Common Weakness Enumeration
CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
2353 vulnerabilities reference this CWE, most recent first.
CVE-2026-115348 (GCVE-0-2026-115348)
Vulnerability from cvelistv5 – Published: 2026-10-22 19:13 – Updated: 2026-10-23 21:07
VLAI
EPSS
VEX
Title
Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text
Summary
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 17:33 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/lepture/mistune/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/mistune-befo… | third-party-advisory |
Impacted products
Date Public
2026-06-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T17:33:00.385741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T21:07:57.729Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/mistune",
"product": "mistune",
"vendor": "lepture",
"versions": [
{
"lessThan": "3.3.0",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.3.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.3.0",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "seankohjs"
}
],
"datePublic": "2026-06-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser\u0027s parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced \u0027[\u0027 or \u0027![\u0027 characters, forcing repeated unbounded forward scans and tying up worker processes for minutes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T19:13:25.416Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x2gr-6qf2-fc9x)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/lepture/mistune/security/advisories/GHSA-x2gr-6qf2-fc9x"
},
{
"name": "VulnCheck Advisory: Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-time-dos-via-parse-link-text"
}
],
"title": "Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115348",
"datePublished": "2026-10-22T19:13:25.416Z",
"dateReserved": "2026-10-22T11:20:02.626Z",
"dateUpdated": "2026-10-23T21:07:57.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114610 (GCVE-0-2026-114610)
Vulnerability from cvelistv5 – Published: 2026-10-22 17:21 – Updated: 2026-10-29 02:22
VLAI
EPSS
VEX
Title
fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
Summary
fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and require no external resource, XML entity, local file, or permissive network setting. This issue is fixed in version 2.8.8.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 02:21 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/py-pdf/fpdf2/security/advisori… | x_refsource_CONFIRM |
| https://github.com/py-pdf/fpdf2/pull/1889 | x_refsource_MISC |
| https://github.com/py-pdf/fpdf2/commit/d7bd106120… | x_refsource_MISC |
| https://github.com/py-pdf/fpdf2/releases/tag/2.8.8 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114610",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T02:21:53.448102Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:22:14.998Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/py-pdf/fpdf2/security/advisories/GHSA-wqw6-wpr3-45rh"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fpdf2",
"vendor": "py-pdf",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.8.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2\u0027s SVGObject.build_xref() passes nested SVG \u003cuse\u003e references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and require no external resource, XML entity, local file, or permissive network setting. This issue is fixed in version 2.8.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T17:21:11.788Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/py-pdf/fpdf2/security/advisories/GHSA-wqw6-wpr3-45rh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/py-pdf/fpdf2/security/advisories/GHSA-wqw6-wpr3-45rh"
},
{
"name": "https://github.com/py-pdf/fpdf2/pull/1889",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/fpdf2/pull/1889"
},
{
"name": "https://github.com/py-pdf/fpdf2/commit/d7bd1061205d50da6a541dadfdb9d66beb763f2f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/fpdf2/commit/d7bd1061205d50da6a541dadfdb9d66beb763f2f"
},
{
"name": "https://github.com/py-pdf/fpdf2/releases/tag/2.8.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/fpdf2/releases/tag/2.8.8"
}
],
"source": {
"advisory": "GHSA-wqw6-wpr3-45rh",
"discovery": "UNKNOWN"
},
"title": "fpdf2: Exponential SVG \u0027\u003cuse\u003e\u0027 expansion causes CPU and memory exhaustion in \u0027FPDF.image()\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-114610",
"datePublished": "2026-10-22T17:21:11.788Z",
"dateReserved": "2026-10-21T20:34:25.599Z",
"dateUpdated": "2026-10-29T02:22:14.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114603 (GCVE-0-2026-114603)
Vulnerability from cvelistv5 – Published: 2026-10-22 15:29 – Updated: 2026-10-29 02:17
VLAI
EPSS
VEX
Title
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
Summary
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 02:17 UTC
CWE
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/open-telemetry/opentelemetry-p… | x_refsource_CONFIRM |
| https://github.com/open-telemetry/opentelemetry-p… | x_refsource_MISC |
| https://github.com/open-telemetry/opentelemetry-p… | x_refsource_MISC |
| https://github.com/open-telemetry/opentelemetry-p… | x_refsource_MISC |
| https://github.com/open-telemetry/opentelemetry-p… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-telemetry | opentelemetry-python |
Affected:
< 1.45.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114603",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T02:17:18.370250Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:17:42.817Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opentelemetry-python",
"vendor": "open-telemetry",
"versions": [
{
"status": "affected",
"version": "\u003c 1.45.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T15:29:25.108Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h"
},
{
"name": "https://github.com/open-telemetry/opentelemetry-python/pull/5749",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/pull/5749"
},
{
"name": "https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b"
},
{
"name": "https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06"
},
{
"name": "https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1"
}
],
"source": {
"advisory": "GHSA-xcq7-p3pf-p88h",
"discovery": "UNKNOWN"
},
"title": "OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-114603",
"datePublished": "2026-10-22T15:29:25.108Z",
"dateReserved": "2026-10-21T20:34:25.599Z",
"dateUpdated": "2026-10-29T02:17:42.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114426 (GCVE-0-2026-114426)
Vulnerability from cvelistv5 – Published: 2026-11-04 08:33 – Updated: 2026-11-09 21:19
VLAI
EPSS
VEX
Title
Pre-authentication upload parsing permits resource exhaustion
Summary
SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 21:18 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
NCSC.ch
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SEPPmail AG | SEPPmail Secure Email Gateway (SEG) |
Affected:
0 , < 15.1.1
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T21:18:50.797816Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:19:00.551Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SEPPmail Secure Email Gateway (SEG)",
"vendor": "SEPPmail AG",
"versions": [
{
"lessThan": "15.1.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dario Weiss of InfoGuard Labs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eSEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T08:33:13.228Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://docs.seppmail.com/en/20_revision-history.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Pre-authentication upload parsing permits resource exhaustion",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114426",
"datePublished": "2026-11-04T08:33:13.228Z",
"dateReserved": "2026-10-21T13:14:01.740Z",
"dateUpdated": "2026-11-09T21:19:00.551Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114349 (GCVE-0-2026-114349)
Vulnerability from cvelistv5 – Published: 2026-10-28 16:46 – Updated: 2026-11-05 17:28
VLAI
EPSS
VEX
Title
Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
Summary
When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce request can declare a body size of up to about 2 GiB and force the broker to attempt that allocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request size limit, and client/broker quotas bound only the compressed wire size, not the declared decompressed size.
Impact:
An authenticated principal with Write on a topic can crash broker request-handler threads (reached when a batch's codec differs from the topic's compression.type and records are re-encoded) and any consumer that fetches the record, denying service. On brokers started with -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the broker JVM. More seriously, a crafted record is accepted at ingest and written to disk; when the log-cleaner later reads it on a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner thread, which is not restarted. With the default of a single cleaner thread, log compaction then stops for the entire broker, including the internal __consumer_offsets and __transaction_state topics, and the condition persists across restarts until the offending record is removed. The impact is availability only; no data is disclosed or altered.
Mitigation:
Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the broker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is not sufficient: for backward compatibility this configuration defaults to an effectively unlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a value at or slightly above the largest legitimate decompressed record your applications produce, and comfortably below the broker heap divided by the number of request-handler and cleaner threads. Until you can upgrade and configure the limit, restrict Write access to trusted producers; quotas and max.message.bytes do not mitigate this issue.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record's declared decompressed body size against max.decompressed.message.bytes before allocating, on the produce-validation, log-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with InvalidRecordException. Operators must set this configuration to a bounded value to be protected, as its default is effectively unlimited.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 17:28 UTC
CWE
Assigner
apache
CNA
References
3 references
| URL | Tags |
|---|---|
| https://kafka.apache.org/cve-list | vendor-advisory |
| https://lists.apache.org/thread/hdy56hrd1h9btf30j… | mailing-list |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Kafka |
Affected:
0.11.0.0 , < 2.5.0
(maven)
|
|
| Apache Software Foundation | Apache Kafka |
Affected:
0.11.0.0 , < 4.0.0
(maven)
|
|
| Apache Software Foundation | Apache Kafka |
Affected:
2.4.0 , ≤ 4.1.2
(maven)
Affected: 4.2.0 , ≤ 4.2.1 (maven) Affected: 4.3.0 , ≤ 4.3.1 (maven) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-28T20:06:58.727Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-114349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T17:28:36.990519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:28:41.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.kafka:kafka_2.11",
"packageURL": "pkg:maven/org.apache.kafka/kafka_2.11",
"product": "Apache Kafka",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.5.0",
"status": "affected",
"version": "0.11.0.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.kafka:kafka_2.12",
"packageURL": "pkg:maven/org.apache.kafka/kafka_2.12",
"product": "Apache Kafka",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4.0.0",
"status": "affected",
"version": "0.11.0.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.kafka:kafka_2.13",
"packageURL": "pkg:maven/org.apache.kafka/kafka_2.13",
"product": "Apache Kafka",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.1.2",
"status": "affected",
"version": "2.4.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "4.2.1",
"status": "affected",
"version": "4.2.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "4.3.1",
"status": "affected",
"version": "4.3.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peyton Kennedy \u003cpkennedy@endor.ai\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Trung Nguyen \u003ctrungnh@cystack.net\u003e, CyStack"
},
{
"lang": "en",
"type": "reporter",
"value": "Bart\u0142omiej Dmitruk \u003cbartek@striga.ai\u003e, Striga"
},
{
"lang": "en",
"type": "reporter",
"value": "\uc784\uc131\ubbfc \u003cat_haemil@naver.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Mike Read (GitHub: Michael-JRead)"
},
{
"lang": "en",
"type": "reporter",
"value": "Salman Aljardan \u003csalman1aljardan@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Yuchao Zhang \u003cndaugoing@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Yu Bao \u003cyubao@paypal.com\u003e, PayPal Cyber Security Team"
},
{
"lang": "en",
"type": "reporter",
"value": "Vamsi K \u003cxh081ix@gmail.com\u003e"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Srinivas Akhil Mallela \u003csrinivasakhil@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Ashish Modi, OpenLogic by Perforce"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cbr\u003e\u003cdiv\u003eWhen a broker decodes a compressed record batch, the per-record decoder reads a declared body\u0026nbsp;\u003cspan\u003esize from the decompressed stream and allocates a buffer of that size before validating it\u0026nbsp;\u003c/span\u003e\u003cspan\u003eagainst the bytes available or any configured limit. The size is attacker-controlled, and the\u0026nbsp;\u003c/span\u003e\u003cspan\u003ebatch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce\u0026nbsp;\u003c/span\u003e\u003cspan\u003erequest can declare a body size of up to about 2 GiB and force the broker to attempt that\u0026nbsp;\u003c/span\u003e\u003cspan\u003eallocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request\u0026nbsp;\u003c/span\u003e\u003cspan\u003esize limit, and client/broker quotas bound only the compressed wire size, not the declared\u0026nbsp;\u003c/span\u003e\u003cspan\u003edecompressed size.