CWE-770

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105297",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T19:20:25.097096Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T19:20:35.542Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "https://github.com/cloudflare/pingora",
          "repo": "https://github.com/cloudflare/pingora",
          "vendor": "Cloudflare",
          "versions": [
            {
              "lessThan": "0.8.1",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Reported by jro-calif (GitHub)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSummary\u003c/p\u003e\u003cp\u003eBefore version 0.8.1, Pingora\u0027s HTTP/2 server used the h2 crate\u0027s default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process.\u003c/p\u003e\u003cbr\u003e\u003cp\u003eImpact\u003c/p\u003e\u003cp\u003eRemote, unauthenticated denial of service against any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting max_header_list_size and max_concurrent_streams. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed.\u003c/p\u003e\u003cbr\u003e\u003cp\u003eNote that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.\u003c/p\u003e\u003cp\u003eMitigation:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eUpgrade to pingora 0.8.1 or later (fix: \u003ca href=\"https://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd\"\u003ehttps://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd\u003c/a\u003e). When no H2Options are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eApplications that supply their own H2Options are not covered by these defaults and must set max_header_list_size and max_concurrent_streams explicitly (this also works on versions before 0.8.1), or, on 0.8.1 and later, start from pingora_core::protocols::http::v2::server::default_h2_options(). H2Options::default() does not include these limits.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "Summary\n\n\n\nBefore version 0.8.1, Pingora\u0027s HTTP/2 server used the h2 crate\u0027s default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process.\n\n\n\n\nImpact\n\n\n\nRemote, unauthenticated denial of service against any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting max_header_list_size and max_concurrent_streams. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed.\n\n\n\n\nNote that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.\n\n\n\nMitigation:\n\n  *  \n\nUpgrade to pingora 0.8.1 or later (fix:  https://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd ). When no H2Options are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection.\n\n\n  *  \n\nApplications that supply their own H2Options are not covered by these defaults and must set max_header_list_size and max_concurrent_streams explicitly (this also works on versions before 0.8.1), or, on 0.8.1 and later, start from pingora_core::protocols::http::v2::server::default_h2_options(). H2Options::default() does not include these limits."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of resources without limits or throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T00:40:27.300Z",
        "orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
        "shortName": "cloudflare"
      },
      "references": [
        {
          "url": "https://github.com/cloudflare/pingora"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003cp\u003eMitigation:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eUpgrade to pingora 0.8.1 or later (fix: \u003ca href=\"https://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd\"\u003ehttps://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd\u003c/a\u003e). When no H2Options are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eApplications that supply their own H2Options are not covered by these defaults and must set max_header_list_size and max_concurrent_streams explicitly (this also works on versions before 0.8.1), or, on 0.8.1 and later, start from pingora_core::protocols::http::v2::server::default_h2_options(). H2Options::default() does not include these limits.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/b\u003e"
            }
          ],
          "value": "Mitigation:\n\n  *  \n\nUpgrade to pingora 0.8.1 or later (fix:  https://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd ). When no H2Options are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection.\n\n\n  *  \n\nApplications that supply their own H2Options are not covered by these defaults and must set max_header_list_size and max_concurrent_streams explicitly (this also works on versions before 0.8.1), or, on 0.8.1 and later, start from pingora_core::protocols::http::v2::server::default_h2_options(). H2Options::default() does not include these limits."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
    "assignerShortName": "cloudflare",
    "cveId": "CVE-2026-105297",
    "datePublished": "2026-10-20T00:40:27.300Z",
    "dateReserved": "2026-10-05T04:18:56.102Z",
