An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
`django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Jaeyoung Jang for reporting this issue.
CVE-2026-58067 is a high-severity vulnerability in Veeam Service Provider Console that allows an unauthenticated attacker to exhaust host memory, resulting in a denial of service condition. The flaw is related to improper handling of memory allocation with excessive size values (CWE-789). No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-12185 is a high severity vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library. It involves memory allocation with excessive size values in BKS/UBER keystore implementations before integrity checks are performed. This affects versions prior to 1.85 and versions from 2.73.0 up to but not including 2.73.12.
CVE-2026-12852 is a high-severity vulnerability in Bouncy Castle for Java (BC-JAVA) versions from 1.73 up to but not including 1.85. The issue involves the MLS wire decoder allocating memory based on an attacker-controlled opaque length value before performing bounds checking, which can lead to excessive memory allocation.
CVE-2026-14682 is a high-severity vulnerability in Bouncy Castle for Java (BC-JAVA) affecting multiple versions before certain fixed releases. It involves a memory allocation issue where unbounded allocation can occur during a definite-length read, potentially leading to an out-of-memory (OOM) condition. This flaw affects several branches including the main BC-JAVA, the LTS version, and various FIPS-certified versions. Fixed versions have been released to address this issue.
CVE-2026-58060 is a high-severity vulnerability in Bouncy Castle for Java (BC-JAVA) affecting versions before 1.85, 2.73.12, 2.0.2, and 2.1.3. The flaw involves an unbounded HSS public-key level count that can trigger excessive memory allocation during verification. This can lead to resource exhaustion and potential denial of service. The issue affects multiple Bouncy Castle Java variants including the LTS and FIPS versions.
A high-severity vulnerability (CVE-2026-59646) exists in Bouncy Castle for Java (BC-JAVA) where the DTLS handshake reassembler allocates a buffer based on an unchecked 24-bit length value. This affects versions before 1.85 and versions from 2.73.0 up to but not including 2.73.12, including certain FIPS series releases. The unchecked allocation can lead to excessive memory allocation, classified under CWE-789.
CVE-2026-59649 is a high severity vulnerability in Bouncy Castle for Java (BC-JAVA) involving memory allocation with an excessive size value. Specifically, the OpenPGP user-attribute subpacket length is only bounded by the JVM's maximum memory, potentially leading to excessive memory allocation. This affects versions before 1.85, as well as certain 2.x LTS and FIPS series versions prior to specified patch releases.
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.
CVE-2026-54638 is a high severity vulnerability in gotd/td, a Telegram MTProto API client written in Go. Versions prior to 0.145.1 contain a flaw in proto.UnencryptedMessage.Decode where an attacker-controlled length value is used to allocate memory without verifying the buffer size first. This can lead to remote unauthenticated denial of service due to excessive memory allocation and increased CPU or garbage collection load. The issue is fixed in version 0.145.1.
Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.
The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)".
The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).
Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).
This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.
CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.
A vulnerability in libssh allows a remote authenticated client to send SSH_FXP_READ requests with an arbitrarily large length, causing the SFTP server to allocate excessive memory. This can lead to memory exhaustion and denial of service through repeated requests. The issue is tracked as CVE-2026-59844 with a CVSS score of 6.5 (medium severity). Red Hat has released an update for libssh to address this flaw. No workaround is available, so applying the vendor's update is the recommended mitigation.
Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget, affecting any message decoded from untrusted input using code generated with preserve_unknown_fields=true (the default); a small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22x memory amplification (for example a 64 MiB input forcing about 1.4 GB of heap allocation), and length-delimited unknown fields could be sized arbitrarily, so an unauthenticated attacker could crash a process through memory exhaustion because the top-level message size cap did not account for in-decode amplification. This issue is fixed in version 0.8.0.
Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.