CWE-770
CVEs classified under CWE-770, newest first.
1139 CVEsRSS
CVE-2026-114644Medium· 5.9PoCMemory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived …
CVE-2026-115398Medium· 5.5Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import…
CVE-2026-115395Medium· 5.5Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()
Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme a…
CVE-2026-115397Medium· 5.5Ghidra before 12.2 Denial of Service via Extension Archive Install
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a …
CVE-2026-115391Medium· 5.8Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can off…
CVE-2026-115389Low· 2.3Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebA…
CVE-2026-115381Medium· 4.8Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not confi…
CVE-2026-115380Medium· 4.0Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming …
CVE-2026-115482High· 7.5In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_ent…
CVE-2026-115454Medium· 5.3Large tables in data apps can bring down execution services in KNIME Hub
An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailabi…
CVE-2026-114610Medium· 6.5PoCfpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenc…
CVE-2026-94482High· 8.2Next.js: Denial of Service in App Router using Server Actions
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block…
CVE-2026-75508High· 7.5PoCGraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips com…
CVE-2026-86696High· 8.2PoCUnbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_co…
CVE-2026-105270High· 8.7PoCUnbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:dec…
CVE-2026-114731Medium· 5.3Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action)
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit …
CVE-2026-96377Medium· 5.3Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.
CVE-2026-96365High· 7.5Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-114723Low· 3.7Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on ot…
CVE-2026-96640High· 8.2PoCPillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-96638Medium· 6.5Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
CVE-2026-76289Medium· 6.5Denial of Service (DoS) through the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Repres…
CVE-2026-114138High· 7.5PoCDjango REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer …
CVE-2026-114144High· 7.5PoCtoml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks…
CVE-2026-113811High· 7.5PoCAlgorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. The failure shift is cached for each pair of trie state and text character in a field of the m…
CVE-2026-114136High· 7.5PoCDjango REST framework: JSONParser applies an attacker-named codec to the request stream
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform code…
CVE-2026-113790Medium· 6.0pypdf: Possible large memory usage when parsing arrays and dictionaries
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in versio…
CVE-2026-113791Medium· 6.0pypdf: Possible large memory usage when parsing content streams
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in vers…
CVE-2026-113795Medium· 6.0pypdf: Possible large memory usage for streams with multiple filters
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This i…
CVE-2026-56387High· 7.5Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive …