Common Weakness Enumeration
CWE-789
AllowedMemory Allocation with Excessive Size Value
Abstraction: Variant · Status: Draft
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
331 vulnerabilities reference this CWE, most recent first.
CVE-2026-115864 (GCVE-0-2026-115864)
Vulnerability from cvelistv5 – Published: 2026-11-09 21:16 – Updated: 2026-11-10 00:11
VLAI
EPSS
VEX
Title
Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory
Summary
Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.
The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.
A remote attacker can force a worker restart with each request of a few bytes.
Severity
No CVSS data available.
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
CPANSec
CNA
References
3 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-11-10T00:11:03.849Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/11/09/32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Monoceros"
],
"packageName": "Monoceros",
"packageURL": "pkg:cpan/Monoceros",
"programFiles": [
"lib/Monoceros/Server.pm"
],
"programRoutines": [
{
"name": "Monoceros::Server::handle_connection"
}
],
"repo": "https://github.com/kazeburo/Monoceros",
"versions": [
{
"lessThan": "0.30",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.\n\nThe request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.\n\nA remote attacker can force a worker restart with each request of a few bytes."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:16:28.102Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/kazeburo/Monoceros/commit/897a4a9624329fc0a4b2352d387bdac6d37848e2.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/KAZEBURO/Monoceros-0.30/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Monoceros 0.30 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-115864",
"datePublished": "2026-11-09T21:16:28.102Z",
"dateReserved": "2026-10-23T17:37:33.626Z",
"dateUpdated": "2026-11-10T00:11:03.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115825 (GCVE-0-2026-115825)
Vulnerability from cvelistv5 – Published: 2026-10-25 16:51 – Updated: 2026-11-02 16:23
VLAI
EPSS
VEX
Title
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length
Summary
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.
The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.
A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 16:23 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
CPANSec
CNA
References
3 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-26T01:23:53.588Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/26/10"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-115825",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T16:23:18.808905Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T16:23:24.866Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"HTTP::Server::PSGI"
],
"packageName": "Plack",
"packageURL": "pkg:cpan/Plack",
"programFiles": [
"lib/HTTP/Server/PSGI.pm"
],
"programRoutines": [
{
"name": "HTTP::Server::PSGI::handle_connection"
}
],
"repo": "https://github.com/plack/Plack",
"versions": [
{
"lessThan": "1.0056",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.\n\nThe request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.\n\nA remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T16:51:54.897Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0056/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Plack 1.0057 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-115825",
"datePublished": "2026-10-25T16:51:54.897Z",
"dateReserved": "2026-10-23T16:47:20.192Z",
"dateUpdated": "2026-11-02T16:23:24.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115417 (GCVE-0-2026-115417)
Vulnerability from cvelistv5 – Published: 2026-10-22 20:34 – Updated: 2026-10-29 01:52
VLAI
EPSS
VEX
Title
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Summary
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.
To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 01:40 UTC
CWE
- CWE-789 - Memory allocation with excessive size value
Assigner
AMZN
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/awslabs/aws-c-mqtt/releases/ta… | release-notespatch |
| https://github.com/awslabs/aws-c-mqtt/security/ad… | third-party-advisory |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AWS | aws-c-mqtt |
Affected:
0.9.1 , < 0.16.2
(custom)
cpe:2.3:a:aws:aws-c-mqtt:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T01:40:57.807113Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T01:52:06.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "aws-c-mqtt",
"vendor": "AWS",
"versions": [
{
"lessThan": "0.16.2",
"status": "affected",
"version": "0.9.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aws:aws-c-mqtt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.2",
"versionStartIncluding": "0.9.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMemory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.\u003c/p\u003e"
}
],
"value": "Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.\n\n\n\nTo remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory allocation with excessive size value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T20:34:50.961Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/awslabs/aws-c-mqtt/releases/tag/v0.16.2"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/awslabs/aws-c-mqtt/security/advisories/GHSA-g3x5-86mr-65p5"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-147-aws/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-115417",
"datePublished": "2026-10-22T20:34:50.961Z",
"dateReserved": "2026-10-22T13:18:17.258Z",
"dateUpdated": "2026-10-29T01:52:06.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115394 (GCVE-0-2026-115394)
Vulnerability from cvelistv5 – Published: 2026-10-22 19:14 – Updated: 2026-10-23 15:00
VLAI
EPSS
VEX
Title
Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation
Summary
Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:48 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/NationalSecurityAgency/ghidra/… | vendor-advisory |
| https://github.com/NationalSecurityAgency/ghidra/… | technical-description |
| https://github.com/NationalSecurityAgency/ghidra/… | technical-description |
| https://github.com/NationalSecurityAgency/ghidra | product |
| https://www.vulncheck.com/advisories/ghidra-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NationalSecurityAgency | ghidra |
Affected:
0 , ≤ 12.2
(custom)
cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115394",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T14:48:33.610551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T15:00:37.926Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/NationalSecurityAgency/ghidra",
"product": "ghidra",
"repo": "https://github.com/NationalSecurityAgency/ghidra",
"vendor": "NationalSecurityAgency",
"versions": [
{
"lessThanOrEqual": "12.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*",
"versionEndIncluding": "12.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuvraj Saxena (0xXA)"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T19:14:00.068Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q538-hhhf-5jxp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-q538-hhhf-5jxp"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.2_build/Ghidra/Framework/DB/src/main/java/db/BinaryField.java#L105-L113"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.2_build/Ghidra/Framework/DB/src/main/java/db/buffers/DataBuffer.java#L170-L174"
},
{
"tags": [
"product"
],
"url": "https://github.com/NationalSecurityAgency/ghidra"
},
{
"name": "VulnCheck Advisory: Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ghidra-through-12.2-denial-of-service-via-binaryfield-memory-allocation"
}
],
"title": "Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115394",
"datePublished": "2026-10-22T19:14:00.068Z",
"dateReserved": "2026-10-22T11:27:18.001Z",
"dateUpdated": "2026-10-23T15:00:37.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114629 (GCVE-0-2026-114629)
Vulnerability from cvelistv5 – Published: 2026-10-24 13:50 – Updated: 2026-11-02 14:09
VLAI
EPSS
VEX
Title
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters
Summary
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.
Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.
An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:09 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
CPANSec
CNA
References
3 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-24T16:06:39.380Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/24/4"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-114629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:09:25.462672Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:09:38.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Web::Simple"
],
"packageName": "Web-Simple",
"packageURL": "pkg:cpan/Web-Simple",
"programFiles": [
"lib/Web/Dispatch/ParamParser.pm"
],
"programRoutines": [
{
"name": "Web::Dispatch::ParamParser::get_unpacked_body_from"
}
],
"repo": "https://github.com/p5sagit/Web-Simple",
"versions": [
{
"lessThan": "0.035",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.\n\nWeb::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl\u0027s read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.\n\nAn attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T13:50:47.616Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/ETHER/Web-Simple-0.035/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Web::Simple 0.035 or later, and in the application configure $Web::Dispatch::ParamParser::MAX_BODY_SIZE."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade but are running behind a reverse proxy, configure the proxy to reject requests above a maxiumum Content-Length."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-114629",
"datePublished": "2026-10-24T13:50:47.616Z",
"dateReserved": "2026-10-21T21:43:01.842Z",
"dateUpdated": "2026-11-02T14:09:38.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114349 (GCVE-0-2026-114349)
Vulnerability from cvelistv5 – Published: 2026-10-28 16:46 – Updated: 2026-11-05 17:28
VLAI
EPSS
VEX
Title
Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
Summary
When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce request can declare a body size of up to about 2 GiB and force the broker to attempt that allocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request size limit, and client/broker quotas bound only the compressed wire size, not the declared decompressed size.
Impact:
An authenticated principal with Write on a topic can crash broker request-handler threads (reached when a batch's codec differs from the topic's compression.type and records are re-encoded) and any consumer that fetches the record, denying service. On brokers started with -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the broker JVM. More seriously, a crafted record is accepted at ingest and written to disk; when the log-cleaner later reads it on a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner thread, which is not restarted. With the default of a single cleaner thread, log compaction then stops for the entire broker, including the internal __consumer_offsets and __transaction_state topics, and the condition persists across restarts until the offending record is removed. The impact is availability only; no data is disclosed or altered.
Mitigation:
Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the broker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is not sufficient: for backward compatibility this configuration defaults to an effectively unlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a value at or slightly above the largest legitimate decompressed record your applications produce, and comfortably below the broker heap divided by the number of request-handler and cleaner threads. Until you can upgrade and configure the limit, restrict Write access to trusted producers; quotas and max.message.bytes do not mitigate this issue.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record's declared decompressed body size against max.decompressed.message.bytes before allocating, on the produce-validation, log-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with InvalidRecordException. Operators must set this configuration to a bounded value to be protected, as its default is effectively unlimited.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 17:28 UTC
CWE
Assigner
apache
CNA
References
3 references
| URL | Tags |
|---|---|
| https://kafka.apache.org/cve-list | vendor-advisory |
| https://lists.apache.org/thread/hdy56hrd1h9btf30j… | mailing-list |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Kafka |
Affected:
0.11.0.0 , < 2.5.0
(maven)
|
|
| Apache Software Foundation | Apache Kafka |
Affected:
0.11.0.0 , < 4.0.0
(maven)
|
|
| Apache Software Foundation | Apache Kafka |
Affected:
2.4.0 , ≤ 4.1.2
(maven)
Affected: 4.2.0 , ≤ 4.2.1 (maven) Affected: 4.3.0 , ≤ 4.3.1 (maven) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-28T20:06:58.727Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-114349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T17:28:36.990519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:28:41.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.kafka:kafka_2.11",
"packageURL": "pkg:maven/org.apache.kafka/kafka_2.11",
"product": "Apache Kafka",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.5.0",
"status": "affected",
"version": "0.11.0.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.kafka:kafka_2.12",
"packageURL": "pkg:maven/org.apache.kafka/kafka_2.12",
"product": "Apache Kafka",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4.0.0",
"status": "affected",
"version": "0.11.0.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.kafka:kafka_2.13",
"packageURL": "pkg:maven/org.apache.kafka/kafka_2.13",
"product": "Apache Kafka",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.1.2",
"status": "affected",
"version": "2.4.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "4.2.1",
"status": "affected",
"version": "4.2.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "4.3.1",
"status": "affected",
"version": "4.3.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peyton Kennedy \u003cpkennedy@endor.ai\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Trung Nguyen \u003ctrungnh@cystack.net\u003e, CyStack"
},
{
"lang": "en",
"type": "reporter",
"value": "Bart\u0142omiej Dmitruk \u003cbartek@striga.ai\u003e, Striga"
},
{
"lang": "en",
"type": "reporter",
"value": "\uc784\uc131\ubbfc \u003cat_haemil@naver.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Mike Read (GitHub: Michael-JRead)"
},
{
"lang": "en",
"type": "reporter",
"value": "Salman Aljardan \u003csalman1aljardan@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Yuchao Zhang \u003cndaugoing@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Yu Bao \u003cyubao@paypal.com\u003e, PayPal Cyber Security Team"
},
{
"lang": "en",
"type": "reporter",
