Django REST framework: JSONParser applies an attacker-named codec to the request stream
CVE-2026-114136
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/pa
#cwe-770
共收录 1180 条相关情报。
← 返回所有主题pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around larg...
CVE-2026-113795
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large nu
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to ...
CVE-2026-113791
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a conte
Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to exhaust the memory of a server ...
CVE-2026-80463
Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms a
Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or ...
CVE-2026-78066
Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled inp
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was ava...
CVE-2026-58064
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection
The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with ...
CVE-2026-56387
The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote u
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-w...
CVE-2026-96405
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-na
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio...
CVE-2026-114052
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_proce...
CVE-2026-114052
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key. Th...
CVE-2026-85783
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costin
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulate...
CVE-2026-113729
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in ex
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
CVE-2026-112899
``` ============================================================================ EPS load(scale) lets Ghostscript render
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
CVE-2026-111768
### Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one
AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111065
### Summary An overflow in Max-Age processing can skip closing a connection. ### Impact An attacker may be able to ex
AIOHTTP: File descriptor exhaustion in multipart requests
CVE-2026-111066
### Summary An attacker can exhaust file descriptors with specially crafted multipart requests. ### Impact If a handl
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddlewa...
CVE-2026-113711
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the imp
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system te...
CVE-2026-113658
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV co
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads ...
CVE-2026-113656
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its
Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits...
CVE-2026-105297
Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set i