Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes

CVE-2026-15957

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface

历史摘要 · 未重新核验 · OSV.dev

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-d...

CVE-2026-55831

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2

历史摘要 · 未重新核验 · NVD

Guzzle: Unbounded response cookies risk denial of service

### Impact In affected versions, Guzzle's built-in `CookieJar` accepts any number of `Set-Cookie` header fields from on

历史摘要 · 未重新核验 · GitHub Advisory

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

CVE-2026-12590

### Impact When body-parser is configured with an invalid `limit` option value, such as an unparseable string or `NaN`,

历史摘要 · 未重新核验 · GitHub Advisory

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

CVE-2026-59204

### Summary `src/libImaging/Jpeg2KDecode.c:853` accumulates `total_component_width` across every tile in a JPEG2000 imag

历史摘要 · 未重新核验 · GitHub Advisory

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

CVE-2026-59200

### Summary `PdfParser.PdfStream.decode()` in Pillow's `PdfParser.py` calls `zlib.decompress()` with the `bufsize` param

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

CVE-2026-50651

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability

CVE-2026-50525

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability

CVE-2026-50648

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

CVE-2026-47302

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

## Summary axios’ fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose

历史摘要 · 未重新核验 · GitHub Advisory

node-tar: Decompression/parse DoS via unlimited input

CVE-2026-59873

### Summary A **Decompression/parse DoS via unlimited input** vulnerability in `node-tar` allows an attacker to exhaust

历史摘要 · 未重新核验 · GitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on...

CVE-2026-53596

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeSco

历史摘要 · 未重新核验 · NVD

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prev...

CVE-2026-48824

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2

历史摘要 · 未重新核验 · NVD

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA p...

CVE-2026-45713

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.M

历史摘要 · 未重新核验 · NVD

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets map[string]MessageA...

CVE-2026-45712

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?dat

历史摘要 · 未重新核验 · NVD

Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

CVE-2026-48824

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2

历史摘要 · 未重新核验 · OSV.dev

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

CVE-2026-45713

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.M

历史摘要 · 未重新核验 · OSV.dev

Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

CVE-2026-45712

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?dat

历史摘要 · 未重新核验 · OSV.dev

SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames...

CVE-2026-63750

SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket c

历史摘要 · 未重新核验 · NVD