CWE-400
CVEs classified under CWE-400, newest first.
1100 CVEsRSS
CVE-2026-61902NoneApache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an af…
CVE-2026-78058NoneApache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 …
CVE-2026-81755NoneApache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive n…
CVE-2026-86147NoneApache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite fi…
CVE-2026-41114NoneApache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver
Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.
CVE-2026-85642High· 7.5Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the da…
CVE-2026-114055High· 7.5vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image s…
CVE-2026-114103Medium· 5.3PoCadm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsifi…
CVE-2026-113711High· 7.5PoCApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
CVE-2026-113729High· 7.5Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference dig…
CVE-2026-101609Medium· 4.4mysql: mysql: Denial of service in InnoDB (CVE-2026-101609)
A flaw was found in the InnoDB component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for …
CVE-2026-101608Medium· 6.5mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101608)
A flaw was found in the MySQL Server Optimizer component. An authenticated remote attacker with low privileges can exploit this vulnerability over the network across multiple protocols. A successful attack allows the attacker to cause the …
CVE-2026-101611Medium· 4.4mysql: mysql: Denial of Service in InnoDB (CVE-2026-101611)
A flaw was found in the InnoDB component of MySQL. A remote attacker with high privileges and network access can exploit this vulnerability to cause the database server to hang or repeatedly crash. This issue results in a complete Denial o…
CVE-2026-101610Medium· 4.9mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101610)
A flaw was found in MySQL's Server Optimizer component. A remote attacker with high administrative privileges can exploit this vulnerability across network protocols to trigger a complete Denial of Service (DoS). Successful exploitation ca…
CVE-2026-101615Medium· 4.4mysql: mysql: Denial of service in InnoDB (CVE-2026-101615)
A flaw was found in the InnoDB component of MySQL. A local attacker with high privileges on the host infrastructure can exploit this vulnerability to cause the database service to hang or repeatedly crash, resulting in a denial of service …
CVE-2026-101614Medium· 4.9mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101614)
A flaw was found in the InnoDB component of MySQL. An authenticated attacker with high privileges and network access can exploit this vulnerability to cause the server to hang or repeatedly crash. This issue results in a complete Denial of…
CVE-2026-101613Medium· 4.9mysql: mysql: Denial of service via DDL component (CVE-2026-101613)
A flaw was found in the Data Definition Language (DDL) component of MySQL Server and MySQL Cluster. An authenticated attacker with high privileges and network access can exploit this vulnerability to cause the server to hang or crash repea…
CVE-2026-101617Medium· 4.9mysql: mysql: Denial of Service in InnoDB (CVE-2026-101617)
A flaw was found in the InnoDB component of MySQL. An authenticated attacker with high privileges and network access can exploit this vulnerability to cause the database server to hang or repeatedly crash. This issue leads to a complete De…
CVE-2026-101622Medium· 4.9mysql: mysql: Denial of Service in InnoDB (CVE-2026-101622)
A flaw was found in the InnoDB component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for …
CVE-2026-101624Medium· 4.9mysql: mysql: Denial of service via InnoDB storage engine (CVE-2026-101624)
A flaw was found in the InnoDB component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for …
CVE-2026-101623Medium· 4.9mysql: mysql: Denial of Service via server optimizer flaw (CVE-2026-101623)
A flaw was found in the Optimizer component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory f…
CVE-2026-101627Medium· 4.4mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101627)
A flaw was found in the InnoDB component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for …
CVE-2026-101679High· 7.5mysql: mysql: Denial of Service via multiple protocols (CVE-2026-101679)
A flaw was found in the Client programs component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advi…
CVE-2026-101721Medium· 4.9mysql: mysql: Denial of Service in Server Components Services (CVE-2026-101721)
A flaw was found in mysql. A remote attacker with high privileges and network access can exploit this vulnerability to cause a Denial of Service (DoS). By targeting the server component services, the attacker can cause the database to hang…
CVE-2026-101724Medium· 4.9mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101724)
A flaw was found in the InnoDB component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for …
CVE-2026-101729Medium· 4.9mysql: mysql: Denial of Service via the Server Replication component (CVE-2026-101729)
A flaw was found in the MySQL replication component. A high-privileged remote attacker with network access can exploit this vulnerability to trigger a hang or repeatable crash. Successful exploitation results in a complete Denial of Servic…
CVE-2026-101726Medium· 6.5mysql: mysql: Denial of Service via the C API (CVE-2026-101726)
A flaw was found in the C API component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for c…
CVE-2026-101730Medium· 4.9mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101730)
A flaw was found in the MySQL Server optimizer component. A remote attacker with high privileges can exploit this vulnerability over network protocols to cause the database server to hang or repeatedly crash. This issue results in a comple…
CVE-2026-101725Medium· 6.5mysql: From CVEorg collector (CVE-2026-101725)
A flaw was found in the C API component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for c…
CVE-2026-101732Medium· 4.9mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101732)
A flaw was found in the Optimizer component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory f…