undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
CVE-2026-109924
### Impact undici's `EventSource` client can be driven to exhaust process memory by a malicious or compromised Server-S
#cwe-770
共收录 1180 条相关情报。
← 返回所有主题Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes receiv...
CVE-2026-115776
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.word
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an una...
CVE-2026-115775
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.
Echo: BodyDump captures request and response bodies without size limits in v4
## Impact Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
CVE-2026-115776
## Summary An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
CVE-2026-115778
## Summary An allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthen
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
CVE-2026-115775
## Summary An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum...
CVE-2026-86019
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum att...
CVE-2026-86018
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows
Ghidra before 12.2 contains a resource allocation without limits vulnerability in...
CVE-2026-115398
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileS
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive en...
CVE-2026-115398
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileS
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limi...
CVE-2026-115397
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFold
Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directo...
CVE-2026-115395
Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that e
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed ...
CVE-2026-115389
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations
fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose defaul...
CVE-2026-114610
fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG re
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only...
CVE-2026-75508
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the pars
pypdf: Possible large memory usage when parsing content streams
CVE-2026-113791
### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires par
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
CVE-2026-114144
### Summary `toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first boundin
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
CVE-2026-75508
### Summary The parser's `max_tokens` limit — the documented defence against oversized GraphQL documents — did not coun
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one...
CVE-2026-94482
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted req