By weakness (CWE)

CWE-770: related vulnerabilities

CVEs classified under CWE-770. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

124 published vulnerabilities · page 2 of 2

• CVE-2026-49955MEDIUM 5.3

  Hermes WebUI versions before 0.51.270 have a flaw that lets anyone on the internet repeatedly trigger authentication challenges without actually completing the login process. By flooding the authentication endpoint with requests, attackers can exhaust server resources—filling up disk space, consuming CPU cycles, and degrading service availability for legitimate users. No authentication is required to exploit this vulnerability.

• CVE-2026-50560MEDIUM 5.3

  Netty, a widely-used Java framework for building network servers and clients, has a flaw in how it handles HTTP/2 header size limits. When a client specifies a maximum header list size via the HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE parameter, Netty can be forced into a state where it crashes while attempting to send response headers back to the client. An attacker can exploit this to repeatedly trigger these crashes, effectively denying service to legitimate users—similar in impact to the HTTP/2 Rapid Reset attack but using different network-level mechanics. The vulnerability affects Netty versions before 4.1.135.Final and 4.2.15.Final.

• CVE-2026-50589MEDIUM 5.3

  OpenStack Ironic versions 32 through 36 contain a vulnerability that allows unauthenticated attackers to crash the service by sending specially crafted JSON payloads to certain API and JSON-RPC endpoints. An attacker requires only network access to the affected service and no credentials—they can disrupt availability without gaining deeper system access. The vulnerability was patched in version 37.0.0.

• CVE-2026-54270MEDIUM 5.3

  protobufjs, a popular JavaScript library for working with Protocol Buffers, has a memory exhaustion vulnerability in versions 8.2.0 through 8.4.2. When decoding untrusted protobuf messages, the library automatically stores unknown fields in memory without providing a way to discard them at decode time. An attacker can craft a malicious protobuf payload with many unknown fields that forces the decoded message to consume far more memory than the payload's raw size would suggest, potentially causing denial of service through resource exhaustion. The vulnerability affects applications that decode protobuf data from untrusted sources, particularly those handling user-supplied or network-sourced messages. Version 8.5.0 introduced options to control unknown-field retention, and version 8.6.2 made discarding unknown fields the default behavior.

• CVE-2026-54285MEDIUM 5.3

  OpenTelemetry's JavaScript implementation has a memory exhaustion vulnerability in its baggage header parsing logic. When the library processes inbound HTTP headers containing baggage data, it fails to validate the size of that data. An attacker can send abnormally large or numerous baggage entries, causing the application to allocate memory without limits, potentially degrading performance or crashing the service. The vulnerability exists only in the inbound parsing path; outbound validation was already in place. Version 2.8.0 and later address this issue.

• CVE-2026-55205MEDIUM 5.3

  Hermes WebUI versions before 0.51.468 contain a flaw in an unauthenticated login-flow endpoint that fails to limit how many simultaneous requests it processes. An attacker can repeatedly hit this endpoint to flood the server with memory-consuming state objects and worker threads, eventually exhausting available resources and causing the service to become slow or unresponsive. The endpoint also triggers outbound device-code requests to upstream OAuth providers, so repeated exploitation can trigger cascading load on those services as well.

• CVE-2026-59868MEDIUM 5.3

  js-yaml, a popular JavaScript library for parsing YAML files, contains a performance vulnerability in versions 5.0.0 through 5.1.x. When YAML merge keys are enabled, an attacker can craft a malicious document that causes the parser to consume quadratic amounts of CPU time despite the document itself growing only linearly in size. This creates a denial-of-service condition where relatively small payloads trigger disproportionate computational overhead. The vulnerability is resolved in version 5.2.0.

• CVE-2026-59870MEDIUM 5.3

  js-yaml, a popular JavaScript library for parsing YAML files, contains a performance vulnerability in its ordered-map (omap) tag handling. When processing specially crafted YAML documents, the library performs redundant duplicate-key checks that consume excessive CPU resources, potentially causing denial-of-service conditions. The vulnerability affects versions 5.0.0 through 5.2.0 and is resolved in version 5.2.1.

• CVE-2026-45682MEDIUM 5.1

  OpenTelemetry's eBPF Instrumentation agent for Java contains a memory leak in its TLS connection state tracking. When Java applications handle repeated connection churn (connections opening and closing), the instrumentation fails to properly clean up its internal tracking queue, causing heap memory to grow indefinitely until the application runs out of memory and crashes. This affects long-running production JVMs where connection pools are regularly recycled. The issue is resolved in version 0.9.0.