"value": "Vamsi K \u003cxh081ix@gmail.com\u003e"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Srinivas Akhil Mallela \u003csrinivasakhil@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Ashish Modi, OpenLogic by Perforce"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cbr\u003e\u003cdiv\u003eWhen a broker decodes a compressed record batch, the per-record decoder reads a declared body\u0026nbsp;\u003cspan\u003esize from the decompressed stream and allocates a buffer of that size before validating it\u0026nbsp;\u003c/span\u003e\u003cspan\u003eagainst the bytes available or any configured limit. The size is attacker-controlled, and the\u0026nbsp;\u003c/span\u003e\u003cspan\u003ebatch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce\u0026nbsp;\u003c/span\u003e\u003cspan\u003erequest can declare a body size of up to about 2 GiB and force the broker to attempt that\u0026nbsp;\u003c/span\u003e\u003cspan\u003eallocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request\u0026nbsp;\u003c/span\u003e\u003cspan\u003esize limit, and client/broker quotas bound only the compressed wire size, not the declared\u0026nbsp;\u003c/span\u003e\u003cspan\u003edecompressed size.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eImpact:\u003c/div\u003e\u003cdiv\u003eAn authenticated principal with Write on a topic can crash broker request-handler threads\u0026nbsp;\u003cspan\u003e(reached when a batch\u0027s codec differs from the topic\u0027s compression.type and records are\u0026nbsp;\u003c/span\u003e\u003cspan\u003ere-encoded) and any consumer that fetches the record, denying service. On brokers started\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewith -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the\u0026nbsp;\u003c/span\u003e\u003cspan\u003ebroker JVM. More seriously, a\u0026nbsp;crafted record\u0026nbsp;\u0026nbsp;\u003c/span\u003e\u003cspan\u003eis accepted at ingest and written to disk; when the log-cleaner later reads it\u0026nbsp;\u003c/span\u003e\u003cspan\u003eon a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethread, which is not restarted. With the default of a single cleaner thread, log compaction\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethen stops for the entire broker, including the internal __consumer_offsets and\u0026nbsp;\u003c/span\u003e\u003cspan\u003e__transaction_state topics, and the condition persists across restarts until the offending\u0026nbsp;\u003c/span\u003e\u003cspan\u003erecord is removed. The impact is availability only; no data is disclosed or altered.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eMitigation:\u003c/div\u003e\u003cdiv\u003eUpgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the\u0026nbsp;\u003cspan\u003ebroker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is\u0026nbsp;\u003c/span\u003e\u003cspan\u003enot sufficient: for backward compatibility this configuration defaults to an effectively\u0026nbsp;\u003c/span\u003e\u003cspan\u003eunlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a\u0026nbsp;\u003c/span\u003e\u003cspan\u003evalue at or slightly above the largest legitimate decompressed record your applications\u0026nbsp;\u003c/span\u003e\u003cspan\u003eproduce, and comfortably below the broker heap divided by the number of request-handler and\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecleaner threads. Until you can upgrade and configure the limit, restrict Write access to\u0026nbsp;\u003c/span\u003e\u003cspan\u003etrusted producers; quotas and max.message.bytes do not mitigate this issue.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eResolution:\u003c/div\u003e\u003cdiv\u003eFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record\u0027s declared decompressed\u0026nbsp;\u003cspan\u003ebody size against max.decompressed.message.bytes before allocating, on the produce-validation,\u0026nbsp;\u003c/span\u003e\u003cspan\u003elog-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with\u0026nbsp;\u003c/span\u003e\u003cspan\u003eInvalidRecordException. Operators must set this configuration to a bounded value to be protected,\u0026nbsp;\u003c/span\u003e\u003cspan\u003eas its default is effectively unlimited.\u003c/span\u003e\u003c/div\u003e"
}
],
"value": "When a broker decodes a compressed record batch, the per-record decoder reads a declared body\u00a0size from the decompressed stream and allocates a buffer of that size before validating it\u00a0against the bytes available or any configured limit. The size is attacker-controlled, and the\u00a0batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce\u00a0request can declare a body size of up to about 2 GiB and force the broker to attempt that\u00a0allocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request\u00a0size limit, and client/broker quotas bound only the compressed wire size, not the declared\u00a0decompressed size.\n\n\nImpact:\n\nAn authenticated principal with Write on a topic can crash broker request-handler threads\u00a0(reached when a batch\u0027s codec differs from the topic\u0027s compression.type and records are\u00a0re-encoded) and any consumer that fetches the record, denying service. On brokers started\u00a0with -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the\u00a0broker JVM. More seriously, a\u00a0crafted record\u00a0\u00a0is accepted at ingest and written to disk; when the log-cleaner later reads it\u00a0on a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner\u00a0thread, which is not restarted. With the default of a single cleaner thread, log compaction\u00a0then stops for the entire broker, including the internal __consumer_offsets and\u00a0__transaction_state topics, and the condition persists across restarts until the offending\u00a0record is removed. The impact is availability only; no data is disclosed or altered.