Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
CVE-2026-42034
### Summary For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https trans
#cwe-770
共收录 1195 条相关情报。
← 返回所有主题Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a...
CVE-2026-7776
Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition
Axios: HTTP adapter streamed responses bypass maxContentLength
CVE-2026-42036
### Summary When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength.
Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes. An attacker with n...
CVE-2026-7776
Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition
net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication
CVE-2026-42256
### Summary When authenticating a connection with `SCRAM-SHA1` or `SCRAM-SHA256`, a hostile server can perform a comput
@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could...
CVE-2026-7768
@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit
Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
CVE-2026-42294
**Severity:** Medium **Component:** Webhook Interceptor (`server/auth/webhook`) **Vulnerability Type:** Denial of Servic
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client registration endpoint accepted unauthenticated requests ...
CVE-2026-42236
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray()
CVE-2025-70071
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataA
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method
CVE-2025-70069
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMes
Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's...
CVE-2026-6948
Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel.
Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel. This allows a compromised or rogue Velociraptor clien...
CVE-2026-6948
Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel.
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated memory exhaustion via oversized HTTP/2 frames. 'Elixir.Bandit.HTTP2....
CVE-2026-42788
该漏洞存在于 Elixir 的 HTTP/2 服务器库 Bandit（版本 0.3.6 至 1.11.0 之前）中。具体问题位于 `lib/bandit/http2/frame.ex` 文件中的 `Elixir.Bandit.HTTP2.F
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The fragment reassem...
CVE-2026-42786
该漏洞存在于 Elixir 编写的 HTTP 服务器 Bandit 的 WebSocket 实现中。在 lib/bandit/websocket/connection.ex 文件的 handle_frame/3 函数处理 WebSocket
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permess...
CVE-2026-39804
Bandit（Elixir HTTP服务器）的WebSocket压缩实现中存在资源分配无限制漏洞（CWE-770）。漏洞位于lib/bandit/websocket/per_message_deflate.ex文件的inflate/2函数，
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial...
CVE-2026-43507
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur v
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML parsing resource ampli...
CVE-2026-43507
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur v
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes...
CVE-2025-36122
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service...
CVE-2025-36122
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could
CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can...
CVE-2025-51846
CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade o