CWE-834 vulnerabilities

CVE-2026-115911 is a vulnerability in vllm, an inference and serving engine for large language models, affecting versions from 0.19.0 up to but not including 0.32.0. Authenticated users can supply a chat template that is compiled and rendered without limits on execution time or output size, potentially causing resource exhaustion. This can block server responses or exhaust memory, leading to denial of service. The issue is fixed in version 0.32.0.

A vulnerability in pypdf versions prior to 6.21.2 allows an attacker to craft a PDF with a cross-reference table declaring more entries than the file actually contains. This causes excessive processing and long runtimes when the file is opened. The issue is fixed in version 6.21.2.

CVE-2026-91137 is a high-severity vulnerability in Apache Thrift before version 0.25.0. It involves improper validation of specified quantity in input, leading to allocation of resources without limits or throttling and excessive iteration in the PHP bindings. This can cause resource exhaustion or denial of service. The issue is fixed in Apache Thrift version 0.25.0.

A vulnerability in the collective icalendar Python library allows uncontrolled resource consumption via attacker-controlled VALARM REPEAT values. Versions from 6.1.0 up to but not including 7.2.2 are affected. Accessing certain alarm-related properties can cause excessive CPU and memory usage, potentially stalling or terminating services. The issue is fixed in version 7.2.2.

radare2 versions prior to 6.2.0 contain a vulnerability in the Apple Preferred Executable Format (PEF) loader where unbounded relocSecCount values can cause excessive processing. This flaw allows the loader to perform an extremely high number of relocation-section iterations and buffer operations beyond the end of the file, leading to denial of service via high CPU consumption. The issue is resolved in version 6.2.0.

CVE-2026-81872 is a medium severity availability vulnerability in the open-telemetry opentelemetry-go SDK. The BatchingProcessor in sdk/log can enter a tight CPU loop when the asynchronous export buffer is full and the exporter is backpressured. This causes repeated immediate export retries, leading to CPU exhaustion and denial of service in the affected application. The issue affects versions prior to 0.21.0. No official patch or fix status is provided in the input data.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service.

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.

Mesop versions prior to 1.3.3 have an uncontrolled resource consumption vulnerability in debug mode via the /hot-reload endpoint. An unauthenticated attacker can supply a high counter parameter value to cause worker thread exhaustion, leading to server unavailability until manual restart. This denial-of-service condition is fixed in version 1.3.3.

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.

CVE-2026-59644 is a high-severity vulnerability in Bouncy Castle for Java (BC-JAVA) versions before 1.85. It involves the MLS hash-ratchet honoring an arbitrary 32-bit generation counter from the sender, leading to excessive iteration. This flaw is categorized under CWE-834 (Excessive Iteration).

Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10 contain a vulnerability where crafted requests targeting applications using the App Router with at least one Server Action can cause excessive CPU usage. This leads to blocking of further request processing in the same process. The issue is fixed in versions 15.5.21 and 16.2.11.

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the metrics exporter to spend excessive CPU time in a tight loop every collection interval. This issue has been patched in version 0.9.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.

CVE-2026-41313 is a medium severity vulnerability in the pypdf library prior to version 6.10.2. It involves excessive iteration caused by loading a crafted PDF with a large trailer /Size value in incremental mode, leading to long runtimes. This issue has been fixed in pypdf version 6.10.2. Users can also manually apply the patch changes as a workaround.

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. ### Patches This has been fixed in [pypdf==6.10.1](https://github.com/py-pdf/pypdf/releases/tag/6.10.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3733](https://github.com/py-pdf/pypdf/pull/3733).

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.

Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.