\n\n\nMitigation:\n\nUpgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the\u00a0broker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is\u00a0not sufficient: for backward compatibility this configuration defaults to an effectively\u00a0unlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a\u00a0value at or slightly above the largest legitimate decompressed record your applications\u00a0produce, and comfortably below the broker heap divided by the number of request-handler and\u00a0cleaner threads. Until you can upgrade and configure the limit, restrict Write access to\u00a0trusted producers; quotas and max.message.bytes do not mitigate this issue.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record\u0027s declared decompressed\u00a0body size against max.decompressed.message.bytes before allocating, on the produce-validation,\u00a0log-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with\u00a0InvalidRecordException. Operators must set this configuration to a bounded value to be protected,\u00a0as its default is effectively unlimited."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory allocation with excessive size value",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper validation of specified quantity in input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T13:48:26.738Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://kafka.apache.org/cve-list"
},
{
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread/hdy56hrd1h9btf30jb1noswsx32l17dq"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-114349",
"datePublished": "2026-10-28T16:46:54.920Z",
"dateReserved": "2026-10-21T08:14:55.090Z",
"dateUpdated": "2026-11-05T17:28:41.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113604 (GCVE-0-2026-113604)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-20 16:19
VLAI
EPSS
VEX
Title
Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts
Summary
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 16:19 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/NationalSecurityAgency/ghidra/… | patch |
| https://github.com/NationalSecurityAgency/ghidra/… | technical-description |
| https://www.vulncheck.com/advisories/ghidra-10.2-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NationalSecurityAgency | ghidra |
Affected:
10.2 , ≤ 12.1.4
(custom)
cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:* |
Date Public
2026-10-16 18:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T16:19:40.402782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:19:49.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/nationalsecurityagency/ghidra",
"product": "ghidra",
"repo": "https://github.com/NationalSecurityAgency/ghidra",
"vendor": "NationalSecurityAgency",
"versions": [
{
"lessThanOrEqual": "12.1.4",
"status": "affected",
"version": "10.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*",
"versionEndIncluding": "12.1.4",
"versionStartIncluding": "10.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Asif Nadaf"
}
],
"datePublic": "2026-10-16T18:55:33.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader\u0027s ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:31.409Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/NationalSecurityAgency/ghidra/commit/6c50a66e8a939e2bcbaf0a6432ec5d53a41ceeb3"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/elf/ElfHeader.java"
},
{
"name": "VulnCheck Advisory: Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ghidra-10.2-through-12.1.4-denial-of-service-via-elf-loader-extended-header-counts"
}
],
"title": "Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113604",
"datePublished": "2026-10-20T15:40:31.409Z",
"dateReserved": "2026-10-20T11:48:57.505Z",
"dateUpdated": "2026-10-20T16:19:49.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112399 (GCVE-0-2026-112399)
Vulnerability from cvelistv5 – Published: 2026-10-19 21:10 – Updated: 2026-10-28 15:21
VLAI
EPSS
VEX
Title
Pillow: APNG background disposal allocates full canvas before decompression bomb check
Summary
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 15:21 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/python-pillow/Pillow/security/… | x_refsource_CONFIRM |
| https://github.com/python-pillow/Pillow/commit/f1… | x_refsource_MISC |
| https://github.com/python-pillow/Pillow/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| python-pillow | Pillow |
Affected:
>= 8.1.0, < 13.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112399",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T15:21:08.274556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T15:21:14.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Pillow",
"vendor": "python-pillow",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0, \u003c 13.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:10:11.266Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9"
},
{
"name": "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48"
},
{
"name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
}
],
"source": {
"advisory": "GHSA-5xm2-6676-qcp9",
"discovery": "UNKNOWN"
},
"title": "Pillow: APNG background disposal allocates full canvas before decompression bomb check"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-112399",
"datePublished": "2026-10-19T21:10:11.266Z",
"dateReserved": "2026-10-19T16:58:51.959Z",
"dateUpdated": "2026-10-28T15:21:14.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112283 (GCVE-0-2026-112283)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-22 02:53
VLAI
EPSS
VEX
Title
libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points
Summary
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 02:53 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libbluray-clpi-ep-map… | third-party-advisory |
| https://code.videolan.org/videolan/libbluray/-/bl… | technical-description |
| https://www.vulncheck.com/advisories/libbluray-th… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112282-11228… | exploit |
Impacted products
Date Public
2026-10-17 17:17
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112283",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T02:53:14.349542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:53:35.556Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112282-112283-libbluray-clpi-ep-map-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://code.videolan.org/videolan/libbluray",
"defaultStatus": "unaffected",
"product": "libbluray",
"repo": "https://code.videolan.org/videolan/libbluray",
"vendor": "VideoLAN",
"versions": [
{
"lessThanOrEqual": "1.5.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:videolan:libbluray:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:17:41.000Z",
"descriptions": [
{
"lang": "en",
"value": "VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:27.741Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libbluray-clpi-ep-map-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://code.videolan.org/videolan/libbluray/-/blob/1.5.1/src/libbluray/bdnav/clpi_parse.c"
},
{
"name": "VulnCheck Advisory: libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libbluray-through-1.5.1-uncontrolled-memory-allocation-via-parse-extent-start-points"
}
],
"title": "libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112283",
"datePublished": "2026-10-19T13:55:27.741Z",
"dateReserved": "2026-10-19T13:25:31.506Z",
"dateUpdated": "2026-10-22T02:53:35.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112214 (GCVE-0-2026-112214)
Vulnerability from cvelistv5 – Published: 2026-10-19 12:15 – Updated: 2026-11-05 16:28
VLAI
EPSS
VEX
Title
Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
Summary
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
redhat
CNA
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-112214 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2555538 | issue-trackingx_refsource_REDHAT |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/a:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/a:redhat:enterprise_linux:9
|
Date Public
2026-10-08 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112214",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:50.985121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:35:33.242Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gstreamer1-plugins-ugly-free",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "unaffected",
"packageName": "gstreamer1-plugins-ugly-free",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "gstreamer1-plugins-ugly-free",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "gstreamer1-plugins-ugly-free",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Robin \"drzobin\" Larsson for reporting this issue."
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:28:23.254Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-112214"
},
{
"name": "RHBZ#2555538",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555538"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-17T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-08T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser",
"workarounds": [
{
"lang": "en",
"value": "Avoid opening untrusted ASF, WMV, or WMA files in GStreamer-based applications (including local players and media indexers/thumbnailers)."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-789: Memory Allocation with Excessive Size Value"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-112214",
"datePublished": "2026-10-19T12:15:06.140Z",
"dateReserved": "2026-10-19T10:42:52.534Z",
"dateUpdated": "2026-11-05T16:28:23.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Architecture and Design
Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
Mitigation
Operation
Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.
No CAPEC attack patterns related to this CWE.