Common Weakness Enumeration
CWE-789
AllowedMemory Allocation with Excessive Size Value
Abstraction: Variant · Status: Draft
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
331 vulnerabilities reference this CWE, most recent first.
CVE-2026-119276 (GCVE-0-2026-119276)
Vulnerability from cvelistv5 – Published: 2026-10-29 20:47 – Updated: 2026-10-30 17:11
VLAI
EPSS
VEX
Title
MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets
Summary
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info field and session-state variable names and values before confirming that the bytes remained in the packet. A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet declaring a much larger length and repeatedly force attacker-controlled heap allocations before the subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:11 UTC
CWE
Assigner
GitHub_M
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_CONFIRM |
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_MISC |
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_MISC |
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_MISC |
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_MISC |
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_MISC |
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mariadb-corporation | mariadb-connector-j |
Affected:
>= 3.0.0, < 3.3.7
Affected: >= 3.4.0, < 3.4.5 Affected: >= 3.5.0, < 3.5.11 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119276",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:11:37.642004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:11:51.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mariadb-connector-j",
"vendor": "mariadb-corporation",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.3.7"
},
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.4.5"
},
{
"status": "affected",
"version": "\u003e= 3.5.0, \u003c 3.5.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info field and session-state variable names and values before confirming that the bytes remained in the packet. A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet declaring a much larger length and repeatedly force attacker-controlled heap allocations before the subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "CWE-130: Improper Handling of Length Parameter Inconsistency",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:47:32.086Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-h599-m3w5-9m7x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-h599-m3w5-9m7x"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"
}
],
"source": {
"advisory": "GHSA-h599-m3w5-9m7x",
"discovery": "UNKNOWN"
},
"title": "MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119276",
"datePublished": "2026-10-29T20:47:32.086Z",
"dateReserved": "2026-10-29T18:50:28.064Z",
"dateUpdated": "2026-10-30T17:11:51.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118590 (GCVE-0-2026-118590)
Vulnerability from cvelistv5 – Published: 2026-10-29 00:00 – Updated: 2026-11-04 01:09
VLAI
EPSS
VEX
Title
nipy nibabel Header volumeutils.py array_from_file memory allocation
Summary
A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 01:09 UTC
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/428028 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/428028/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-118590 | third-party-advisory |
| https://vuldb.com/submit/1026208 | third-party-advisory |
| https://github.com/nipy/nibabel/issues/1566 | issue-tracking |
| https://github.com/nipy/nibabel/pull/1587 | issue-trackingpatch |
| https://github.com/nipy/nibabel/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T01:09:00.738918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:09:13.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nipy:nibabel:*:*:*:*:*:*:*:*"
],
"modules": [
"Header Handler"
],
"product": "nibabel",
"vendor": "nipy",
"versions": [
{
"status": "affected",
"version": "5.4.0"
},
{
"status": "affected",
"version": "5.4.1"
},
{
"status": "affected",
"version": "5.4.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohammedix88 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T00:00:21.707Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-428028 | nipy nibabel Header volumeutils.py array_from_file memory allocation",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/428028"
},
{
"name": "VDB-428028 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/428028/cti"
},
{
"name": "CVE-2026-118590 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-118590"
},
{
"name": "Submit #1026208 | nipy nibabel 5.4.2 Uncontrolled Memory Allocation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1026208"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/nipy/nibabel/issues/1566"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/nipy/nibabel/pull/1587"
},
{
"tags": [
"product"
],
"url": "https://github.com/nipy/nibabel/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-28T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-28T17:24:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "nipy nibabel Header volumeutils.py array_from_file memory allocation",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-118590",
"datePublished": "2026-10-29T00:00:21.707Z",
"dateReserved": "2026-10-28T16:19:42.890Z",
"dateUpdated": "2026-11-04T01:09:13.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118589 (GCVE-0-2026-118589)
Vulnerability from cvelistv5 – Published: 2026-10-28 23:45 – Updated: 2026-10-29 17:20
VLAI
EPSS
VEX
Title
nschloe meshio VTK Reader _vtk_42.py memory allocation
Summary
A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 15:43 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/428027 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/428027/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-118589 | third-party-advisory |
