CWE-401: Memory Leak vulnerabilities

Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c. This issue affects iSulad: through 2.1.6. The memory leak vulnerability causes the iSulad daemon to be triggered frequently, exhausting the host machine's memory and ultimately leading to an OOM crash of the daemon, resulting in a denial of service (DoS).

CVE-2026-106137 is a race condition vulnerability in Progress Telerik UI for ASP.NET MVC versions from 2012.2.710 up to but not including 2026.3.1015. The issue involves unsafe updates to a shared class dictionary without exclusive write protection, leading to potential corruption or resource exhaustion. An unauthenticated remote attacker can exploit this by sending concurrent crafted requests to an exposed aggregation endpoint, causing increased CPU and memory usage and potentially degrading application availability. The vulnerability is fixed in version 2026.3.1015.

Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.

Uncontrolled resource consumption in Windows Hyper-V allows an authorized attacker to deny service locally.

Uncontrolled resource consumption in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Uncontrolled resource consumption in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to deny service over a network.

Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.

Missing release of memory after effective lifetime in Windows Kerberos allows an unauthorized attacker to deny service over a network.

Missing release of memory after effective lifetime in Windows Layer-2 Bridge Network Driver allows an unauthorized attacker to deny service over an adjacent network.

Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow state. A remote peer can send DATAGRAMs with many distinct identifiers, causing the per-connection flow map and associated channel state to grow without bound. Impact Exploitation can exhaust process memory and cause a denial of service. The vulnerable code is used in both client and server configurations, so either role can be affected by a malicious peer. QUIC DATAGRAM support in tokio-quiche is enabled by default through QuicSettings::enable_dgram; applications can disable it by setting this field to false. The vulnerable HTTP/3 path is reachable only when DATAGRAM support is negotiated with the peer. Core quiche and HTTP/3 deployments without DATAGRAM support are not affected.  Mitigation Disable DATAGRAMs in tokio-quiche’s QuicSettings::enable_dgram. Remediation Upgrade to tokio-quiche version 0.23.0 or later. The fixed code creates flow state only for valid DATAGRAM-capable request streams, which are bounded by QUIC’s stream limits. To tolerate packet reordering, servers retain early DATAGRAMs in a bounded, expiring buffer, while clients discard DATAGRAMs for unknown flows.

CVE-2026-108949 is a denial of service vulnerability in Apache ActiveMQ and ActiveMQ Broker caused by a memory leak. An authenticated OpenWire client sending a ConsumerInfo for a temporary queue/topic owned by another connection triggers an InvalidDestinationException, but the broker fails to clean up the rejected subscription, leading to heap memory exhaustion. This affects Apache ActiveMQ versions from 6.0.0 before 6.3.3 and versions before 5.19.12. The issue is fixed in versions 6.3.3 and 5.19.12.

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.

CVE-2026-121512 is a high-severity vulnerability in D3TN GmbH's µD3TN software. It involves a memory leak due to missing release of memory after its effective lifetime in the BPv6 EID reference handling component. This flaw allows an unauthenticated remote attacker to cause a denial of service (DoS) by amplifying memory consumption. The issue affects versions prior to 0.15.2 and has been fixed in version 0.15.2.

A vulnerability in graphql-core (Python port of GraphQL.js) versions from 3.3.0a3 up to but not including 3.3.1 allows unauthenticated clients to cause unbounded memory growth by repeatedly submitting small documents with over 100 validation errors. This occurs because the validate() function reuses a module-level exception whose traceback grows with each raise, retaining large amounts of data and exhausting memory. The issue is fixed in version 3.3.1.

CVE-2026-114613 is a high-severity vulnerability in msgpack-python prior to version 1.2.3. The msgpack-python C extension leaks memory when deserialization rejects a map key with strict_map_key set to true (default). This memory leak can cause unbounded memory growth and denial of service when processing attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The issue is fixed in version 1.2.3.

CVE-2026-110685 is a critical memory leak vulnerability in Cpanel::JSON::XS for Perl versions before 4.80. The flaw occurs when the THAW method of a tagged value dies during decoding, causing the decoded arguments to remain allocated and not released. This leads to memory exhaustion if the error is caught and the process continues running. The issue is fixed in version 4.80.

CVE-2026-110684 is a high-severity memory leak vulnerability in Cpanel::JSON::XS versions from 3.0202 up to but not including 4.80. The flaw occurs in the encode_stringify function, which improperly manages references when encoding overloaded objects as strings, causing memory to be retained indefinitely. This leads to unbounded growth in process memory when repeatedly encoding such data.