    "dateUpdated": "2026-10-20T19:20:35.542Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105270",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:04:17.988212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:04:50.590Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-105270"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "esaml_binding",
            "esaml_cowboy"
          ],
          "packageName": "arekinath/esaml",
          "packageURL": "pkg:github/arekinath/esaml",
          "product": "esaml",
          "programFiles": [
            "src/esaml_binding.erl",
            "src/esaml_cowboy.erl"
          ],
          "programRoutines": [
            {
              "name": "esaml_binding:decode_response/2"
            },
            {
              "name": "esaml_cowboy:validate_assertion/2"
            },
            {
              "name": "esaml_cowboy:validate_logout/2"
            }
          ],
          "repo": "https://github.com/arekinath/esaml",
          "vendor": "arekinath",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "esaml_binding",
            "esaml_cowboy"
          ],
          "packageName": "handnot2/esaml",
          "packageURL": "pkg:github/handnot2/esaml",
          "product": "esaml",
          "programFiles": [
            "src/esaml_binding.erl",
            "src/esaml_cowboy.erl"
          ],
          "programRoutines": [
            {
              "name": "esaml_binding:decode_response/2"
            },
            {
              "name": "esaml_cowboy:validate_assertion/2"
            },
            {
              "name": "esaml_cowboy:validate_logout/2"
            }
          ],
          "repo": "https://github.com/handnot2/esaml",
          "vendor": "handnot2",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "esaml_binding",
            "esaml_cowboy"
          ],
          "packageName": "esaml",
          "packageURL": "pkg:hex/esaml",
          "product": "esaml",
          "programFiles": [
            "src/esaml_binding.erl",
            "src/esaml_cowboy.erl"
          ],
          "programRoutines": [
            {
              "name": "esaml_binding:decode_response/2"
            },
            {
              "name": "esaml_cowboy:validate_assertion/2"
            },
            {
              "name": "esaml_cowboy:validate_logout/2"
            }
          ],
          "repo": "https://github.com/dropbox/esaml",
          "vendor": "dropbox",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "esaml_binding",
            "esaml_cowboy"
          ],
          "packageName": "dropbox/esaml",
          "packageURL": "pkg:github/dropbox/esaml",
          "product": "esaml",
          "programFiles": [
            "src/esaml_binding.erl",
            "src/esaml_cowboy.erl"
          ],
          "programRoutines": [
            {
              "name": "esaml_binding:decode_response/2"
            },
            {
              "name": "esaml_cowboy:validate_assertion/2"
            },
            {
              "name": "esaml_cowboy:validate_logout/2"
            }
          ],
          "repo": "https://github.com/dropbox/esaml",
          "vendor": "dropbox",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Quinn Wilton"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Quinn Wilton"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-10-08T14:44:30.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in \u003ccode\u003eesaml_binding\u003c/code\u003e in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted \u003ccode\u003eSAMLResponse\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eesaml_binding:decode_response/2\u003c/code\u003e parses the decoded \u003ccode\u003eSAMLResponse\u003c/code\u003e with \u003ccode\u003exmerl_scan:string/2\u003c/code\u003e, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.\u003c/p\u003e\n\u003cp\u003eThis issue affects esaml: from 0.1.0 onward.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in `esaml_binding` in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted `SAMLResponse`.\n\n`esaml_binding:decode_response/2` parses the decoded `SAMLResponse` with `xmerl_scan:string/2`, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.\n\nThis issue affects esaml: from 0.1.0 onward."
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.\n\nesaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.\n\nThis issue affects esaml: from 0.1.0 onward."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn unauthenticated attacker posts a small SAML document with thousands of distinct element and attribute names to a service provider\u0027s consume or single-logout endpoint. Each request permanently consumes thousands of atom table entries, and a few dozen requests abort the Erlang VM, denying service to every user of the service provider.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An unauthenticated attacker posts a small SAML document with thousands of distinct element and attribute names to a service provider\u0027s consume or single-logout endpoint. Each request permanently consumes thousands of atom table entries, and a few dozen requests abort the Erlang VM, denying service to every user of the service provider."
