CVE-2026-77299 is a high-severity vulnerability in the dlclark regexp2 library for Go, affecting versions prior to 2.3.0. It involves uncontrolled resource consumption when compiling and matching patterns with large fixed-count quantifiers applied to zero-width subexpressions. This can cause the match engine to allocate multi-gigabyte memory, potentially leading to out-of-memory (OOM) termination of the process. The issue is patched in version 2.3.0.
OpenHuman versions prior to 0.57.44 have a security vulnerability in the local /ws/dictation WebSocket endpoint, which lacks client authentication and browser-origin validation. This allows unauthenticated clients, including malicious web pages, to submit audio and trigger resource-intensive speech-to-text processing. Earlier versions also have an unbounded audio buffer, enabling continuous streaming that can exhaust process memory and degrade or crash the application. The issue is fixed in version 0.57.44.
ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in `mdns_utils_read_fqdn()`. An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an `ESP-IDF` device using `espressif/mdns` with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.
CVE-2026-74841 is an uncontrolled resource consumption vulnerability in Apache OFBiz affecting versions prior to 24.09.08. In multitenant deployments, the application builds a per-tenant delegator name from a user-supplied tenant ID before verifying tenant existence. The internal cache retains all delegator names requested, including invalid ones, allowing an unauthenticated attacker to submit arbitrary tenant IDs and cause unbounded cache growth, leading to increased memory and database load.
CVE-2026-33971 is a vulnerability in the LTE RRC component of the Samsung Semiconductor Exynos 850 chipset. It involves improper handling of messages received before authentication, which triggers a data abort and results in a denial-of-service (DoS) condition. A fix for this issue was released in October 2026.
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a local attacker to cause a denial of service by triggering uncontrolled resource consumption. The vulnerability is identified as CWE-400 and results in availability impact without affecting confidentiality or integrity.
SEPPmail Secure Email Gateway (SEG) versions before 15.1.1 have an uncontrolled resource consumption vulnerability (CWE-400). The product processes and writes v1 file-interface upload data before authenticating the caller and lacks an absolute request-size limit. This allows an unauthenticated remote attacker to consume system resources by sending concurrent or slow requests, potentially causing service unavailability. The issue is fixed in version 15.1.1.
CVE-2026-111751 is a high-severity vulnerability in Angular versions 21.2.0 through 21.2.24 and 22.0.0 through 22.2.0. It involves uncontrolled resource consumption during Node.js server-side rendering when RouterLink directives retain computed UrlTree instances containing attacker-controlled query parameters. This can lead to excessive memory use and termination of the SSR worker. The issue is fixed in Angular versions 21.2.25 and 22.2.1.
CVE-2026-111752 is a high-severity vulnerability in Angular's @angular/router for Node.js server-side rendering (SSR). It allows an unauthenticated remote attacker to cause uncontrolled resource consumption by sending crafted requests with multiple unconfigured empty-path outlet groups. This leads to repeated route evaluations, duplicate route snapshot trees, and excessive CPU and heap usage, potentially terminating SSR workers. The issue affects versions prior to 20.3.33, 21.2.25, and 22.2.1 and does not impact client-side SPAs or build-time prerendering. Fixed versions are 20.3.33, 21.2.25, and 22.2.1.
A resource consumption vulnerability exists in isomorphic-git versions prior to 1.38.6. The library reads a server-controlled targetSize value when applying a packfile delta and uses it to allocate a Buffer without bounds. This can cause excessive memory allocation (~2 GB) before validating the delta output, potentially leading to process termination on memory-constrained environments. The issue is fixed in version 1.38.6.
OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.
@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler that iterates the request parts and performs asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds while the connection stays open. An unauthenticated remote client can repeat these malformed uploads against such a route to accumulate pending connections and exhaust server resources, so the impact is availability only and exploitation depends on the application using a delayed file consumer. The issue is fixed in @fastify/multipart 10.1.7, where the parser error is propagated to the file stream so a delayed consumer settles with an error instead of hanging, and users should upgrade to 10.1.7 or later. There is no workaround other than upgrading.
CVE-2026-117677 is an uncontrolled resource consumption vulnerability in Gitea versions before 28.3.0. It occurs when parsing uploaded Helm charts, where the decompressed archive size is not limited before quota checks, allowing attackers with package write access to cause high CPU usage by uploading small, highly compressed archives. This can degrade the availability of the Gitea instance but does not enable code execution or unauthorized data access.
Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message containing an excessively deep topic can reach `qlobber._split_words` in `lib/qlobber.js` and trigger an uncaught `too many words` exception. Calls from `handlers/subscribe.js` and the publishing logic are not protected against that exception, so it escapes to the `Node.js event loop` and terminates the entire broker. The `Will` path is independently reachable when a client disconnects ungracefully: it calls `broker.publish` directly and bypasses the `PUBLISH` handler. An attacker must be able to establish an `MQTT session`, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.
LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_preR13` in `src/decode_r11.c` computes `size` from the raw file-controlled `entities_start` and `entities_end` header bounds; the callee clamps `end` to `dat->size` but never recalculates `size`. At `end` of input, `bit_read_RC` and `bit_read_RS` stop advancing `dat->byte`, the overflow guard fails because `end` equals `dat->size`, and the no-advance check compares against `oldpos` saved before the loop instead of the previous iteration. This leaves repeated allocation of `dwg->object` entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling `dwg_read_file()` on untrusted files, including `dwg2dxf`, `dwgread` and `dwg2svg`, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.