| https://vuldb.com/submit/1026207 | third-party-advisory |
| https://github.com/nschloe/meshio/issues/1576 | issue-tracking |
| https://github.com/nschloe/meshio/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T15:43:42.543685Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T17:20:40.744Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nschloe:meshio:*:*:*:*:*:*:*:*"
],
"modules": [
"VTK Reader"
],
"product": "meshio",
"vendor": "nschloe",
"versions": [
{
"status": "affected",
"version": "5.3.0"
},
{
"status": "affected",
"version": "5.3.1"
},
{
"status": "affected",
"version": "5.3.2"
},
{
"status": "affected",
"version": "5.3.3"
},
{
"status": "affected",
"version": "5.3.4"
},
{
"status": "affected",
"version": "5.3.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohammedix88 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T23:45:18.675Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-428027 | nschloe meshio VTK Reader _vtk_42.py memory allocation",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/428027"
},
{
"name": "VDB-428027 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/428027/cti"
},
{
"name": "CVE-2026-118589 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-118589"
},
{
"name": "Submit #1026207 | nschloe meshio 5.3.5 Uncontrolled Memory Allocation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1026207"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/nschloe/meshio/issues/1576"
},
{
"tags": [
"product"
],
"url": "https://github.com/nschloe/meshio/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-28T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-28T17:22:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "nschloe meshio VTK Reader _vtk_42.py memory allocation",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-118589",
"datePublished": "2026-10-28T23:45:18.675Z",
"dateReserved": "2026-10-28T16:17:16.147Z",
"dateUpdated": "2026-10-29T17:20:40.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118036 (GCVE-0-2026-118036)
Vulnerability from cvelistv5 – Published: 2026-10-28 12:33 – Updated: 2026-11-06 18:34
VLAI
EPSS
VEX
Title
Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering
Summary
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 18:17 UTC
CWE
Assigner
ProgressSoftware
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://docs.telerik.com/devtools/document-proces… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | Telerik Document Processing Libraries |
Affected:
0 , < 2026.3.1027
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118036",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T18:17:20.608688Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:34:42.847Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Telerik Document Processing Libraries",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2026.3.1027",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Progress\u00ae Telerik\u00ae Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.\u003c/p\u003e"
}
],
"value": "In Progress\u00ae Telerik\u00ae Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Serialized Data with Nested Payloads"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407 Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T12:33:04.373Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-uncontrolled-resource-consumption-pdfprocessing-cve-2026-118036"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-118036",
"datePublished": "2026-10-28T12:33:04.373Z",
"dateReserved": "2026-10-27T15:05:16.963Z",
"dateUpdated": "2026-11-06T18:34:42.847Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116787 (GCVE-0-2026-116787)
Vulnerability from cvelistv5 – Published: 2026-11-05 19:24 – Updated: 2026-11-05 21:12
VLAI
EPSS
VEX
Title
FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length
Summary
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:12 UTC
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/signalwire/freeswitch/security… | x_refsource_CONFIRM |
| https://github.com/signalwire/freeswitch/commit/a… | x_refsource_MISC |
| https://github.com/signalwire/freeswitch/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| signalwire | freeswitch |
Affected:
< 1.11.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116787",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:12:28.446816Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:12:35.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "freeswitch",
"vendor": "signalwire",
"versions": [
{
"status": "affected",
"version": "\u003c 1.11.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:24:15.968Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-j27c-m99r-8pc3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-j27c-m99r-8pc3"
},
{
"name": "https://github.com/signalwire/freeswitch/commit/a097e124213c164845dcaaa8feed2e70bc1e7191",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/signalwire/freeswitch/commit/a097e124213c164845dcaaa8feed2e70bc1e7191"
},
{
"name": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.2"
}
],
"source": {
"advisory": "GHSA-j27c-m99r-8pc3",
"discovery": "UNKNOWN"
},
"title": "FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-116787",
"datePublished": "2026-11-05T19:24:15.968Z",
"dateReserved": "2026-10-26T21:53:35.167Z",
"dateUpdated": "2026-11-05T21:12:35.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116095 (GCVE-0-2026-116095)
Vulnerability from cvelistv5 – Published: 2026-10-25 22:45 – Updated: 2026-10-29 16:26 X_Open Source
VLAI
EPSS
VEX
Title
smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation
Summary
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 16:25 UTC
Assigner
VulDB
CNA
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426162 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426162/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116095 | third-party-advisory |
| https://vuldb.com/submit/1000796 | third-party-advisory |
| https://github.com/smg-project/smg/issues/2361 | issue-tracking |
| https://github.com/smg-project/smg/pull/2569 | issue-trackingpatch |
| https://gist.github.com/Yunzez/24a1bf4c226fbc324e… | exploit |
| https://github.com/smg-project/smg/commit/8f51b57… | patch |
| https://github.com/smg-project/smg/releases/tag/v1.11.0 | patch |
| https://github.com/smg-project/smg/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smg-project | smg |
Affected:
1.7.0
Affected: 1.8.0 Affected: 1.9.0 Affected: 1.10.0 Affected: 1.10.1 Unaffected: 1.11.0 cpe:2.3:a:smg-project:smg:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116095",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T16:25:53.426367Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T16:26:13.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/smg-project/smg/issues/2361"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:smg-project:smg:*:*:*:*:*:*:*:*"
],
"modules": [
"llm-multimodal"
],
"product": "smg",
"vendor": "smg-project",
"versions": [
{
"status": "affected",
"version": "1.7.0"
},
{
"status": "affected",
"version": "1.8.0"
},
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.10.0"
},
{
"status": "affected",
"version": "1.10.1"
},
{
"status": "unaffected",
"version": "1.11.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zyz3366 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T22:45:20.931Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426162 | smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426162"
},
{
"name": "VDB-426162 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426162/cti"
},
{
"name": "CVE-2026-116095 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116095"
},
{
"name": "Submit #1000796 | SMG Project (smg-project) Shepherd Model Gateway (SMG), llm-multimodal Rust crate v1.7.0, v1.8.0, v1.9.0, v1.10.0, and v1.10.1 Memory Allocation with Excessive Size Value",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1000796"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/smg-project/smg/issues/2361"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/smg-project/smg/pull/2569"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/Yunzez/24a1bf4c226fbc324ea8da1d202c6d9b"
},
{
"tags": [
"patch"
],
"url": "https://github.com/smg-project/smg/commit/8f51b57e219a914089e345b704c3c8de37a3bb8e"
},
{
"tags": [
"patch"
],
"url": "https://github.com/smg-project/smg/releases/tag/v1.11.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/smg-project/smg/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T07:46:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116095",
"datePublished": "2026-10-25T22:45:20.931Z",
"dateReserved": "2026-10-25T06:41:29.349Z",
"dateUpdated": "2026-10-29T16:26:13.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115922 (GCVE-0-2026-115922)
Vulnerability from cvelistv5 – Published: 2026-10-26 17:31 – Updated: 2026-10-30 17:40
VLAI
EPSS
VEX
Title
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
Summary
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory. This issue is fixed in version 1.22.0.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:40 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
GitHub_M
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/onnx/onnx/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/onnx/onnx/pull/8033 | x_refsource_MISC |
| https://github.com/onnx/onnx/pull/8038 | x_refsource_MISC |
| https://github.com/onnx/onnx/pull/8066 | x_refsource_MISC |
| https://github.com/onnx/onnx/commit/05c1bc3bceceb… | x_refsource_MISC |
| https://github.com/onnx/onnx/commit/8de2cf6aa4792… | x_refsource_MISC |
| https://github.com/onnx/onnx/commit/dce5876d6cc6c… | x_refsource_MISC |
| https://github.com/onnx/onnx/releases/tag/v1.22.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115922",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:40:12.778537Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:40:32.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "onnx",
"vendor": "onnx",
"versions": [
{
"status": "affected",
"version": "\u003c 1.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory. This issue is fixed in version 1.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T17:31:03.716Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/onnx/onnx/security/advisories/GHSA-q69g-f4f5-v8m7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/onnx/onnx/security/advisories/GHSA-q69g-f4f5-v8m7"
},
{
"name": "https://github.com/onnx/onnx/pull/8033",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onnx/onnx/pull/8033"
},
{
"name": "https://github.com/onnx/onnx/pull/8038",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onnx/onnx/pull/8038"
},
{
"name": "https://github.com/onnx/onnx/pull/8066",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onnx/onnx/pull/8066"
},
{
"name": "https://github.com/onnx/onnx/commit/05c1bc3bceceb8d3cf11e9e7fc7f19f971c44988",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onnx/onnx/commit/05c1bc3bceceb8d3cf11e9e7fc7f19f971c44988"
},
{
"name": "https://github.com/onnx/onnx/commit/8de2cf6aa47928e6515ac6d9e1a8b4758886a7df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onnx/onnx/commit/8de2cf6aa47928e6515ac6d9e1a8b4758886a7df"
},
{
"name": "https://github.com/onnx/onnx/commit/dce5876d6cc6cc30157af7d26a752ef44976da8e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onnx/onnx/commit/dce5876d6cc6cc30157af7d26a752ef44976da8e"
},
{
"name": "https://github.com/onnx/onnx/releases/tag/v1.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onnx/onnx/releases/tag/v1.22.0"
}
],
"source": {
"advisory": "GHSA-q69g-f4f5-v8m7",
"discovery": "UNKNOWN"
},
"title": "ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-115922",
"datePublished": "2026-10-26T17:31:03.716Z",
"dateReserved": "2026-10-23T20:21:45.107Z",
"dateUpdated": "2026-10-30T17:40:32.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115909 (GCVE-0-2026-115909)
Vulnerability from cvelistv5 – Published: 2026-10-26 16:39 – Updated: 2026-10-26 19:48
VLAI
EPSS
VEX
Title
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
Summary
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 19:30 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/zip-rs/zip2/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/zip-rs/zip2/pull/984 | x_refsource_MISC |
| https://github.com/zip-rs/zip2/commit/a543a1fc8f3… | x_refsource_MISC |
| https://github.com/zip-rs/zip2/releases/tag/v9.0.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115909",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T19:30:13.578600Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:48:35.352Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zip2",
"vendor": "zip-rs",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.3.0, \u003c 9.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:39:00.037Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3"
},
{
"name": "https://github.com/zip-rs/zip2/pull/984",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zip-rs/zip2/pull/984"
},
{
"name": "https://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98"
},
{
"name": "https://github.com/zip-rs/zip2/releases/tag/v9.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zip-rs/zip2/releases/tag/v9.0.0"
}
],
"source": {
"advisory": "GHSA-q7v9-x93c-xqv3",
"discovery": "UNKNOWN"
},
"title": "zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-115909",
"datePublished": "2026-10-26T16:39:00.037Z",
"dateReserved": "2026-10-23T20:21:45.106Z",
"dateUpdated": "2026-10-26T19:48:35.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115907 (GCVE-0-2026-115907)
Vulnerability from cvelistv5 – Published: 2026-10-26 16:32 – Updated: 2026-10-30 14:13
VLAI
EPSS
VEX
Title
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
Summary
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 14:13 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/zip-rs/zip2/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/zip-rs/zip2/pull/991 | x_refsource_MISC |
| https://github.com/zip-rs/zip2/commit/8b4991288b7… | x_refsource_MISC |
| https://github.com/zip-rs/zip2/releases/tag/v9.0.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115907",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T14:13:42.538263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:13:49.386Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zip2",
"vendor": "zip-rs",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.1.0, \u003c 9.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:32:15.373Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963"
},
{
"name": "https://github.com/zip-rs/zip2/pull/991",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zip-rs/zip2/pull/991"
},
{
"name": "https://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e"
},
{
"name": "https://github.com/zip-rs/zip2/releases/tag/v9.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zip-rs/zip2/releases/tag/v9.0.0"
}
],
"source": {
"advisory": "GHSA-9hj8-73fh-9963",
"discovery": "UNKNOWN"
},
"title": "zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-115907",
"datePublished": "2026-10-26T16:32:15.373Z",
"dateReserved": "2026-10-23T20:21:45.106Z",
"dateUpdated": "2026-10-30T14:13:49.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115865 (GCVE-0-2026-115865)
Vulnerability from cvelistv5 – Published: 2026-10-30 12:44 – Updated: 2026-11-06 16:42
VLAI
EPSS
VEX
Title
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory
Summary
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.
The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.
A remote attacker can force a worker restart with each request of a few bytes.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:42 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
CPANSec
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/kazuho/Starlet/commit/598947ac… | patch |
| https://metacpan.org/release/KAZUHO/Starlet-0.33/… | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-115865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:42:04.938586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:42:32.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Starlet"
],
"packageName": "Starlet",
"packageURL": "pkg:cpan/Starlet",
"programFiles": [
"lib/Starlet/Server.pm"
],
"programRoutines": [
{
"name": "Starlet::Server::handle_connection"
}
],
"repo": "https://github.com/kazuho/Starlet",
"versions": [
{
"lessThan": "0.33",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.\n\nThe request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.\n\nA remote attacker can force a worker restart with each request of a few bytes."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:44:06.034Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/kazuho/Starlet/commit/598947ac620fd31b390335c683d79fa244770782.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/KAZUHO/Starlet-0.33/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Starlet 0.33 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-115865",
"datePublished": "2026-10-30T12:44:06.034Z",
"dateReserved": "2026-10-23T17:37:33.627Z",
"dateUpdated": "2026-11-06T16:42:32.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Architecture and Design
Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
Mitigation
Operation
Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.
No CAPEC attack patterns related to this CWE.