                }
              ],
              "value": "An unauthenticated attacker posts a small SAML document with thousands of distinct element and attribute names to a service provider\u0027s consume or single-logout endpoint. Each request permanently consumes thousands of atom table entries, and a few dozen requests abort the Erlang VM, denying service to every user of the service provider."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T06:58:43.034Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "EEF CNA record for CVE-2026-105270",
          "tags": [
            "related",
            "third-party-advisory"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-105270.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-105270",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-105270"
        },
        {
          "name": "Introducing commit deeb843 in arekinath/esaml",
          "tags": [
            "related"
          ],
          "url": "https://github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"
        },
        {
          "name": "Introducing commit deeb843 in handnot2/esaml",
          "tags": [
            "related"
          ],
          "url": "https://github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"
        },
        {
          "name": "Introducing commit deeb843 in dropbox/esaml",
          "tags": [
            "related",
            "broken-link"
          ],
          "url": "https://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion",
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eBuild a well-formed XML document whose root contains several thousand empty elements with distinct names, each carrying a distinctly named attribute, for example \u003ccode\u003e\u0026lt;p0 a0=\"x\"/\u0026gt;\u003c/code\u003e through \u003ccode\u003e\u0026lt;p4999 a4999=\"x\"/\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDeflate and base64-encode it, and post it to the service provider\u0027s SAML consume (ACS) or single-logout endpoint as the \u003ccode\u003eSAMLResponse\u003c/code\u003e form field with \u003ccode\u003eSAMLEncoding\u003c/code\u003e set to the DEFLATE URI. A document with 5,000 elements and 5,000 attributes encodes to about 33 KB.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eesaml_binding:decode_response/2\u003c/code\u003e parses it with \u003ccode\u003exmerl_scan:string/2\u003c/code\u003e before any signature check, and the atom table grows by 10,000 entries that are never reclaimed. Repeat with fresh names until the VM aborts.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. Build a well-formed XML document whose root contains several thousand empty elements with distinct names, each carrying a distinctly named attribute, for example `\u003cp0 a0=\"x\"/\u003e` through `\u003cp4999 a4999=\"x\"/\u003e`.\n2. Deflate and base64-encode it, and post it to the service provider\u0027s SAML consume (ACS) or single-logout endpoint as the `SAMLResponse` form field with `SAMLEncoding` set to the DEFLATE URI. A document with 5,000 elements and 5,000 attributes encodes to about 33 KB.\n3. `esaml_binding:decode_response/2` parses it with `xmerl_scan:string/2` before any signature check, and the atom table grows by 10,000 entries that are never reclaimed. Repeat with fresh names until the VM aborts."
            }
          ],
          "value": "* Build a well-formed XML document whose root contains several thousand empty elements with distinct names, each carrying a distinctly named attribute, for example \u003cp0 a0=\"x\"/\u003e through \u003cp4999 a4999=\"x\"/\u003e.\n* Deflate and base64-encode it, and post it to the service provider\u0027s SAML consume (ACS) or single-logout endpoint as the SAMLResponse form field with SAMLEncoding set to the DEFLATE URI. A document with 5,000 elements and 5,000 attributes encodes to about 33 KB.\n* esaml_binding:decode_response/2 parses it with xmerl_scan:string/2 before any signature check, and the atom table grows by 10,000 entries that are never reclaimed. Repeat with fresh names until the VM aborts."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Input.\u003c/strong\u003e The SAML consume (ACS) and single-logout endpoints in \u003ccode\u003eesaml_cowboy\u003c/code\u003e read the request body, capped at 128 KB, and pass the \u003ccode\u003eSAMLResponse\u003c/code\u003e form field to \u003ccode\u003eesaml_binding:decode_response/2\u003c/code\u003e. Both the DEFLATE clause and the default clause end in \u003ccode\u003exmerl_scan:string/2\u003c/code\u003e with \u003ccode\u003enamespace_conformant\u003c/code\u003e set.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Interning.\u003c/strong\u003e \u003ccode\u003exmerl_scan\u003c/code\u003e converts every element name, attribute name, and namespace prefix it tokenizes into an atom with \u003ccode\u003elist_to_atom/1\u003c/code\u003e, and the same happens for each namespace local name in \u003ccode\u003eexpanded_name/4\u003c/code\u003e. A well-formed document with many distinct names therefore mints one permanent atom per name. Repetitive names deflate well, so a document with ten thousand distinct names fits in a few tens of kilobytes on the wire.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Exhaustion before any check.