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eImpact:\u003c/div\u003e\u003cdiv\u003eAn authenticated principal with Write on a topic can crash broker request-handler threads\u0026nbsp;\u003cspan\u003e(reached when a batch\u0027s codec differs from the topic\u0027s compression.type and records are\u0026nbsp;\u003c/span\u003e\u003cspan\u003ere-encoded) and any consumer that fetches the record, denying service. On brokers started\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewith -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the\u0026nbsp;\u003c/span\u003e\u003cspan\u003ebroker JVM. More seriously, a\u0026nbsp;crafted record\u0026nbsp;\u0026nbsp;\u003c/span\u003e\u003cspan\u003eis accepted at ingest and written to disk; when the log-cleaner later reads it\u0026nbsp;\u003c/span\u003e\u003cspan\u003eon a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethread, which is not restarted. With the default of a single cleaner thread, log compaction\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethen stops for the entire broker, including the internal __consumer_offsets and\u0026nbsp;\u003c/span\u003e\u003cspan\u003e__transaction_state topics, and the condition persists across restarts until the offending\u0026nbsp;\u003c/span\u003e\u003cspan\u003erecord is removed. The impact is availability only; no data is disclosed or altered.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eMitigation:\u003c/div\u003e\u003cdiv\u003eUpgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the\u0026nbsp;\u003cspan\u003ebroker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is\u0026nbsp;\u003c/span\u003e\u003cspan\u003enot sufficient: for backward compatibility this configuration defaults to an effectively\u0026nbsp;\u003c/span\u003e\u003cspan\u003eunlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a\u0026nbsp;\u003c/span\u003e\u003cspan\u003evalue at or slightly above the largest legitimate decompressed record your applications\u0026nbsp;\u003c/span\u003e\u003cspan\u003eproduce, and comfortably below the broker heap divided by the number of request-handler and\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecleaner threads. Until you can upgrade and configure the limit, restrict Write access to\u0026nbsp;\u003c/span\u003e\u003cspan\u003etrusted producers; quotas and max.message.bytes do not mitigate this issue.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eResolution:\u003c/div\u003e\u003cdiv\u003eFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record\u0027s declared decompressed\u0026nbsp;\u003cspan\u003ebody size against max.decompressed.message.bytes before allocating, on the produce-validation,\u0026nbsp;\u003c/span\u003e\u003cspan\u003elog-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with\u0026nbsp;\u003c/span\u003e\u003cspan\u003eInvalidRecordException. Operators must set this configuration to a bounded value to be protected,\u0026nbsp;\u003c/span\u003e\u003cspan\u003eas its default is effectively unlimited.\u003c/span\u003e\u003c/div\u003e"
}
],
"value": "When a broker decodes a compressed record batch, the per-record decoder reads a declared body\u00a0size from the decompressed stream and allocates a buffer of that size before validating it\u00a0against the bytes available or any configured limit. The size is attacker-controlled, and the\u00a0batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce\u00a0request can declare a body size of up to about 2 GiB and force the broker to attempt that\u00a0allocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request\u00a0size limit, and client/broker quotas bound only the compressed wire size, not the declared\u00a0decompressed size.\n\n\nImpact:\n\nAn authenticated principal with Write on a topic can crash broker request-handler threads\u00a0(reached when a batch\u0027s codec differs from the topic\u0027s compression.type and records are\u00a0re-encoded) and any consumer that fetches the record, denying service. On brokers started\u00a0with -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the\u00a0broker JVM. More seriously, a\u00a0crafted record\u00a0\u00a0is accepted at ingest and written to disk; when the log-cleaner later reads it\u00a0on a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner\u00a0thread, which is not restarted. With the default of a single cleaner thread, log compaction\u00a0then stops for the entire broker, including the internal __consumer_offsets and\u00a0__transaction_state topics, and the condition persists across restarts until the offending\u00a0record is removed. The impact is availability only; no data is disclosed or altered.\n\n\nMitigation:\n\nUpgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the\u00a0broker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is\u00a0not sufficient: for backward compatibility this configuration defaults to an effectively\u00a0unlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a\u00a0value at or slightly above the largest legitimate decompressed record your applications\u00a0produce, and comfortably below the broker heap divided by the number of request-handler and\u00a0cleaner threads. Until you can upgrade and configure the limit, restrict Write access to\u00a0trusted producers; quotas and max.message.bytes do not mitigate this issue.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record\u0027s declared decompressed\u00a0body size against max.decompressed.message.bytes before allocating, on the produce-validation,\u00a0log-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with\u00a0InvalidRecordException. Operators must set this configuration to a bounded value to be protected,\u00a0as its default is effectively unlimited."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory allocation with excessive size value",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper validation of specified quantity in input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T13:48:26.738Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://kafka.apache.org/cve-list"
