Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
CVE-2026-55407
Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the dec
#cwe-400
共收录 1395 条相关情报。
← 返回所有主题Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service
CVE-2026-55440
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND
adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files
### Impact `adawolfa/isdoc` reads ISDOC invoices from ISDOCX (ZIP) archives and from PDF files with embedded ISDOC docu
Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback
CVE-2026-50285
## Summary The HPKE V2 URL decode path in `pkg/hpke/url.go` decompresses attacker-controlled zstd data without any size
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50276
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50274
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50273
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50272
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50271
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50270
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method w...
CVE-2026-52890
Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachm
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component
CVE-2026-36590
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in
websocket-driver: Memory exhaustion in HTTP header parser
CVE-2026-54465
### Impact If this library is used to implement a WebSocket server on top of a TCP server (rather than an HTTP server o
websocket-driver: Memory exhaustion via abuse of protocol length headers
CVE-2026-54463
### Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitra
CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunnel can create a no...
CVE-2026-55399
CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with vali
CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel p...
CVE-2026-55398
CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with
CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol c...
CVE-2026-33445
CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate
CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can ...
CVE-2026-33444
CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate kno
Wekan: Arbitrary file read and server DoS via attachment versions.original.path
CVE-2026-52890
Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachm
CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can creat...
CVE-2026-33443
CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledg