CWE-770: Unthrottled Resource Allocation vulnerabilities

CVE-2026-14511 is a vulnerability in IBM MQ versions 9.4.5.0 through 9.4.5.1 where an authenticated user can cause a denial of service by sending a specially crafted message that crashes consuming applications.

CVE-2026-111061 is a resource exhaustion vulnerability in the Eugeny russh Rust SSH client and server library. Versions prior to 0.64.1 improperly handle SSH_AGENT_CONSTRAIN_LIFETIME records by spawning a separate long-lived task for each record without limits or rollback on parsing failures. This can lead to memory and task exhaustion, causing denial of SSH agent service. The issue is fixed in version 0.64.1.

CVE-2026-108837 is a high-severity vulnerability in Apache Kylin versions 4.0.0 through 5.0.4. It involves allocation of resources without limits or throttling, which can lead to resource exhaustion when an attacker with project admin permissions uses a cache API related to computed columns. The issue is fixed in version 5.0.5.

CVE-2026-105964 is a vulnerability in Gitea's Actions artifact v4 (Twirp) handlers where the request body is read into memory without size limits. This allows a user with workflow execution and runner token access to send an oversized request, exhausting server memory and causing process termination. The issue has been addressed by limiting the request body size to 1 MiB.

Text::CSV_XS versions before 1.65 for Perl contain a vulnerability where memory exhaustion can occur due to allocation of one entry per index of an RFC 7111 selector in the fragment parameter. This happens because the fragment expands selectors into large arrays without limiting the size, allowing an attacker to cause an out-of-memory error that terminates the process.

CVE-2026-57487 is a vulnerability in pupnp prior to version 2.0.2 where chunked Transfer-Encoding HTTP requests can cause the HTTP parser to accumulate decoded chunked bodies without enforcing size limits. This leads to resource exhaustion and denial of service. The issue is fixed in version 2.0.2.

CVE-2026-95859 is a high-severity vulnerability in libp2p-rust prior to version 0.49.5. It involves the Gossipsub GRAFT control-message handling, which improperly adds attacker-supplied topic hashes to a peer's topic list without verifying prior subscription. This allows a remote unauthenticated attacker to cause unbounded memory growth per peer, potentially leading to denial of service by exhausting process memory. The issue is fixed in version 0.49.5.

An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.

CVE-2026-16251 is a vulnerability in Mattermost versions 11.7.0, 11.8.0, 11.9.0, and 11.10.0 where the application fails to limit the size of remote image responses buffered in memory during local image proxy direct fetches. This flaw allows a remote attacker to cause memory exhaustion on the server by sending a crafted oversized image response.

CVE-2026-19867 is a resource allocation vulnerability in Mattermost versions 11.7.0, 11.8.0, 11.9.0, and 11.10.0. It arises because the software does not limit the number or size of mention keys stored in a user's notification properties, nor does it bound the quadratic multibyte-keyword matching during post processing. An authenticated user can exploit this by storing an oversized mention_keys list in their profile, causing excessive CPU consumption and degraded post-processing latency for other channel members.

CVE-2026-109468 is a high-severity vulnerability in Microsoft Visual Studio 2022 version 17.14 and related versions, involving allocation of resources without limits or throttling in ASP.NET Core. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network by exhausting resources. The vulnerability has been officially fixed in versions 17.14.42, 18.10.4, and 10.0.13.

A resource exhaustion vulnerability exists in reactphp http versions from 1.0.0 up to but not including 1.11.1. The ClientRequestStream::handleData() method appends response-header bytes to an internal buffer without size limits, allowing a remote server to cause unbounded memory growth by sending partial headers without terminating sequences. This can exhaust PHP memory and crash the event loop or worker process. The issue does not affect confidentiality or integrity. It is fixed in version 1.11.1.

Lychee versions prior to 7.7.0 expose the Scramble-generated OpenAPI documentation at the GET /docs/api endpoint to unauthenticated users. This endpoint regenerates the schema on each request without caching or throttling, allowing a remote attacker to repeatedly request it and consume server CPU resources. The vulnerability is fixed in version 7.7.0.

Lychee versions prior to 7.7.0 contain an uncontrolled resource consumption vulnerability in the ImagickHandler::loadPdf() function. An authenticated user can upload a crafted PDF with an oversized /MediaBox, causing excessive CPU usage during image processing. This can lead to denial of service by occupying web workers or clogging the image-processing queue. The issue is fixed in version 7.7.0.

CVE-2026-100350 is a medium severity vulnerability in the getkin kin-openapi library affecting versions >=0.145.0 and <0.146.0. It involves uncontrolled resource consumption due to repeated compilation of an invariant regular expression inside a loop over all query keys when decoding deepObject-style query parameters. This causes CPU usage to scale linearly with the number of query keys, enabling denial of service by sending requests with many junk query keys.

CVE-2026-110726 affects Eclipse Connected Services Platform's api-gateway component up to version 1.7.3. The default rate-limit key resolver uses the leftmost element of the X-Forwarded-For header, which is attacker-controlled and not validated against trusted proxies. This allows attackers to bypass request-rate limiting by using unique header values to create unlimited independent rate-limit buckets.

Pipecat-ai pipecat versions from 0.0.98 up to but not including 1.6.0 include a development runner exposing unauthenticated endpoints for creating bot sessions and Daily rooms. These endpoints are bound to localhost by default and intended only for local development. Exploitation requires deliberate exposure of the runner to untrusted networks. Version 1.6.0 adds warnings and documentation directing users to authenticated or managed production deployments but does not change endpoint behavior.

CVE-2026-109527 is a high-severity vulnerability in the Model Context Protocol Python SDK affecting versions before 1.29.1 and from 2.0.0a1 up to but not including 2.1.0. The issue involves the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffering entire HTTP request bodies without enforcing size limits. This allows an unauthenticated remote attacker to send large request bodies that exhaust server memory, potentially causing denial of service. Servers using stdio-only or with upstream request size limits are not affected. The vulnerability is fixed in versions 1.29.1 and 2.1.0.

CVE-2026-108395 is a high-severity vulnerability in the Model Context Protocol Java SDK affecting multiple versions of the io.modelcontextprotocol.sdk:mcp artifact and mcp-core. The issue arises because certain server transports read HTTP request bodies into memory without enforcing a maximum size limit. This allows an unauthenticated remote attacker to send arbitrarily large POST requests, potentially exhausting the Java process heap and causing denial of service. The vulnerability affects versions from 0.8.0 up to but not including 0.13.0, from 0.13.0 up to 0.18.4, from 1.0.0 up to 1.1.4, and from 2.0.0-M1 up to 2.0.1. Fixed versions are 0.18.4, 1.1.4, and 2.0.1. Mitigations include authentication, origin or host validation, or upstream request size limits to reject malicious requests before they reach the vulnerable code.

CVE-2026-102048 is a resource allocation vulnerability in the l2cpd process of Juniper Networks Junos OS. It allows an adjacent unauthenticated attacker to cause denial of service and restart of the l2cpd process via FNP-enabled Layer 2 interfaces. The issue occurs when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation. All Junos OS platforms except PTX and SRX Series are affected.