PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input
CVE-2026-15055
In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also a
#cwe-770
共收录 1181 条相关情报。
← 返回所有主题better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not...
CVE-2025-71401
better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., B
better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the ve...
CVE-2025-71401
better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., B
better-auth before 1.4.1 basePath Modification DoS
CVE-2025-71401
better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., B
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion....
CVE-2026-55734
Guardian 是一个流行的 Elixir 认证库，其 Guardian.Permissions 模块存在一个资源未限制分配漏洞（CVE-2026-55734），可导致拒绝服务。漏洞根因在于 encode_permissions!/1 函
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian....
CVE-2026-55733
CVE-2026-55733 是 Elixir 的 Guardian 库（版本 2.0.0 至 2.4.0）中存在的一个拒绝服务漏洞。该漏洞源于 Guardian.Permissions.AtomEncoding 模块的 encode/3
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian....
CVE-2026-54894
该漏洞存在于 ueberauth guardian 库（版本 0.1.0 至 2.4.1 之前），属于资源无限制分配/未限流类型，可导致拒绝服务。Guardian.Plug.Keys 模块在派生连接和会话命名空间键时，将任意二进制直接传递给
guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
CVE-2026-55734
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) a
Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation
CVE-2026-55733
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom c
Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys
CVE-2026-54894
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom c
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the...
CVE-2026-67353
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimit
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream...
CVE-2026-67317
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch a
FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding:...
CVE-2026-67297
FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. At...
CVE-2026-67353
CVE-2026-67353 是 PHP HTTP 客户端库 guzzlehttp/guzzle 中 CookieJar 组件存在的一个拒绝服务（Denial of Service）漏洞，影响 7.15.1 之前的所有版本。该漏洞源于 Co
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attacker...
CVE-2026-67317
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch a
FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a ma...
CVE-2026-67297
FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses
guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service
CVE-2026-67353
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimit
FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response
CVE-2026-67297
FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses
axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream
CVE-2026-67317
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch a
zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit
### Summary `NonFinalizedState::handle_reorg` is a recursive, unbounded async function that traverses parent blocks unti