},
{
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread/hdy56hrd1h9btf30jb1noswsx32l17dq"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-114349",
"datePublished": "2026-10-28T16:46:54.920Z",
"dateReserved": "2026-10-21T08:14:55.090Z",
"dateUpdated": "2026-11-05T17:28:41.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114144 (GCVE-0-2026-114144)
Vulnerability from cvelistv5 – Published: 2026-10-21 20:32 – Updated: 2026-10-30 14:30
VLAI
EPSS
VEX
Title
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
Summary
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 14:30 UTC
CWE
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/BinaryMuse/toml-node/security/… | x_refsource_CONFIRM |
| https://github.com/BinaryMuse/toml-node/commit/9d… | x_refsource_MISC |
| https://github.com/BinaryMuse/toml-node/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| BinaryMuse | toml-node |
Affected:
< 5.0.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114144",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T14:30:01.115470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:30:11.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "toml-node",
"vendor": "BinaryMuse",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T20:32:54.019Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p"
},
{
"name": "https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead"
},
{
"name": "https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"
}
],
"source": {
"advisory": "GHSA-9qmh-m7c6-f92p",
"discovery": "UNKNOWN"
},
"title": "toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-114144",
"datePublished": "2026-10-21T20:32:54.019Z",
"dateReserved": "2026-10-20T21:53:58.474Z",
"dateUpdated": "2026-10-30T14:30:11.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114138 (GCVE-0-2026-114138)
Vulnerability from cvelistv5 – Published: 2026-10-21 20:09 – Updated: 2026-10-28 18:11
VLAI
EPSS
VEX
Title
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
Summary
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType parsing from rest_framework/utils/mediatypes.py for each attacker-controlled token, every renderer, and forced 406 renegotiation. A remote unauthenticated client can send many distinct media types containing large quoted parameter values with numerous semicolons, causing Django's parameter parser and DRF's repeated parsing structure to consume disproportionate CPU. Requests to any reachable endpoint can pin synchronous workers for prolonged periods, and concurrent requests can make the service unavailable until the requests stop. This issue is fixed in version 3.18.2.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 18:11 UTC
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/encode/django-rest-framework/s… | x_refsource_CONFIRM |
| https://github.com/encode/django-rest-framework/c… | x_refsource_MISC |
| https://github.com/encode/django-rest-framework/r… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| encode | django-rest-framework |
Affected:
< 3.18.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114138",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T18:11:09.830556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:11:30.554Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-33wh-fxxf-88vv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-rest-framework",
"vendor": "encode",
"versions": [
{
"status": "affected",
"version": "\u003c 3.18.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType parsing from rest_framework/utils/mediatypes.py for each attacker-controlled token, every renderer, and forced 406 renegotiation. A remote unauthenticated client can send many distinct media types containing large quoted parameter values with numerous semicolons, causing Django\u0027s parameter parser and DRF\u0027s repeated parsing structure to consume disproportionate CPU. Requests to any reachable endpoint can pin synchronous workers for prolonged periods, and concurrent requests can make the service unavailable until the requests stop. This issue is fixed in version 3.18.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T20:09:06.489Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-33wh-fxxf-88vv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-33wh-fxxf-88vv"
},
{
"name": "https://github.com/encode/django-rest-framework/commit/148ab6523922d5a0c110f76615935e5220b63029",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/encode/django-rest-framework/commit/148ab6523922d5a0c110f76615935e5220b63029"
},
{
"name": "https://github.com/encode/django-rest-framework/releases/tag/3.18.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/encode/django-rest-framework/releases/tag/3.18.2"
}
],
"source": {
"advisory": "GHSA-33wh-fxxf-88vv",
"discovery": "UNKNOWN"
},
"title": "Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-114138",
"datePublished": "2026-10-21T20:09:06.489Z",
"dateReserved": "2026-10-20T21:53:58.473Z",
"dateUpdated": "2026-10-28T18:11:30.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114103 (GCVE-0-2026-114103)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:37 – Updated: 2026-10-27 21:54
VLAI
EPSS
VEX
Title
adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
Summary
