Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.
When a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.
This issue affects bandit: from 1.9.0 before 1.14.0.
CVE-2026-112326 is a vulnerability in GitLab EE versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. It involves improper cleanup on thrown exceptions that could allow an authenticated user with read-only permissions to permanently delete existing vulnerability records. This occurs due to flawed error handling logic that fails to differentiate between pre-existing and newly created records. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-93710 affects Dancer2 versions from 2.0.0 up to but not including 2.2.0. It involves improper cleanup when an exception is thrown in a hook during request dispatch. Specifically, if an exception handler halts the response without properly invoking the halt method or setting the is_halted flag, cleanup does not prevent the refused route from running, potentially causing unintended request processing. This vulnerability has a high severity score of 7.5 due to its impact on availability.
Eclipse Milo versions 1.0.0 through 1.1.4 contain a vulnerability where monitored-item quota accounting is not exception-safe. An unauthenticated remote client can trigger a StackOverflowError by sending deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter. This causes the server-global monitored-item quota to be exhausted and prevents new monitored items from being created until the server is restarted. Existing monitored items and other server functions remain unaffected.
> [!NOTE]
> The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. Impact is reduced auth availability until the next successful fetch, not complete denial of service.
## Summary
PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests.
Additionally, fetch_data() finally block clears the JWKS cache on network error.
## Root Cause
jwt/jwks_client.py:172-198 - get_signing_key(kid) calls get_signing_keys(refresh=True) for unknown kids, bypassing TTL cache with no cooldown.
jwt/jwks_client.py:120-122 - finally block writes None to cache on error, clearing valid data.
## Impact
- DoS against JWKS endpoint (unlimited requests per invalid token)
- DoS against application (network I/O latency)
- Cascading failure (rate limiting clears cache, breaking legitimate auth)
## Suggested Fix
1. Add refresh cooldown (refuse refresh more than once per TTL period)
2. Move cache write from finally to else block
## Affected Versions
All versions with PyJWKClient (2.4.0 through 2.12.1)
UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.
CVE-2026-33481 is a medium severity vulnerability in Anchore Syft versions prior to 1.42.3 where temporary files are not properly cleaned up if an error occurs due to exhausted temporary storage during scanning. This can happen when scanning very large or highly compressed artifacts, causing Syft to exit without removing temporary files, which may fill the temporary storage and prevent future scans or other system utilities from functioning properly. The issue is fixed in Syft version 1.42.3, which ensures cleanup of temporary files even on error. No workarounds exist, but manual removal of leftover temporary files can restore storage availability.