pypdf has possible long runtimes/large memory usage for encrypted PDF files

CVE-2026-119208

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This req

来源摘录 · GitHub Advisory

pypdf has possible large memory usage when parsing cross-reference streams

CVE-2026-119209

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires ope

来源摘录 · GitHub Advisory

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

CVE-2026-116775

## Summary `pageant::PageantStream` reads a 4-byte big-endian length prefix from its input stream and buffers until `le

来源摘录 · GitHub Advisory

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

CVE-2026-116696

### Summary **All evidence, reproduction steps, and scripts in the report were verified against a real running instance

来源摘录 · GitHub Advisory

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmai...

CVE-2026-119701

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood pa

来源摘录 · NVD

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the...

CVE-2026-119699

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticat

来源摘录 · NVD

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-leve...

CVE-2026-119036

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before

来源摘录 · NVD

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer o...

CVE-2026-116128

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked re

来源摘录 · NVD

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers vers...

CVE-2026-107312

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Al

来源摘录 · NVD / OSV.dev

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that ...

CVE-2026-119209

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while openi

来源摘录 · NVD / GitHub Advisory / OSV.dev

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted en...

CVE-2026-119208

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory wh

来源摘录 · NVD / GitHub Advisory

Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

## Summary An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthent

来源摘录 · GitHub Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.

CVE-2026-90991

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to al

来源摘录 · NVD

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle alloca...

CVE-2026-119134

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only

来源摘录 · NVD

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max...

CVE-2026-119119

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails

来源摘录 · NVD

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attac...

CVE-2026-119051

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to cr

来源摘录 · NVD

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

CVE-2026-115927

### Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have

来源摘录 · GitHub Advisory

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

CVE-2026-116577

### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obs

来源摘录 · GitHub Advisory

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payloa...

CVE-2026-118689

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthe

来源摘录 · NVD

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

## ⚠️ Update (verification, 2026-05-19): C-2 confirmed end-to-end — **4.5× amplification observed** (worse than the advi

历史摘要 · 未重新核验 · GitHub Advisory