Common Weakness Enumeration
CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
2353 vulnerabilities reference this CWE, most recent first.
CVE-2026-125224 (GCVE-0-2026-125224)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 21:06
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata
Summary
FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid extradata for every packet when valid_extradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CPU during demuxing or probing.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:58 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25694 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/90f5e61a1… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125224",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:58:59.946259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:06:55.096Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid extradata for every packet when valid_extradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CPU during demuxing or probing."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:37.332Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25694"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/90f5e61a1da2dcc0050169af8ca593530f26071b"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vorbis_parser.c#L312"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vorbis-parser-cpu-exhaustion-via-invalid-extradata"
}
],
"title": "FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125224",
"datePublished": "2026-11-09T19:11:37.332Z",
"dateReserved": "2026-11-09T18:15:20.740Z",
"dateUpdated": "2026-11-09T21:06:55.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125111 (GCVE-0-2026-125111)
Vulnerability from cvelistv5 – Published: 2026-11-09 22:02 – Updated: 2026-11-09 22:02
VLAI
EPSS
VEX
Title
Rack: Multipart parsing allows DoS via unbounded scan buffer growth
Summary
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with rack.multipart.buffer_size boundaries so the buffer grows with the request despite per-field, header, and preamble limits, causing a worker to exhaust memory. The attack requires only a well-formed multipart body and affects applications that parse multipart requests. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.
Severity
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rack/rack/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/rack/rack/commit/244e75a840cee… | x_refsource_MISC |
| https://github.com/rack/rack/commit/2eaa5b1026a03… | x_refsource_MISC |
| https://github.com/rack/rack/commit/c9b4698595050… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "rack",
"vendor": "rack",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.25"
},
{
"status": "affected",
"version": "\u003e= 3.0, \u003c 3.1.23"
},
{
"status": "affected",
"version": "\u003e= 3.2, \u003c 3.2.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with rack.multipart.buffer_size boundaries so the buffer grows with the request despite per-field, header, and preamble limits, causing a worker to exhaust memory. The attack requires only a well-formed multipart body and affects applications that parse multipart requests. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:02:38.334Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm"
},
{
"name": "https://github.com/rack/rack/commit/244e75a840cee0823f86d5d01dc374505a8abed8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rack/rack/commit/244e75a840cee0823f86d5d01dc374505a8abed8"
},
{
"name": "https://github.com/rack/rack/commit/2eaa5b1026a03a43b6537b1a0b233707ba887702",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rack/rack/commit/2eaa5b1026a03a43b6537b1a0b233707ba887702"
},
{
"name": "https://github.com/rack/rack/commit/c9b4698595050838342bd3b5a0fc9ab908065f8f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rack/rack/commit/c9b4698595050838342bd3b5a0fc9ab908065f8f"
}
],
"source": {
"advisory": "GHSA-5v64-555j-wjxm",
"discovery": "UNKNOWN"
},
"title": "Rack: Multipart parsing allows DoS via unbounded scan buffer growth"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125111",
"datePublished": "2026-11-09T22:02:38.334Z",
"dateReserved": "2026-11-09T17:45:35.936Z",
"dateUpdated": "2026-11-09T22:02:38.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124437 (GCVE-0-2026-124437)
Vulnerability from cvelistv5 – Published: 2026-11-08 13:15 – Updated: 2026-11-08 13:15
VLAI
EPSS
VEX
Title
Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion
Summary
Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/scriban/scriban/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/scriban-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:nuget/Scriban",
"product": "scriban",
"vendor": "scriban",
"versions": [
{
"lessThan": "7.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.5.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:nuget/Scriban.Signed",
"product": "scriban",
"vendor": "scriban",
"versions": [
{
"lessThan": "7.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.5.3",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T13:15:31.634Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-95w2-9mjq-6c74)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/scriban/scriban/security/advisories/GHSA-95w2-9mjq-6c74"
},
{
"name": "VulnCheck Advisory: Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-unguarded-builtins-and-recursion"
}
],
"title": "Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-124437",
"datePublished": "2026-11-08T13:15:31.634Z",
"dateReserved": "2026-11-08T02:13:42.362Z",
"dateUpdated": "2026-11-08T13:15:31.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123748 (GCVE-0-2026-123748)
Vulnerability from cvelistv5 – Published: 2026-11-06 17:15 – Updated: 2026-11-09 22:44 X_Open Source
VLAI
EPSS
VEX
Title
chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption
Summary
A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:34 UTC
Assigner
VulDB
CNA
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431905 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431905/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123748 | third-party-advisory |
