minimatch has potential denial of service via globparts amplification
CVE-2026-118764
minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel
#cwe-405
共收录 44 条相关情报。
← 返回所有主题pypdf has possible large memory usage for exceptions in strict mode
CVE-2026-119207
### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loa
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested pars...
CVE-2026-119207
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, ...
CVE-2026-118764
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1,
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
CVE-2026-109932
### Impact undici's WebSocket client (including Node.js's bundled `globalThis.WebSocket`) can be driven to exhaust proc
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key. Th...
CVE-2026-85783
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costin
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number...
CVE-2026-110676
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal dig
Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
CVE-2026-96960
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Syst
Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
CVE-2026-70162
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Syst
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions an...
CVE-2026-104817
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the serve...
CVE-2026-97031
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing S...
CVE-2026-78669
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request....
CVE-2026-78659
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.T
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33...
CVE-2026-84897
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_M
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) proper...
CVE-2026-104712
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive syn...
CVE-2026-104431
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers b
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invali...
CVE-2026-104425
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to deg
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transac...
CVE-2026-104423
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers
Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
CVE-2026-104431
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers b
Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
CVE-2026-104425
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to deg