Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length
CVE-2026-50011
### Summary RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count dec
#cwe-770
共收录 1181 条相关情报。
← 返回所有主题Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
CVE-2026-48748
### Summary A memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blo
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
CVE-2026-54283
### Summary `request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form d
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
CVE-2026-54285
## Overview `W3CBaggagePropagator.extract()` in `@opentelemetry/core` does not enforce size limits when parsing inbound
protobufjs: Memory amplification from preserved unknown fields in binary decode
CVE-2026-54270
## Summary protobufjs 8.2.0 added support for preserving unknown fields encountered during binary decode. Affected vers
aiohttp: Incomplete websocket frame payloads bypass memory limits
CVE-2026-54274
### Summary If an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to ...
CVE-2026-8683
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Matterm
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard exposes two endpo...
CVE-2026-53522
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to be
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling...
CVE-2026-50560
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates Ar...
CVE-2026-50011
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina
Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 co...
CVE-2026-48748
Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final,
Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each n...
CVE-2026-46340
Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads ...
CVE-2026-45416
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina
Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still crea...
CVE-2026-49347
Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly
Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers...
CVE-2026-53781
Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhausti
Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced si...
CVE-2026-53781
Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhausti
FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload...
CVE-2026-45802
FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as template
Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests w...
CVE-2026-44488
Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce co
python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
CVE-2026-48045
### Impact `AsyncListener.handle_query_or_defer` retained every truncated (TC-bit) incoming query in `self._deferred[ad
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could...
CVE-2026-7250
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, a