| https://vuldb.com/submit/1033605 | third-party-advisory |
| https://github.com/chenyme/grok2api/issues/1071 | issue-tracking |
| https://github.com/chenyme/grok2api/pull/1073 | issue-trackingpatch |
| https://github.com/chenyme/grok2api/commit/7ad0f7… | patch |
| https://github.com/chenyme/grok2api/releases/tag/v3.1.7 | patch |
| https://github.com/chenyme/grok2api/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123748",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:34:54.834782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:44:46.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*"
],
"modules": [
"WebSocket Proxy"
],
"product": "grok2api",
"vendor": "chenyme",
"versions": [
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.1.1"
},
{
"status": "affected",
"version": "3.1.2"
},
{
"status": "affected",
"version": "3.1.3"
},
{
"status": "affected",
"version": "3.1.4"
},
{
"status": "affected",
"version": "3.1.5"
},
{
"status": "affected",
"version": "3.1.6"
},
{
"status": "unaffected",
"version": "3.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "carfeii (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:15:20.058Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431905 | chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431905"
},
{
"name": "VDB-431905 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431905/cti"
},
{
"name": "CVE-2026-123748 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123748"
},
{
"name": "Submit #1033605 | https://github.com/chenyme/ grok2api v3.1.6 Uncontrolled Resource Consumption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033605"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/chenyme/grok2api/issues/1071"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/chenyme/grok2api/pull/1073"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chenyme/grok2api/releases/tag/v3.1.7"
},
{
"tags": [
"product"
],
"url": "https://github.com/chenyme/grok2api/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-06T14:03:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123748",
"datePublished": "2026-11-06T17:15:20.058Z",
"dateReserved": "2026-11-06T12:58:35.166Z",
"dateUpdated": "2026-11-09T22:44:46.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123606 (GCVE-0-2026-123606)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-09 13:52
VLAI
EPSS
VEX
Title
Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification
Summary
The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 13:52 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/hickory-dns-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-dns |
Affected:
0.25.0-alpha.3 , ≤ 0.25.2
(semver)
|
|
| hickory-dns | hickory-dns |
Affected:
0.26.0-alpha.1 , < 0.26.2
(semver)
Unaffected: 0.26.2 (semver) |
Date Public
2026-09-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123606",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T13:52:24.658971Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T13:52:33.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-recursor",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThanOrEqual": "0.25.2",
"status": "affected",
"version": "0.25.0-alpha.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-resolver",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThan": "0.26.2",
"status": "affected",
"version": "0.26.0-alpha.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.26.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qifan-sailboat"
}
],
"datePublic": "2026-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:38:32.727Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6h5c-jjg5-wj59)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6h5c-jjg5-wj59"
},
{
"name": "VulnCheck Advisory: Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hickory-dns-recursor-0.25.0-alpha.3-through-0.25.2-glueless-ns-referral-amplification"
}
],
"title": "Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123606",
"datePublished": "2026-11-08T01:38:32.727Z",
"dateReserved": "2026-11-06T01:02:39.794Z",
"dateUpdated": "2026-11-09T13:52:33.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123586 (GCVE-0-2026-123586)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-09 13:54
VLAI
EPSS
VEX
Title
Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals
Summary
Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 13:54 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/hickory-dns-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-dns |
Affected:
0.25.0-alpha.3 , ≤ 0.25.2
(semver)
|
|
| hickory-dns | hickory-dns |
Affected:
0 , < 0.26.2
(semver)
Unaffected: 0.26.2 (semver) |
Date Public
2026-09-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T13:54:27.883535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T13:54:36.684Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-recursor",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThanOrEqual": "0.25.2",
"status": "affected",
"version": "0.25.0-alpha.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-resolver",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThan": "0.26.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.26.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qifan-sailboat"
}
],
"datePublic": "2026-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:38:18.937Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cx5j-p54p-q756)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756"
},
{
"name": "VulnCheck Advisory: Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hickory-dns-0.25.0-alpha.3-through-0.25.2-query-amplification-via-cyclic-referrals"
}
],
"title": "Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123586",
"datePublished": "2026-11-08T01:38:18.937Z",
"dateReserved": "2026-11-06T00:57:31.044Z",
"dateUpdated": "2026-11-09T13:54:36.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123585 (GCVE-0-2026-123585)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-08 01:38
VLAI
EPSS
VEX
Title
Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records
Summary
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.
