#cwe-770

共收录 1180 条相关情报。

漏洞预警2026-10-02 发布INFO

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects...

CVE-2026-94634

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerabilit

历史摘要 · 未重新核验 · NVD

#cve #cwe-770 #cwe-1188

漏洞预警2026-10-02 发布INFO

Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7....

CVE-2026-63578

Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters)

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-02 发布INFO

Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can suppl...

CVE-2026-63572

Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-02 发布INFO

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, withou...

CVE-2026-17508

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost paramete

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

安全公告2026-10-02 发布INFO

Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

CVE-2026-17508

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost paramete

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-770

漏洞预警2026-10-02 发布INFO

Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows...

CVE-2026-63568

Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legio

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

安全公告2026-10-02 发布INFO

Unbounded PBE iteration count when decrypting PKCS#8 private keys

CVE-2026-63578

Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters)

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-770

安全公告2026-10-02 发布INFO

Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files

CVE-2026-63572

Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-770

安全公告2026-10-02 发布INFO

Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion

CVE-2026-63568

Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legio

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-770

安全公告2026-10-02 发布INFO

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in...

CVE-2026-103761

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePee

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-770 #severity:high

漏洞预警2026-10-01 发布INFO

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow pro...

CVE-2026-103761

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePee

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

安全公告2026-10-01 发布INFO

Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

CVE-2026-103761

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePee

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-770

安全公告2026-10-01 发布INFO

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption...

CVE-2023-54404

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows atta

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-770 #severity:high

漏洞预警2026-10-01 发布INFO

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength ...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when d

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-01 发布INFO

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength l...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when de

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

安全公告2026-10-01 发布INFO

jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

CVE-2026-68495 · CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when d

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-400 #cwe-770

安全公告2026-10-01 发布INFO

jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

CVE-2026-68496 · CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when de

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-400 #cwe-770

安全公告2026-10-01 发布INFO

Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation

CVE-2023-54404

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows atta

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-770

安全公告2026-10-01 发布INFO

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

CVE-2026-89425

## Status **FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a 20,000,109-character

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #maven #cwe-400 #cwe-770 #severity:high

漏洞预警2026-10-01 发布INFO

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM vi...

CVE-2026-94250

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unau

历史摘要 · 未重新核验 · NVD

#cve #cwe-770