By weakness (CWE)

CWE-703: related vulnerabilities

CVEs classified under CWE-703. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

4 published vulnerabilities

• CVE-2026-44893HIGH 7.5

  Netty's HAProxy protocol decoder has a resource leak vulnerability triggered by malformed protocol messages. When an attacker sends a specially crafted HAProxy TLV (Type-Length-Value) structure with an undersized length field, the decoder attempts to read data beyond the declared bounds. The exception that follows bypasses the error handler, leaving memory buffers permanently unreleased. This cumulates over repeated malicious messages, exhausting available memory and crashing the application.

• CVE-2026-51600HIGH 7.5

  Tenda CP3 V3.0 devices running firmware V31.1.9.91 contain a flaw in how they process streaming protocol requests. When a malicious or misconfigured client sends an RTSP request (used for media streaming) with a Content-Length header but no actual data following it, the device gets stuck waiting for that data indefinitely. The connection never closes, consuming resources on the device until all available connections are exhausted. An attacker on the network can exploit this without credentials to render the device unresponsive to legitimate requests.

• CVE-2026-12324HIGH 7.3

  A boundary condition flaw in Firefox and Thunderbird's WebGL graphics component allows an attacker to send a specially crafted request over the network without authentication or user interaction to cause information disclosure, data manipulation, or denial of service. The vulnerability affects multiple versions of both applications and has been patched in recent releases.

• CVE-2026-56338MEDIUM 5.3

  Capgo versions prior to 12.128.2 have a denial-of-service flaw in their two-factor authentication system. When users attempt to verify their email address as part of 2FA setup, a broken captcha validation process causes the authentication endpoint to fail repeatedly with server errors. This prevents users from completing 2FA enrollment, leaving accounts without this critical security layer—a particularly concerning impact since the vulnerability blocks access to security controls rather than enabling unauthorized access.