\u003c/strong\u003e Signature verification and assertion validation run on the parsed document afterward, so the atoms are minted whether or not the document is a valid or signed SAML message. Atoms are never garbage collected and the VM aborts when the atom table reaches its limit of about one million entries, so a few dozen requests take the node down.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Input.** The SAML consume (ACS) and single-logout endpoints in `esaml_cowboy` read the request body, capped at 128 KB, and pass the `SAMLResponse` form field to `esaml_binding:decode_response/2`. Both the DEFLATE clause and the default clause end in `xmerl_scan:string/2` with `namespace_conformant` set.\n\n**2. Interning.** `xmerl_scan` converts every element name, attribute name, and namespace prefix it tokenizes into an atom with `list_to_atom/1`, and the same happens for each namespace local name in `expanded_name/4`. A well-formed document with many distinct names therefore mints one permanent atom per name. Repetitive names deflate well, so a document with ten thousand distinct names fits in a few tens of kilobytes on the wire.\n\n**3. Exhaustion before any check.** Signature verification and assertion validation run on the parsed document afterward, so the atoms are minted whether or not the document is a valid or signed SAML message. Atoms are never garbage collected and the VM aborts when the atom table reaches its limit of about one million entries, so a few dozen requests take the node down."
            }
          ],
          "value": "1. Input. The SAML consume (ACS) and single-logout endpoints in esaml_cowboy read the request body, capped at 128 KB, and pass the SAMLResponse form field to esaml_binding:decode_response/2. Both the DEFLATE clause and the default clause end in xmerl_scan:string/2 with namespace_conformant set.\n\n2. Interning. xmerl_scan converts every element name, attribute name, and namespace prefix it tokenizes into an atom with list_to_atom/1, and the same happens for each namespace local name in expanded_name/4. A well-formed document with many distinct names therefore mints one permanent atom per name. Repetitive names deflate well, so a document with ten thousand distinct names fits in a few tens of kilobytes on the wire.\n\n3. Exhaustion before any check. Signature verification and assertion validation run on the parsed document afterward, so the atoms are minted whether or not the document is a valid or signed SAML message. Atoms are never garbage collected and the VM aborts when the atom table reaches its limit of about one million entries, so a few dozen requests take the node down."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-105270",
    "datePublished": "2026-10-22T06:58:43.034Z",
    "dateReserved": "2026-10-07T22:15:01.882Z",
    "dateUpdated": "2026-10-30T18:04:50.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105127",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T15:42:13.004909Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T15:42:38.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-v36p-8578-8gch"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/laradashboard/laradashboard",
          "product": "laradashboard",
          "vendor": "laradashboard",
          "versions": [
            {
              "lessThan": "1.4.8",
              "status": "affected",
              "version": "1.4.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.4.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:laradashboard:lara_dashboard:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "EVIL0RD"
        }
      ],
      "datePublic": "2026-09-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making validation fail open for all public forms, and probe domain resolution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T23:40:00.470Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-v36p-8578-8gch)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-v36p-8578-8gch"
        },
        {
          "name": "GitHub Security Advisory (GHSA-5hq2-r2f3-9vp9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-5hq2-r2f3-9vp9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/Auth/ForgotPasswordRequest.php#L22-L27"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/Auth/ResetPasswordRequest.php#L23-L30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/EmailVerificationService.php#L95-L114"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/EmailDomainCheckService.php#L128"
        },
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/laradashboard/laradashboard/pull/339"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/laradashboard/laradashboard/commit/8babc803066a74c628fa012928fb1e6591411eba"
        },
        {
          "name": "laradashboard v1.4.8 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/laradashboard/laradashboard"
        },
        {
          "name": "VulnCheck Advisory: LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/laradashboard-1.4.2-before-1.4.8-resource-exhaustion-via-password-recovery-endpoints"
        }
      ],
      "title": "LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-105127",
    "datePublished": "2026-10-03T23:40:00.470Z",
    "dateReserved": "2026-10-03T12:05:26.755Z",
    "dateUpdated": "2026-10-05T15:42:38.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104893",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T17:33:58.706981Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T17:41:38.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "plane",