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-27 21:54 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/cthackers/adm-zip/security/adv… | vendor-advisory |
| https://www.vulncheck.com/advisories/adm-zip-0.6.… | third-party-advisory |
Impacted products
Date Public
2026-09-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114103",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T21:54:35.654847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T21:54:59.911Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-c6fg-446q-cg94"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/adm-zip",
"product": "adm-zip",
"vendor": "cthackers",
"versions": [
{
"lessThan": "0.6.1",
"status": "affected",
"version": "0.6.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.6.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adm-zip_project:adm-zip:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.6.1",
"versionStartIncluding": "0.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zikk090"
}
],
"datePublic": "2026-09-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:37:04.594Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-c6fg-446q-cg94)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-c6fg-446q-cg94"
},
{
"name": "VulnCheck Advisory: adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/adm-zip-0.6.0-decompression-bomb-guard-bypass-via-getdataasync"
}
],
"title": "adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114103",
"datePublished": "2026-10-21T00:37:04.594Z",
"dateReserved": "2026-10-20T21:47:43.313Z",
"dateUpdated": "2026-10-27T21:54:59.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114055 (GCVE-0-2026-114055)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-26 19:49
VLAI
EPSS
VEX
Title
vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
Summary
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 14:40 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/vllm-project/vllm/security/adv… | vendor-advisory |
| https://www.vulncheck.com/advisories/vllm-0.7.3-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vllm-project | vllm |
Affected:
0.7.3 , < 0.31.0
(semver)
Unaffected: 0.31.0 (semver) cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* |
Date Public
2026-10-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114055",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T14:40:33.947720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:50:46.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/vllm",
"product": "vllm",
"vendor": "vllm-project",
"versions": [
{
"lessThan": "0.31.0",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.31.0",
"versionStartIncluding": "0.7.3",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chedrian07"
},
{
"lang": "en",
"type": "coordinator",
"value": "jperezdealgaba"
},
{
"lang": "en",
"type": "remediation developer",
"value": "DarkLight1337"
}
],
"datePublic": "2026-10-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:49:33.622Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gx7p-2j49-hfq4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-gx7p-2j49-hfq4"
},
{
"name": "VulnCheck Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-dos-via-unvalidated-mm-processor-kwargs"
}
],
"title": "vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114055",
"datePublished": "2026-10-21T00:36:31.227Z",
"dateReserved": "2026-10-20T21:42:27.669Z",
"dateUpdated": "2026-10-26T19:49:33.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113795 (GCVE-0-2026-113795)
Vulnerability from cvelistv5 – Published: 2026-10-21 16:01 – Updated: 2026-10-30 15:58
VLAI
EPSS
VEX
Title
pypdf: Possible large memory usage for streams with multiple filters
Summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:58 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/py-pdf/pypdf/security/advisori… | x_refsource_CONFIRM |
| https://github.com/py-pdf/pypdf/pull/4173 | x_refsource_MISC |
| https://github.com/py-pdf/pypdf/commit/80a84d4be6… | x_refsource_MISC |
| https://github.com/py-pdf/pypdf/releases/tag/6.20.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113795",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:58:24.825765Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:58:32.072Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pypdf",
"vendor": "py-pdf",
"versions": [
{
"status": "affected",
"version": "\u003c 6.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:01:22.314Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f"
},
{
"name": "https://github.com/py-pdf/pypdf/pull/4173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/pull/4173"
},
{
"name": "https://github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185"
},
{
"name": "https://github.com/py-pdf/pypdf/releases/tag/6.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/releases/tag/6.20.0"
}
],
"source": {
"advisory": "GHSA-7mh2-4gg2-979f",
"discovery": "UNKNOWN"
},
"title": "pypdf: Possible large memory usage for streams with multiple filters"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113795",
"datePublished": "2026-10-21T16:01:22.314Z",
"dateReserved": "2026-10-20T17:39:41.373Z",
"dateUpdated": "2026-10-30T15:58:32.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
Architecture and Design
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Implementation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.