CVE-2026-121824 is a high-severity vulnerability in LY Corporation's Armeria software prior to version 1.43.0. It involves improper handling of malformed Thrift messages that can trigger excessive memory allocation, potentially leading to denial of service conditions.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2.
Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0.
The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did not check that decoded lengths fit within the frame being read. A malicious or compromised broker, or an attacker able to intercept and modify an unencrypted connection, could send a crafted OpenWire frame with an oversized or negative length. This could cause the client to attempt very large memory allocations, leading to excessive memory consumption, an OutOfMemoryException or an uncaught exception, and a denial of service of the client application.
Users are recommended to upgrade to version 2.3.0, which enforces a configurable maximum frame size and validates lengths against the size of the frame being read.
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.
CVE-2026-83594 is a high-severity vulnerability in Apache Wicket affecting versions 9.14.0 through 9.24.0 and 10.0.0 through 10.11.0. It involves memory allocation with an excessive size value in the FileUploadToResourceField component, which can be exploited by sending crafted requests that cause the server to allocate large byte arrays, potentially exhausting heap memory. The vulnerability arises because the component trusts client-supplied JSON data about file uploads without verifying the actual stored files. The issue is fixed in Apache Wicket versions 9.25.0 and 10.12.0.
CVE-2026-62297 is a high-severity vulnerability in the ag-psd JavaScript library used for reading and writing Photoshop Document files. Prior to version 31.0.0, the library's readPsd() function allocates memory buffers based on attacker-controlled PSD geometry declarations without sufficient validation, potentially causing multi-gigabyte memory allocations. This can lead to denial of service by exhausting system memory or crashing the process. Version 31.0.0 introduces a composite-image allocation limit to mitigate this issue, though some allocation paths may still require review.
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.
Starlet versions before 0.33 for Perl contain a vulnerability where a remote attacker can send a request with a large Content-Length header, causing the worker process to exhaust memory and exit with an uncatchable error. This results in denial of service by forcing worker restarts with minimal requests.
MariaDB Connector/J versions from 3.0.0 up to but not including 3.3.7, 3.4.5, and 3.5.11 contain an improper input validation vulnerability in the XA recovery process. The vulnerable methods trusted length values from the XA RECOVER command without validating them against maximum allowed sizes, potentially causing large memory allocations or runtime exceptions. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
MariaDB Connector/J versions from 3.0.0 up to but not including 3.3.7 and from 3.4.0 up to but not including 3.4.5 contain an improper validation of array index vulnerability during caching_sha2_password authentication. A malicious or compromised server or a man-in-the-middle attacker could exploit this by sending a malformed authentication-more-data response that causes excessive memory allocation or an unhandled ArrayIndexOutOfBoundsException. This issue has been fixed in versions 3.3.7 and 3.4.5.
MariaDB Connector/J versions 3.0.0 up to but not including 3.3.7, 3.4.0 up to 3.4.5, and 3.5.0 up to 3.5.11 contain a vulnerability involving improper handling of length parameters in OK packet parsing. A malicious or compromised server, or a man-in-the-middle attacker, can exploit this by sending a small OK packet that declares a larger length, causing repeated heap allocations and potentially leading to OutOfMemoryError in the client application. This issue has been fixed in versions 3.3.7, 3.4.5, and 3.5.11.
When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce request can declare a body size of up to about 2 GiB and force the broker to attempt that allocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request size limit, and client/broker quotas bound only the compressed wire size, not the declared decompressed size.
Impact:
An authenticated principal with Write on a topic can crash broker request-handler threads (reached when a batch's codec differs from the topic's compression.type and records are re-encoded) and any consumer that fetches the record, denying service. On brokers started with -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the broker JVM. More seriously, a crafted record is accepted at ingest and written to disk; when the log-cleaner later reads it on a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner thread, which is not restarted. With the default of a single cleaner thread, log compaction then stops for the entire broker, including the internal __consumer_offsets and __transaction_state topics, and the condition persists across restarts until the offending record is removed. The impact is availability only; no data is disclosed or altered.
Mitigation:
Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the broker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is not sufficient: for backward compatibility this configuration defaults to an effectively unlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a value at or slightly above the largest legitimate decompressed record your applications produce, and comfortably below the broker heap divided by the number of request-handler and cleaner threads. Until you can upgrade and configure the limit, restrict Write access to trusted producers; quotas and max.message.bytes do not mitigate this issue.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record's declared decompressed body size against max.decompressed.message.bytes before allocating, on the produce-validation, log-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with InvalidRecordException. Operators must set this configuration to a bounded value to be protected, as its default is effectively unlimited.
CVE-2026-111551 is a vulnerability in Apache Kafka where several deserialization paths allocate memory based on unvalidated size or count fields from input data. This can lead to excessive memory allocation, causing an OutOfMemoryError that crashes the affected consumer or Kafka Streams thread. The issue affects Kafka versions up to 4.1.2, 4.2.1, and 4.3.1. The vulnerability does not impact brokers or the cluster as a whole. It can be triggered by crafted records or assignment data in specific Kafka Streams or client library components. Fixed versions include Apache Kafka 4.2.2, 4.3.2, and 4.4.0, which validate size fields before allocation.
CVE-2026-111108 is a critical vulnerability in Apache Kafka affecting versions from 3.3.0 through 4.3.1. The flaw involves the allocation of resources without proper limits or throttling during request parsing, allowing an attacker to cause excessive heap memory allocation by declaring large array lengths in requests. This can lead to broker crashes due to OutOfMemoryError, even before authorization checks occur. The issue is mitigated in Apache Kafka versions 4.2.2, 4.3.2, and 4.4.0 by capping array pre-allocation and rejecting overly large array lengths.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.
CVE-2026-104895 is a high-severity vulnerability in the FasterXML jackson-dataformat-smile library's asynchronous Smile parser. It involves unbounded memory allocation based on a length prefix from untrusted input, leading to potential OutOfMemoryError or NegativeArraySizeException crashes. The flaw affects multiple version ranges prior to fixed releases and requires no privileges or user interaction beyond submitting data for parsing.
A memory allocation vulnerability exists in ONNX versions prior to 1.22.0 where certain tensor unpacking functions can cause excessive memory allocation based on attacker-controlled input. This can lead to memory exhaustion when processing untrusted tensor data. The issue is resolved in version 1.22.0.
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.
A vulnerability in the zip-rs zip2 Rust library versions 5.1.0 through before 9.0.0 allows an attacker to cause uncontrolled resource consumption. This occurs when applications using the legacy-zip feature reserve output capacity based on attacker-controlled ZIP64 uncompressed sizes before validating the compressed stream. The flaw can cause a panic due to capacity overflow during archive extraction, potentially terminating the archive-processing service. The issue is fixed in version 9.0.0.