CWE-400: Uncontrolled Resource Consumption vulnerabilities

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

CVE-2026-68496 is a high-severity vulnerability in the Smile parser component of FasterXML jackson-dataformats-binary. The parser fails to enforce the maxNameLength limit on JSON object property names, allowing an attacker to submit a Smile document with an unboundedly long property name. This leads to uncontrolled memory allocation and potential denial of service due to memory exhaustion. The issue affects multiple jackson-dataformats-binary versions starting from 2.16.0 where the constraint was introduced but not enforced. No special privileges are required to exploit this vulnerability.

CVE-2026-68495 is a high-severity vulnerability in the CBOR parser of FasterXML jackson-dataformats-binary. The parser does not enforce the maxNameLength limit when decoding JSON object property names in CBOR format, allowing an attacker to submit a property name of unbounded length. This can lead to memory exhaustion and denial of service due to unbounded memory allocation during parsing. No special privileges are required beyond the ability to submit data to the parser. The issue affects multiple versions starting from 2.16.0 where the maxNameLength constraint was introduced but not enforced in this parser. The vulnerability is tracked alongside a related Smile parser defect under the same vendor advisory.

CVE-2026-103000 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by unusually large alphabetical page-label values in crafted PDFs. This leads to excessive memory use and can potentially make applications using pypdf unavailable. The issue is fixed in version 6.19.0.

CVE-2026-102999 is a high-severity vulnerability in the pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by the dictionary-based attachments API reparsing the full attachment list repeatedly when processing crafted PDFs with many embedded files. This leads to excessive CPU usage and long runtimes during embedded-file mapping access. The issue is fixed in pypdf version 6.19.0.

CVE-2026-102144 is a resource exhaustion vulnerability in Kiteworks Email Protection Gateway that allows an unauthenticated remote attacker to repeatedly trigger an expensive server-side operation, causing a partial denial of service. The vulnerability is due to missing authentication for a critical function. It affects versions from 0 up to but not including 9.5.1. The CVSS score is 5.3 (medium severity). No known exploits are reported in the wild and no patch information is provided.

CVE-2026-102998 is a high-severity vulnerability in the pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by inefficient processing of appearance-stream generation when updating PDF form fields with flattening enabled. This can lead to excessive runtimes and potential application unavailability. The issue is fixed in pypdf version 6.19.0.

pypdf versions prior to 6.18.1 contain a vulnerability where a crafted PDF with a malformed /FlateDecode stream causes inefficient byte-by-byte decompression. This leads to excessive resource consumption, resulting in long runtimes and potential application unavailability. The issue is a residual problem after a previous fix related to malformed FlateDecode recovery. The vulnerability is fixed in version 6.18.1.

CVE-2026-102996 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.18.1. It involves uncontrolled resource consumption caused by processing an unusually large /Widths array in a crafted PDF's simple font. This leads to excessive memory usage during operations like text extraction. The issue is fixed in pypdf version 6.18.1.

CVE-2026-102995 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.18.1. It involves uncontrolled resource consumption caused by crafted PDFs that place unusually large tokens in a font /ToUnicode mapping. This triggers excessive memory use during text extraction operations. The issue is fixed in version 6.18.1.

CVE-2026-102994 is a high-severity vulnerability in the pypdf library prior to version 6.18.0. It involves uncontrolled resource consumption caused by crafted PDFs containing long sequences of indirect-object identifiers or generation-number tokens without whitespace. This leads to excessive scanning in specific pypdf modules, resulting in long runtimes and potential application unavailability. The issue is resolved in pypdf version 6.18.0.

CVE-2026-102993 is a high-severity vulnerability in the pypdf Python library prior to version 6.17.0. It involves uncontrolled resource consumption caused by processing crafted PDF files with unusually large Roman page-label values. This leads to excessive memory use and potential application unavailability. The issue is fixed in pypdf version 6.17.0.

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause uncontrolled kernel log generation by repeatedly invoking an interface that emits unrate-limited error messages. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontrolled resource consumption by exhausting the DRM VMA offset address space. A successful exploit of this vulnerability might lead to denial of service.

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.

CVE-2026-102821 is an uncontrolled resource consumption vulnerability in the Eugeny russh Rust SSH client and server library. Versions prior to 0.63.2 allow an authenticated remote peer to flood SSH_MSG_CHANNEL_OPEN messages without sending the required SSH_MSG_KEX_ECDH_INIT, causing the server to enqueue replies on an unbounded channel. This leads to memory growth until the process is terminated. The issue is fixed in version 0.63.2.