CWE-770
CVEs classified under CWE-770, newest first.
1108 CVEsRSS
CVE-2026-114644Medium· 5.9Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived …
CVE-2026-115398Medium· 5.5Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import…
CVE-2026-115395Medium· 5.5Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()
Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme a…
CVE-2026-115397Medium· 5.5Ghidra before 12.2 Denial of Service via Extension Archive Install
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a …
CVE-2026-115389Low· 2.3Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebA…
CVE-2026-115381Medium· 4.8Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not confi…
CVE-2026-115380Medium· 4.0Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming …
CVE-2026-115482High· 7.5In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_ent…
CVE-2026-115454Medium· 5.3Large tables in data apps can bring down execution services in KNIME Hub
An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailabi…
CVE-2026-114610Medium· 6.5PoCfpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenc…
CVE-2026-94482High· 8.2Next.js: Denial of Service in App Router using Server Actions
Next.js: Denial of Service in App Router using Server Actions
CVE-2026-75508High· 7.5PoCGraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips com…
CVE-2026-86696High· 8.2Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_co…
CVE-2026-105270High· 8.7Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:dec…
CVE-2026-114731Medium· 5.3Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action)
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit …
CVE-2026-96377Medium· 5.3Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.
CVE-2026-96365High· 7.5Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-114723Low· 3.7Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on ot…
CVE-2026-96640High· 8.2PoCPillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-114144High· 7.5toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
CVE-2026-113791Medium· 6.0pypdf: Possible large memory usage when parsing content streams
pypdf: Possible large memory usage when parsing content streams
CVE-2026-76289Medium· 6.5Denial of Service (DoS) through the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Repres…
CVE-2026-114138High· 7.5PoCDjango REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer …
CVE-2026-96638Medium· 6.5Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch…
CVE-2026-113811NoneAlgorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. The failure shift is cached for each pair of trie state and text character in a field of the m…
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-suppl…
CVE-2026-113790Medium· 6.0pypdf: Possible large memory usage when parsing arrays and dictionaries
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in versio…
CVE-2026-113795Medium· 6.0pypdf: Possible large memory usage for streams with multiple filters
pypdf: Possible large memory usage for streams with multiple filters
CVE-2026-56387NoneApache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive …
CVE-2026-58064NoneApache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bR…