Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
CVE-2026-96638
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits
#cwe-400
共收录 1360 条相关情报。
← 返回所有主题toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
CVE-2026-114144
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, bec...
CVE-2026-111817
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.d
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes t...
CVE-2026-111810
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header th
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0....
CVE-2026-111805
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length valu
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
CVE-2026-114138
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non...
CVE-2026-110803
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside t
Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8
CVE-2026-110803
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside t
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around larg...
CVE-2026-113795
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large nu
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to ...
CVE-2026-113791
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a conte
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retriev...
CVE-2026-113789
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin ...
CVE-2026-86147
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all pla
Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service ...
CVE-2026-81755
Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attac
Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server...
CVE-2026-78058
Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms all
Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase resp...
CVE-2026-61902
Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTT
Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11. Users are recommended t...
CVE-2026-41114
Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC dri
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the...
CVE-2026-114103
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard b
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that...
CVE-2026-114055
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-...
CVE-2026-114055
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to
IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-93441
IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.