A vulnerability in pypdf prior to version 6.21.0 allows an attacker to craft a PDF with a content stream containing many small operations, leading to excessive memory consumption during parsing. This uncontrolled resource consumption issue is fixed in version 6.21.0.
CVE-2026-113790 is a vulnerability in the py-pdf pypdf library prior to version 6.21.0. An attacker can craft a malicious PDF containing arrays or dictionaries with many elements, causing excessive memory consumption during parsing. This uncontrolled resource consumption can lead to denial of service. The issue is fixed in version 6.21.0.
CVE-2026-80463 is a high-severity vulnerability in Apache bRPC versions prior to 1.18.0 that allows remote attackers to cause a denial of service by exhausting server memory. The issue arises from unbounded memory accumulation in the stream message reassembly process when handling fragmented stream messages without limits on the accumulated size. This can be exploited by sending an endless sequence of continuation data frames, causing the server process to crash or become unavailable. The vulnerability affects services accepting streams from untrusted clients using the built-in streaming protocol.
CVE-2026-78066 is a resource exhaustion vulnerability in Apache bRPC versions prior to 1.18.0. Multiple parsers handling wire-controlled input do not limit the sizes declared by clients or the decompressed output, allowing attackers to cause excessive memory consumption and crash the service. The issue affects gzip/zlib/snappy decompressors, AMF string readers, RTMP chunk headers, sofa-pbrpc parser, and mcpack2pb message handling. The vulnerability is fixed in Apache bRPC version 1.18.0.
CVE-2026-74757 is a high-severity vulnerability in Apache bRPC versions prior to 1.18.0. It involves uncontrolled resource allocation in the mcpack2pb component, where a crafted request with a large array item count causes excessive memory allocation. This can lead to process termination due to memory exhaustion on constrained hosts. The issue arises because the parser trusts the declared item count without validating it against the actual payload size. The vulnerability is fixed in version 1.18.0.
CVE-2026-58064 is a vulnerability in Apache bRPC's Redis protocol implementation where the inline command parser allocates memory without proper limits before a complete command is received. This allows a remote attacker to send long inline inputs without a terminating CRLF, causing excessive memory and CPU usage that can lead to denial of service. The issue is fixed in Apache bRPC version 1.18.0.
CVE-2026-56387 is a high-severity vulnerability in Apache bRPC's RTMP AMF parser that allows remote unauthenticated attackers to cause excessive memory allocation or resource consumption by sending crafted AMF payloads with large declared string lengths or array counts. This occurs because the parser resizes buffers based on unvalidated length fields before verifying the actual payload size. The issue affects bRPC versions prior to 1.18.0 when RTMP is enabled and exposed to untrusted clients. The vulnerability is fixed in version 1.18.0, which introduces configurable limits on maximum string size and array element count to prevent excessive resource use.
NLnet Labs Unbound versions up to 1.26.1 have a vulnerability related to resource allocation without aggregate limits on decompression work. This allows an attacker with recursive-query access and control over a delegated authority to craft responses that cause excessive CPU usage, degrading Unbound's performance. The issue is fixed in version 1.26.2.
Crypt::Age versions before 0.004 for Perl contain a vulnerability that allows an attacker to cause CPU exhaustion by providing an unbounded number of recipient stanzas. Each stanza triggers expensive cryptographic operations during decryption, leading to denial of service. The vulnerability is fixed in version 0.004.
CVE-2026-113729 is a high-severity vulnerability in the moov-io signedxml Go library prior to version 1.4.1. The issue involves uncontrolled resource consumption caused by the ExclusiveCanonicalization function copying the entire accumulated namespace map at every nested XML element. An attacker can craft a deeply nested XML document with many unused namespace declarations, causing excessive memory allocation and potentially terminating the process. This vulnerability can be triggered through the ValidateReferences function without requiring a valid signature or authentication. The flaw is fixed in version 1.4.1.
ApostropheCMS versions prior to 4.33.0 and its import-export module prior to 3.7.0 contain an uncontrolled resource consumption vulnerability. The import routes invoke a middleware that allows unauthenticated users to initiate upload processes and consume resources before authentication checks occur. This flaw can lead to denial of service due to resource exhaustion. The issue is resolved in ApostropheCMS 4.33.0 and import-export 3.7.0.
ApostropheCMS versions prior to 4.33.0 contain an uncontrolled resource consumption vulnerability in the unauthenticated Rich Text CSV conversion route. This route writes multipart uploads to the system temporary directory before validating the file extension and does not remove rejected files. Attackers can exploit this by repeatedly uploading large invalid files, consuming disk space and potentially disrupting ApostropheCMS and other services sharing the same disk partition. The issue is fixed in version 4.33.0.
ApostropheCMS versions prior to 4.33.0 and its Form add-on prior to 1.5.5 have a vulnerability where the form submission route accepts unbounded multipart uploads before validation or authentication. This lack of upload size, count, and rate limits allows repeated unauthenticated submissions to consume temporary disk storage, potentially disrupting form handling and other services. The issue is fixed in ApostropheCMS 4.33.0 and Form add-on 1.5.5.
CVE-2026-105297 is a high-severity denial of service vulnerability in Pingora's HTTP/2 server before version 0.8.1. It arises from the server using default h2 crate limits without explicit application settings, allowing a remote unauthenticated client to exhaust memory by sending crafted HTTP/2 header frames. This can cause the Pingora process to be terminated due to out-of-memory conditions. Cloudflare's CDN customers are unaffected as their internal Pingora services do not use HTTP/2 clients.
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts of system resources.
CVE-2026-112400 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 9.2.0 up to but not including 13.0.0. It involves uncontrolled resource consumption due to a flaw in GIF frame size handling during decompression bomb checks. An attacker can craft a small GIF that causes Pillow to allocate gigabytes of memory, leading to denial of service by exhausting system memory. The issue arises because the image object retains a rejected oversized frame size after a DecompressionBombError, causing subsequent operations to allocate memory based on this stale size. This flaw does not cause memory corruption but can crash or kill the process due to out-of-memory conditions. The vulnerability was introduced in version 9.2.0 and fixed in version 13.0.0.
CVE-2026-110678 is a high-severity vulnerability in Cpanel::JSON::XS for Perl versions before 4.80. It allows memory exhaustion due to improper handling of incremental input buffering in the incr_parse function. The parser incorrectly compares the max_size limit with the progression offset rather than the actual buffer length, and certain input conditions cause the buffer to grow without limit, potentially exhausting process memory.
CVE-2026-111066 is a high-severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions from 2.0.0 up to but not including 3.14.4 are affected. The flaw allows unauthenticated attackers to exhaust server file descriptors by sending specially crafted multipart requests to handlers using Request.post(). This uncontrolled resource consumption issue is fixed in version 3.14.4.
CVE-2026-111065 is a vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.4 improperly handle Max-Age processing, which can overflow and prevent connections from closing properly. This can lead to temporary exhaustion of the connection pool until garbage collection reclaims the connections. The issue is fixed in version 3.14.4.
CVE-2026-111064 is a resource allocation vulnerability in aiohttp versions prior to 3.14.4. The flaw involves the absence of keepalive timeout handling during the initial phase of a request, allowing an attacker to keep idle connections open indefinitely without sending request data. This can exhaust server connection capacity. The issue is fixed in aiohttp version 3.14.4.