Severity
5.3 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/hickory-dns-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-dns |
Affected:
0.25.0 , < 0.26.2
(semver)
Unaffected: 0.26.2 (semver) |
Date Public
2026-09-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-resolver",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThan": "0.26.2",
"status": "affected",
"version": "0.25.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.26.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qifan-sailboat"
}
],
"datePublic": "2026-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name\u0027s CNAME chain, causing excess resolver queries and increased query amplification."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:38:18.261Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6f2x-v7q7-m7m5)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5"
},
{
"name": "VulnCheck Advisory: Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-query-amplification-via-irrelevant-cname-records"
}
],
"title": "Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123585",
"datePublished": "2026-11-08T01:38:18.261Z",
"dateReserved": "2026-11-06T00:57:31.044Z",
"dateUpdated": "2026-11-08T01:38:18.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123570 (GCVE-0-2026-123570)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-09 13:55
VLAI
EPSS
VEX
Title
Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts
Summary
The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 13:55 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/hickory-dns-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-dns |
Affected:
0.18 , < 0.26.2
(custom)
Unaffected: 0.26.2 (semver) |
Date Public
2026-09-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123570",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T13:55:49.382736Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T13:55:57.344Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-proto",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThan": "0.26.2",
"status": "affected",
"version": "0.18",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.26.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jpds"
}
],
"datePublic": "2026-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:38:07.919Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-67wc-6jq8-ghrc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-67wc-6jq8-ghrc"
},
{
"name": "VulnCheck Advisory: Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hickory-dns-from-0.18-before-0.26.2-memory-amplification-dos-via-rr-counts"
}
],
"title": "Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123570",
"datePublished": "2026-11-08T01:38:07.919Z",
"dateReserved": "2026-11-06T00:53:14.313Z",
"dateUpdated": "2026-11-09T13:55:57.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123566 (GCVE-0-2026-123566)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-09 13:56
VLAI
EPSS
VEX
Title
Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
Summary
Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 13:56 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/sveltejs/devalue/security/advi… | vendor-advisory |
| https://www.vulncheck.com/advisories/devalue-befo… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123566",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T13:56:15.132234Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T13:56:46.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/devalue",
"product": "devalue",
"vendor": "sveltejs",
"versions": [
{
"lessThan": "5.9.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.9.3",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:svelte:devalue:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.9.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "elliott-with-the-longest-name-on-github"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:38:05.159Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hx4r-w6wj-j8fg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/sveltejs/devalue/security/advisories/GHSA-hx4r-w6wj-j8fg"
},
{
"name": "VulnCheck Advisory: Devalue before 5.9.3 CPU Amplification Denial of Service via uneval",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/devalue-before-5.9.3-cpu-amplification-denial-of-service-via-uneval"
}
],
"title": "Devalue before 5.9.3 CPU Amplification Denial of Service via uneval",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123566",
"datePublished": "2026-11-08T01:38:05.159Z",
"dateReserved": "2026-11-06T00:53:14.312Z",
"dateUpdated": "2026-11-09T13:56:46.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123565 (GCVE-0-2026-123565)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-08 01:38
VLAI
EPSS
VEX
Title
Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval
Summary
Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/sveltejs/devalue/security/advi… | vendor-advisory |
| https://www.vulncheck.com/advisories/devalue-befo… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/devalue",
"product": "devalue",
"vendor": "sveltejs",
"versions": [
{
"lessThan": "5.9.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.9.3",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:svelte:devalue:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.9.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "elliott-with-the-longest-name-on-github"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:38:04.469Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mcm9-63f2-9j32)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32"
},
{
"name": "VulnCheck Advisory: Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/devalue-before-5.9.3-quadratic-expansion-denial-of-service-via-uneval"
}
],
"title": "Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123565",
"datePublished": "2026-11-08T01:38:04.469Z",
"dateReserved": "2026-11-06T00:53:14.312Z",
"dateUpdated": "2026-11-08T01:38:04.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
Architecture and Design
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Implementation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.