          "vendor": "makeplane",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows the user to modify the token\u0027s allowed_rate_limit field without server-side validation or a maximum value. A user can raise the limit arbitrarily and bypass intended API rate-limiting controls, enabling high-volume automated requests, backend resource abuse, and possible resource exhaustion. This issue is fixed in 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T16:40:12.607Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/makeplane/plane/security/advisories/GHSA-xfgr-2x3f-g2cf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/makeplane/plane/security/advisories/GHSA-xfgr-2x3f-g2cf"
        },
        {
          "name": "https://github.com/makeplane/plane/pull/9148",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/makeplane/plane/pull/9148"
        },
        {
          "name": "https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d"
        },
        {
          "name": "https://github.com/makeplane/plane/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/makeplane/plane/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xfgr-2x3f-g2cf",
        "discovery": "UNKNOWN"
      },
      "title": "Plane: Improper validation allows arbitrary modification of API token rate limits"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104893",
    "datePublished": "2026-10-05T16:40:12.607Z",
    "dateReserved": "2026-10-02T14:59:11.776Z",
    "dateUpdated": "2026-10-06T17:41:38.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104845",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T16:34:12.143577Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T16:34:23.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "seroval",
          "vendor": "lxsmnsyc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can provide a small untrusted JSON object with a large length value, causing the array-like TypedArray constructor to synchronously allocate the selected number of elements and exhaust CPU or memory while starving the event loop. The offset check does not reject the crafted source because source.byteLength is undefined. DataView reaches a similar unchecked cast but throws rather than allocating, and the issue has no identified confidentiality or integrity impact. This issue is fixed in version 1.6.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T15:55:21.197Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-jp82-f5mq-hwhp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-jp82-f5mq-hwhp"
        },
        {
          "name": "https://github.com/lxsmnsyc/seroval/commit/ac0163e420ac7dcbbefac4d069bcefad300a4851",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lxsmnsyc/seroval/commit/ac0163e420ac7dcbbefac4d069bcefad300a4851"
        },
        {
          "name": "https://github.com/lxsmnsyc/seroval/commit/e54a6f62784b9e48e3a5fa2ab4089ca69fb8996e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lxsmnsyc/seroval/commit/e54a6f62784b9e48e3a5fa2ab4089ca69fb8996e"
        }
      ],
      "source": {
        "advisory": "GHSA-jp82-f5mq-hwhp",
        "discovery": "UNKNOWN"
      },
      "title": "Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104845",
    "datePublished": "2026-10-02T15:55:21.197Z",
    "dateReserved": "2026-10-02T14:38:43.243Z",
    "dateUpdated": "2026-10-06T16:34:23.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104827",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:22:22.674618Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:11:59.859Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http",
          "vendor": "reactphp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.11.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\\Http\\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \\r\\n\\r\\n or \\n\\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:19:32.785Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/reactphp/http/security/advisories/GHSA-g4f2-2pf3-2pwj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/reactphp/http/security/advisories/GHSA-g4f2-2pf3-2pwj"
        },
        {
          "name": "https://github.com/reactphp/http/commit/2558622d0b76227c60c61eac8a61572cb6638e8c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/reactphp/http/commit/2558622d0b76227c60c61eac8a61572cb6638e8c"
        },
        {
          "name": "https://github.com/reactphp/http/releases/tag/v1.11.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/reactphp/http/releases/tag/v1.11.1"
        }
      ],
      "source": {
        "advisory": "GHSA-g4f2-2pf3-2pwj",
        "discovery": "UNKNOWN"
      },
      "title": "react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104827",
    "datePublished": "2026-10-15T18:19:32.785Z",
    "dateReserved": "2026-10-02T14:17:09.335Z",
    "dateUpdated": "2026-10-16T17:11:59.859Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T19:03:52.462592Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T19:04:03.012Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "misskey",
          "vendor": "misskey-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 12.0.0, \u003c= 13.14.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2023.9.0-beta.1, \u003c 2026.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:N/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-405",
