undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
CVE-2026-109932
### Impact undici's WebSocket client (including Node.js's bundled `globalThis.WebSocket`) can be driven to exhaust proc
#cwe-400
共收录 1360 条相关情报。
← 返回所有主题Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
CVE-2026-116656
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
CVE-2026-108331
Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cle...
CVE-2026-77167
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. Th
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notificati...
CVE-2026-117506
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificat
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipula...
CVE-2026-117505
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue
a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
CVE-2026-117506
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificat
a2aproject a2a-java ChildQueue queue.offer resource consumption
CVE-2026-117505
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation ...
CVE-2026-117503
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplyin...
CVE-2026-116878
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anony
A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network acces...
CVE-2026-70380
A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has alread...
CVE-2026-115927
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked
libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service.
CVE-2026-104591
libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-contr...
CVE-2026-115918
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-...
CVE-2026-115911
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can s
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capac...
CVE-2026-115907
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications b
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is...
CVE-2026-116095
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_tu...
CVE-2026-116095
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that...
CVE-2026-116177
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated a
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL proces...
CVE-2026-116177
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated a