Bandit Buffers Unbounded WebSocket Continuation Frames, Allowing Unauthenticated Memory Exhaustion

CVE-2026-42786

### Summary A single unauthenticated WebSocket client can exhaust server memory in any Bandit-fronted application that a

历史摘要 · 未重新核验 · GitHub Advisory

Bandit's unbounded WebSocket inflate causes BEAM OOM with a single frame

CVE-2026-39804

### Summary When a Bandit-fronted server has explicitly enabled WebSocket permessage-deflate (`compress: true`), an una

历史摘要 · 未重新核验 · GitHub Advisory

hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression

During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compressi

历史摘要 · 未重新核验 · GitHub Advisory

Netty Lz4FrameDecoder is vulnerable to resource exhaustion

CVE-2026-42583

### Summary Lz4FrameDecoder allocates a ByteBuf of size `decompressedLength` (up to 32 MB per block) before LZ4 runs. A

历史摘要 · 未重新核验 · GitHub Advisory

Netty HTTP/3 QPACK literal unbounded allocation

CVE-2026-42582

### Summary When Netty decodes HTTP/3 headers, it sometimes runs `new byte[length]` using a length from the wire before

历史摘要 · 未重新核验 · GitHub Advisory

wasmtime has a panic when allocating a table exceeding the size of the host's address space

CVE-2026-44216

### Impact Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow.

历史摘要 · 未重新核验 · GitHub Advisory

ldap3_proto has LDAP Filter stack exhaustion

### Impact LDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack.

历史摘要 · 未重新核验 · GitHub Advisory

Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening

## Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP. In versions 1.15.0 and earlier, when a request to the configure...

CVE-2026-41484

OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP. In ver

历史摘要 · 未重新核验 · NVD

OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlier, the AzureVmMetaDataRequestor class makes HTTP requests...

CVE-2026-41483

OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlie

历史摘要 · 未重新核验 · NVD

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts unbounded key grow...

CVE-2026-41310

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin

历史摘要 · 未重新核验 · NVD

ciguard: SCA HTTP client reads response body without size cap

CVE-2026-44219

## Summary Both SCA HTTP clients (`src/ciguard/analyzer/sca/osv.py` and `src/ciguard/analyzer/sca/endoflife.py`) call `

历史摘要 · 未重新核验 · GitHub Advisory

GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

GraphQL-Ruby's `max_query_string_tokens` configuration didn't count comment tokens against the limit, allowing strings t

历史摘要 · 未重新核验 · GitHub Advisory

Plug.Cowboy vulnerable to unauthenticated remote DoS via HTTP/2 `:scheme` atom-table exhaustion

CVE-2026-32688

## Summary An unauthenticated remote denial-of-service vulnerability in `Plug.Cowboy.Conn` allows any attacker who can

历史摘要 · 未重新核验 · GitHub Advisory

Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled

### Summary A specially constructed quic package can crash the server OOM when the sniff is enabled. ### Details When

历史摘要 · 未重新核验 · GitHub Advisory

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote cli...

CVE-2026-32934

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven i

历史摘要 · 未重新核验 · NVD

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

CVE-2026-42198

## Summary pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. ### Impact A ma

历史摘要 · 未重新核验 · GitHub Advisory

Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix allows a denial of service via the long-poll transport's NDJSON body handling. In...

CVE-2026-32689

Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix allows a denial of servic

历史摘要 · 未重新核验 · NVD

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 th...

CVE-2026-29168

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response dat

历史摘要 · 未重新核验 · NVD

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper vali...

CVE-2026-42437

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSock

历史摘要 · 未重新核验 · NVD