 1.0.0 allows an attacker to bypass useNestingLimit protection by exploiting inconsistent href attribute normalization. This can lead to resource exhaustion when rendering sanitized SVGs. The issue is fixed in version 1.0.0.
CVE-2026-100139 is an Uncontrolled Resource Consumption vulnerability in Adobe Content Credentials Rust SDK that can lead to application denial-of-service. The flaw allows an attacker to exhaust system resources without requiring any user interaction, potentially causing the application to become unavailable. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-105902 is an uncontrolled resource consumption vulnerability in Adobe Content Credentials Rust SDK that can lead to application denial-of-service. The vulnerability allows an attacker to exhaust system resources without requiring user interaction, causing the application to become unavailable. It has a high severity rating with a CVSS score of 7.5.
CVE-2026-100137 is an Uncontrolled Resource Consumption vulnerability in Adobe Content Credentials Rust SDK that can lead to application denial-of-service. The vulnerability allows an attacker to exhaust system resources without requiring user interaction, causing the application to become unavailable. It has a high severity rating with a CVSS score of 7.5.
CVE-2026-106627 is an Uncontrolled Resource Consumption vulnerability in Adobe Content Credentials Rust SDK that can lead to application denial-of-service. The vulnerability allows an attacker to exhaust system resources without requiring user interaction, causing the application to become unavailable. It has a high severity rating with a CVSS score of 7.5.