Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.
pypdf versions prior to 6.21.3 contain a vulnerability where strict mode processing of crafted invalid PDF dictionaries can cause excessive memory consumption. This occurs due to nested parsing failures that repeatedly append exception text, amplifying error messages and leading to uncontrolled resource usage. The issue is resolved in version 6.21.3.
CVE-2026-118764 is a vulnerability in the isaacs minimatch library versions 7.0.0 up to but not including 11.0.1. The flaw involves excessive CPU and memory consumption caused by repeated expansion of attacker-controlled glob pattern segments during pattern compilation. This can lead to asymmetric resource consumption, impacting performance. The issue is resolved in version 11.0.1.
Crypt::Age versions before 0.004 for Perl contain a vulnerability that allows an attacker to cause CPU exhaustion by providing an unbounded number of recipient stanzas. Each stanza triggers expensive cryptographic operations during decryption, leading to denial of service. The vulnerability is fixed in version 0.004.
CVE-2026-110676 is a high-severity vulnerability in Cpanel::JSON::XS for Perl versions before 4.80. It allows an attacker to cause memory exhaustion by exploiting the encoding of JSON numbers with large exponents when the allow_bignum option is enabled. Specifically, encoding a JSON number with a large exponent as a plain decimal string can consume excessive memory and CPU resources, leading to a denial of service.
CVE-2026-70162 is a denial of service vulnerability in Microsoft Visual Studio 2022 and related .NET applications caused by improper handling of web requests in the Microsoft Common Object Runtime Library. A remote unauthenticated attacker can exploit this by sending specially crafted requests to cause a denial of service. The issue is fixed in versions 17.14.42, 18.10.4, and 10.0.13.
CVE-2026-96960 is a high-severity vulnerability in Microsoft .NET Framework 3.5 and related versions that allows an unauthorized attacker to cause asymmetric resource consumption (amplification), leading to denial of service over a network. The flaw affects multiple versions of the .NET Framework and has been officially fixed in specific updates. No known exploits are reported in the wild.
Misskey versions from 12.0.0 through 13.14.2 and from 2023.9.0-beta.1 up to but not including 2026.7.0 have a vulnerability in the unauthenticated fetch-rss API. This API lacks rate limiting and response size restrictions and performs synchronous XML parsing. An attacker can exploit this to cause unbounded outbound HTTP requests and synchronous parsing, leading to resource exhaustion on the instance, amplification of requests toward third-party servers, or probing of network-reachable services even if federation is disabled. The issue is fixed in version 2026.7.0.
CVE-2026-97031 is a high-severity vulnerability in the Go standard library's crypto/tls package. It involves improper handling of multiple Encrypted Client Hello (ECH) outer extension references, which are disallowed by RFC 9849. A malicious client could send a crafted packet with multiple references, causing memory exhaustion on the server. The issue has been addressed by rejecting such malformed packets, mitigating the memory amplification risk.
CVE-2026-78659 is a high-severity vulnerability in the Go standard library net/http package. It involves asymmetric resource consumption through the handling of "Trailer" headers in HTTP/2 servers. A malicious client can send a "Trailer" header declaring many fields, causing excessive memory allocation by the server. This bypasses existing limits on header size and count, leading to potential denial-of-service conditions. The issue does not affect HTTP/1 servers due to different header handling and lack of multiplexing. No known exploits are reported in the wild. Affected versions include multiple pre-1.26.9 and pre-1.27.2 releases, as well as versions before 0.60.0. No patch or official fix information is provided in the input data.
CVE-2026-78669 is a high-severity vulnerability in the Go standard library net/http package. It involves asymmetric resource consumption (amplification) via HTTP/2 where a malicious peer can cause excessive CPU usage by opening many streams and sending numerous small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values. This can impact both clients and servers using the affected versions of the net/http package.
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33) when a server receives them from an unauthenticated client. IsMessageAllowedServer() applies no direction check to the key exchange message range: when the peer is keying and no particular message is expected, which is the state a server is in for the whole window after it processes the client's KEXINIT because nothing sets handshake->expectMsgId there, the function falls out of its expectation branch without a verdict and reaches a numeric bound that admits every message id from 30 through 34. A client that negotiates diffie-hellman-group-exchange-sha256 and then sends message 31 makes the server run the client-side handler DoKexDhGexGroup(), which validates the attacker-supplied group with two 8-round Miller-Rabin primality tests, one on p and one on (p-1)/2, on a value of up to 8192 bits. The handler then returns success: the server stores the attacker's prime and generator, generates a Diffie-Hellman key pair in the attacker's group, and sends the client-role message SSH_MSG_KEX_DH_GEX_INIT (32) back to the attacker. Published RFC 3526 safe primes are the worst-case input and cost the attacker nothing to obtain. The primality validation was added in 1.5.0; versions from 1.2.0 through 1.4.22 admit the same message and enter the same client-role path without the primality cost. Message 33 is admitted as well, but on a server it is rejected before any cryptography because no public key check callback is registered, so it carries no comparable cost. Builds that define WOLFSSH_NO_DH_GEX_SHA256, which is implied by WOLFSSH_NO_DH or NO_SHA256, are unaffected.
CVE-2026-104712 is an asymmetric resource consumption vulnerability in Apache Struts affecting versions 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. The flaw occurs when a request parameter bound to a BigDecimal property is rendered via the Struts tag library, causing the response size to amplify significantly. This allows an unauthenticated attacker to exhaust server CPU and network resources with low-volume traffic. Upgrading to Apache Struts versions 6.12.0 or 7.4.0 mitigates the issue.
CVE-2026-103880 is an asymmetric resource consumption vulnerability in the Apache Directory LDAP API. It occurs when storing a password using the bcrypt algorithm with a high cost factor (e.g., 30), causing the LDAP server CPU to run for hours during credential verification. This can lead to a denial-of-service (DoS) condition. The issue affects versions from 2.1.0 up to but not including 2.1.9. The vulnerability is fixed in version 2.1.9.
CVE-2026-75029 is a medium severity vulnerability in ISC BIND 9 that allows an attacker to cause asymmetric resource consumption via amplification. By sending multiple copies of a record that should only exist once in a query response, such as an SOA record with identical RDATA, the BIND server appends these to the in-memory RDATA set. This behavior increases memory usage of the negative cache and may lead to other memory-related attack vectors. The vulnerability affects multiple BIND 9 versions from 9.11.0 through 9.21.25 and their respective S1 variants.
Robots::Validate Perl module versions from 0.3.2 up to but not including 0.3.11 contain a vulnerability where unbounded outbound DNS queries can be triggered during validation. This occurs due to a forward-confirmation loop in the _check_dns function that does not limit the number of DNS names queried. An attacker controlling the reverse DNS zone for a client IP can cause the module to issue many synchronous DNS queries, potentially leading to resource exhaustion. The vulnerability has a medium severity with a CVSS score of 4.3.
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.