              "description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:39:30.169Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8"
        },
        {
          "name": "https://github.com/misskey-dev/misskey/commit/a12ee2e5d72c40252e11a164b2231667c9697667",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/misskey-dev/misskey/commit/a12ee2e5d72c40252e11a164b2231667c9697667"
        },
        {
          "name": "https://github.com/misskey-dev/misskey/releases/tag/2026.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/misskey-dev/misskey/releases/tag/2026.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4x7v-qx8f-g3p8",
        "discovery": "UNKNOWN"
      },
      "title": "Misskey: Lack of rate limiting and size restrictions in RSS fetching API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104817",
    "datePublished": "2026-10-13T18:39:30.169Z",
    "dateReserved": "2026-10-02T14:17:09.334Z",
    "dateUpdated": "2026-10-13T19:04:03.012Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-05T19:08:42.973Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/05/12"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-104713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T14:11:48.988162Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T14:12:55.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.struts:struts2-rest-plugin",
          "packageURL": "pkg:maven/org.apache.struts/struts2-rest-plugin",
          "product": "Apache Struts",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.3.37",
              "status": "affected",
              "version": "2.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.5.33",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.0",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.0",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "n0mi1k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
            }
          ],
          "value": "Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T18:36:09.420Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://cwiki.apache.org/confluence/display/WW/S2-077"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Struts: Unbounded request body read in the REST plugin",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-104713",
    "datePublished": "2026-10-05T18:36:09.420Z",
    "dateReserved": "2026-10-02T10:54:35.480Z",
    "dateUpdated": "2026-10-06T14:12:55.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104436",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T14:51:19.938453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T14:51:28.130Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/zebrad",
          "product": "zebra",
          "vendor": "ZcashFoundation",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.5.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/zebra-chain",
          "product": "zebra-chain",
          "vendor": "ZcashFoundation",
          "versions": [
            {
              "lessThan": "8.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:zfnd:zebra-chain:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "dingledropper"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "mpguerra"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "oxarbitrage"
        }
      ],
      "datePublic": "2026-05-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T21:15:28.872Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-443g-gwgp-49x4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-443g-gwgp-49x4"
        },
        {
          "name": "VulnCheck Advisory: Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zebra-before-4.5.0-cpu-amplification-via-uncapped-getblocks-getheaders-locator-length"
        }
      ],
      "title": "Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-104436",
    "datePublished": "2026-10-02T11:38:13.172Z",
    "dateReserved": "2026-10-02T00:50:26.604Z",
    "dateUpdated": "2026-10-29T21:15:28.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T12:27:13.306414Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T12:27:23.589Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/zebrad",
          "product": "zebra",
          "vendor": "ZcashFoundation",
          "versions": [
            {
              "lessThan": "6.0.0-rc.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "SuplabsYi"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "upbqdn"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "oxarbitrage"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "mpguerra"
        }
      ],
      "datePublic": "2026-07-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers\u0027 transaction relay."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T11:38:09.257Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m9xx-8rcj-vmgp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-m9xx-8rcj-vmgp"
        },
        {
          "name": "VulnCheck Advisory: Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zebra-before-6.0.0-rc.0-per-peer-mempool-admission-bypass-via-p2p-tx-messages"
        }
      ],
      "title": "Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-104429",
    "datePublished": "2026-10-02T11:38:09.257Z",
    "dateReserved": "2026-10-02T00:46:23.831Z",
    "dateUpdated": "2026-10-02T12:27:23.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}