CVE-2026-71397 is a high-severity vulnerability in elixir-grpc grpc_server versions from 1.0.0 up to but not including 1.0.6. It allows unauthenticated attackers to exhaust server memory and crash the node by sending oversized client-streaming or bidirectional-streaming request bodies. The vulnerability arises because the streaming read path does not enforce the configured maximum body size, leading to unbounded buffering of incoming data.
CVE-2026-59171 is a vulnerability in the JSON-java library (stleary) affecting versions from 20150729 through 20260522. The flaw allows unbounded accumulation of numeric tokens in JSONTokener.nextSimpleValue, leading to excessive CPU consumption when converting large numeric literals. This can cause denial of service by blocking request-handling threads. The issue is not mitigated by strict mode or keep-strings settings. Version 20260719 introduces a limit on numeric conversion length to address this.
A vulnerability in Nuxt Content versions 3.0.0 through 3.15.1 allows unauthenticated attackers to send crafted POST requests to the /__nuxt_content/:collection/query endpoint. The flaw permits expensive SQLite expressions in the sql field, leading to uncontrolled resource consumption that blocks the Node.js event loop and disrupts concurrent request handling. This can cause denial of service due to high CPU and memory usage. The issue is fixed in version 3.15.2. Fully static prerendered deployments that do not expose the server endpoint are not affected.
CVE-2026-85111 is a high-severity vulnerability in Apache James server versions prior to 3.9.1. It involves allocation of resources without limits or throttling in the Apache James Mime4J library before version 0.8.15, which can lead to denial of service when parsing MIME messages. The issue is fixed in Apache James 3.9.1, which uses the updated MIME4J 0.8.15 library.
Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.
Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.
CVE-2026-84161 is a vulnerability in Ericsson CodeChecker versions prior to 6.29.3 where enabling the store.analysis_statistics_dir feature allows authorized users with PRODUCT_STORE permission to submit highly compressed Base64-encoded data that is decompressed without size limits. This can lead to excessive memory and disk usage, potentially exhausting resources and impairing service availability. The feature is disabled by default, and no authorization bypass or path traversal is involved.
CVE-2026-115701 is a resource exhaustion vulnerability in the ninenines cowboy HTTP server affecting versions from 2.18.0 onward. An unauthenticated remote attacker can send an unlimited amount of data on a keep-alive HTTP/1.1 connection while a request handler is running, causing the connection buffer to grow without limits. This can exhaust the Erlang VM memory and potentially lead to denial of service.
CVE-2026-113431 is a high-severity vulnerability in the ninenines cowlib HTTP/2 implementation that allows an unauthenticated remote attacker to exhaust server memory by exploiting the handling of HPACK-indexed header fields. The vulnerability arises because the decoding process does not properly limit the size of the decoded header list, allowing a small compressed input to expand into a very large memory allocation. This can lead to resource exhaustion across multiple streams and connections. The issue affects cowlib versions 2.7.0 and later and has been fixed in a commit identified by hash a3b15e29b3067644bfd580246c87f7af7a90b3b8.
CVE-2026-123660 affects vulnerability-lookup versions 5.5.1 up to but not including 6.4.1. A signed-in user can craft webhook notification payload templates that cause excessive memory allocation during string formatting, leading to potential denial of service. The vulnerability arises because format specifiers in placeholders are passed unchecked to Python's string formatting, allowing very large memory allocations. Version 6.4.1 fixes this by capping format specifier numbers, limiting rendered template size, and restricting template nesting depth.
HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.
Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines.
A remote attackercan exhause the CPU with a single request.
HTTP::Body version 1.25 limits the size and number of lines in the trailer.
Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process. MatchTimeout does not fully mitigate this because the memory is allocated faster than the 100 ms timeout clock can fire. This issue has been patched in version 2.3.0.
CVE-2026-111768 is a high-severity vulnerability in the @modelcontextprotocol TypeScript SDK and server components. Versions from 1.3.0 up to but not including 1.32.0 of the SDK, and 2.0.0 up to but not including 2.3.0 of the server, do not enforce limits on the number of array elements or object keys validated in a single HTTP request. This can lead to JavaScript heap exhaustion and process termination when processing large arrays or objects within the default 4 MiB request size limit. The vulnerability is fixed in versions 1.32.0 of the SDK and 2.3.0 of the server. Operators must configure both input element bounds and request body size limits to fully mitigate the issue.
CVE-2026-77622 is a high-severity vulnerability in the BishopFox sliver command and control framework prior to version 1.7.6. It involves an HTTP(S) listener using the PNG encoder that accepts attacker-controlled PNG image dimensions without effective limits, allowing an unauthenticated attacker who discovers a valid nonce to submit a highly compressed image that expands during decoding. This leads to server memory exhaustion and complete loss of availability. The issue is fixed in version 1.7.6.
Pillow, a Python imaging library, has a resource allocation vulnerability in EPS rendering in versions 2.3.0 through 12.3.0. The issue arises because scaled image dimensions are not validated before invoking Ghostscript, leading to excessive CPU and disk usage when processing untrusted EPS or PostScript files with application-selected scales greater than one. Although decompression-bomb protection exists, it only checks the scaled output after rendering, allowing resource overconsumption. This vulnerability is fixed in version 13.0.0.
OpenHuman versions prior to 0.57.44 have a security vulnerability in the local /ws/dictation WebSocket endpoint, which lacks client authentication and browser-origin validation. This allows unauthenticated clients, including malicious web pages, to submit audio and trigger resource-intensive speech-to-text processing. Earlier versions also have an unbounded audio buffer, enabling continuous streaming that can exhaust process memory and degrade or crash the application. The issue is fixed in version 0.57.44.
CVE-2026-74841 is an uncontrolled resource consumption vulnerability in Apache OFBiz affecting versions prior to 24.09.08. In multitenant deployments, the application builds a per-tenant delegator name from a user-supplied tenant ID before verifying tenant existence. The internal cache retains all delegator names requested, including invalid ones, allowing an unauthenticated attacker to submit arbitrary tenant IDs and cause unbounded cache growth, leading to increased memory and database load.
Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau.
The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing denial of service. Related unbounded allocations in REST request handling (multipart uploads and request reader buffers) are fixed at the same time.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.