axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2
CVE-2026-67318
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bo
#cwe-400
共收录 1383 条相关情报。
← 返回所有主题axios 0.28.0 before 0.33.0 Denial of Service via formToJSON
CVE-2026-67312
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (
axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
CVE-2026-67313
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names wi
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs ...
CVE-2026-53505
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion() filter do
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated n...
CVE-2026-53504
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expressio
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
CVE-2026-53505
### Summary Thumbor's `filters:proportion()` filter does not enforce an upper bound on `` and runs in the post-transform
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
CVE-2026-53505
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion() filter do
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
CVE-2026-53504
### Summary The regular expression used to parse the `convolution` filter exhibits exponential-time backtracking for cer
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
CVE-2026-53504
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expressio
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
CVE-2026-56819
### Summary A remote, unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that e
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
CVE-2026-41695
`src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175` · Unbounded Resource All
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
CVE-2026-52856
### Summary A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in...
CVE-2026-52857
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, un
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
CVE-2026-52857
### Summary Config file parsers, `json`, `yaml`, `xml` etc in parser.go have no file size limit/checks, allowing for a g
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
CVE-2026-52857
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, un
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypa...
CVE-2026-18358
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mo
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit deco...
CVE-2026-55497
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image
Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)
CVE-2026-55497
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image
IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which could all...
CVE-2024-25039
IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.1
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login ha...
CVE-2026-67437
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/inte