pypdf: Possible long runtimes with large amount of embedded files
CVE-2026-102999
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files c
#cwe-400
共收录 1360 条相关情报。
← 返回所有主题pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
CVE-2026-102995
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature...
CVE-2026-18105
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, au
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent)...
CVE-2026-86104
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthent
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or g...
CVE-2026-90441
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authe
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a...
CVE-2026-86104
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthent
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the syst...
CVE-2026-18105
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, au
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
CVE-2026-101911
### Summary `new Address6()` and `Address6.isValid()` place no bound on the length of the string they parse. When the s
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
CVE-2026-102277
### Summary Expanding `{a},b}`-shaped input takes time quadratic in the number of literal `}` characters, blocking the
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
CVE-2026-102278
### Summary `expand_()` recurses once per level of brace *nesting*. Deeply nested input exhausts the native stack and c
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
CVE-2026-102276
### Summary `parseCommaParts()` can exhaust the native stack and crash the process. There are two distinct ways to trig
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
### Summary adm-zip enforces a `maxOutputLength` guard against decompression bombs on its synchronous `getData()` path,
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
## Summary Denial of Service in `adm-zip`'s async decompression API allows an unauthenticated attacker to crash the ent
Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood S...
CVE-2026-102821
Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT wi
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
CVE-2026-102821
Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT wi
Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Al...
CVE-2026-100242
Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundati
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (...
CVE-2026-102414
CVE-2026-102414 涉及广泛使用的 npm 加密库 pbkdf2(3.1.6 及更早版本)。该库在无法使用运行时原生 pbkdf2Sync 时,会退回纯 JavaScript 实现 lib/sync.js。问题出在这一回退路径的
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
CVE-2026-88932
### Impact Multer's `diskStorage` can leave complete, orphaned files on disk when a multipart upload is aborted in the
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
CVE-2026-101895
A Denial of Service (DoS) vulnerability exists in `@angular/platform-server`'s DOM emulation parser (`domino`). When pro
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand...
CVE-2026-102278
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3