• CVE-2026-10533MEDIUM 5.0

  A vulnerability in OpenShift Container Platform allows non-privileged users to circumvent resource quota enforcement by creating pods with a never-restart policy. These pods and their associated Kubernetes events are not counted against quota limits, enabling an attacker to flood the cluster's event database (etcd) with activity. The resulting accumulation degrades API server performance across the entire cluster, affecting all users and workloads.

• CVE-2026-14362MEDIUM 4.9

  HashiCorp's memberlist library, a Go package used for cluster membership and failure detection, contains a flaw in how it processes incoming gossip protocol messages that can cause a process to run out of memory and crash. An attacker with network access to the gossip port can trigger this condition remotely. The vulnerability is resolved in memberlist version 0.6.0 and later.

• CVE-2026-56149MEDIUM 4.9

  A vulnerability in Elasticsearch allows users with administrative or elevated privileges to crash an Elasticsearch node by submitting a malicious machine learning request. The attack causes the affected node to consume excessive memory until it becomes unavailable, effectively denying service to legitimate users. This is a resource exhaustion issue that requires elevated permissions to exploit, limiting its immediate blast radius but still posing operational risk in multi-tenant or shared Elasticsearch environments.

• CVE-2026-49324MEDIUM 4.6

  A vulnerability in the Wireless Control Module of the 2025 Indian Motorcycle Scout Bobber + Tech allows someone with access to the bike's internal network to permanently disable it. By sending a small number of specially crafted wireless messages, an attacker can trigger a lockout on the motorcycle's immobilizer system—the security mechanism that prevents unauthorized starting. Unlike typical lockouts that reset when you power cycle the device, this one persists even after restarting the bike, leaving owners unable to start their motorcycle until they visit a dealer for service.

• CVE-2025-36319MEDIUM 4.3

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain a denial-of-service vulnerability accessible to authenticated users. An attacker with valid credentials can send a specially crafted HTTP request that exploits improper resource throttling controls, temporarily disrupting service availability. The vulnerability does not compromise confidentiality or integrity—only availability is at risk.

• CVE-2026-49140MEDIUM 4.3

  Nanobot versions before 0.2.1 have a denial-of-service flaw in how they handle media downloads from Matrix chat rooms. An authenticated user in a room can deliberately send specially crafted media events with missing or wrong size information, causing the system to download large files without properly checking their declared sizes first. By sending many of these malicious requests at once, an attacker can force the Nanobot process to consume excessive memory and bandwidth until the service becomes slow or unresponsive. The attacker must already be a member of the room to exploit this.

• CVE-2026-49337MEDIUM 4.3

  libde265, an open-source H.265 video decoder library, contains a memory management flaw that allows attackers to trigger unbounded memory growth on a victim's system. By sending a specially crafted sequence of video data packets, an attacker can cause the decoder to accumulate slice header data in memory without ever releasing it. This happens during normal video playback and can eventually exhaust available memory (denial of service). The vulnerability requires user interaction—someone must open or play a malicious video file—but does not require any special privileges or network access beyond the ability to deliver the crafted video.

• CVE-2026-53781MEDIUM 4.3

  Summarize, a podcast and media management CLI tool, contains a vulnerability that allows attackers to exhaust a system's disk space. If you use Summarize before version 0.17.0, an attacker who controls a podcast feed or media URL can force the application to download an extremely large (or infinite) file to your disk. The vulnerability exists because Summarize doesn't properly validate file sizes when the server doesn't send proper size headers or uses certain types of data streaming. This can render your system unusable by filling up its storage.

• CVE-2026-56255MEDIUM 4.3

  Capgo versions before 12.128.2 contain a denial of service flaw in the demo application creation endpoint. An authenticated user with organization write permissions can abuse this endpoint to repeatedly create demo applications without any rate limiting. Each request triggers approximately 138 database operations, which can degrade system performance, inflate operational costs, and potentially cause service instability for all users.

• CVE-2026-58661MEDIUM 4.3

  n8n workflow automation platform versions before 2.28.0 (or 1.123.58 on the legacy 1.x branch) contain a disk space exhaustion vulnerability in file upload functionality. An authenticated attacker can repeatedly upload files through the data-table endpoint without triggering proper quota enforcement, causing files to accumulate in temporary storage until the system's periodic cleanup cycle runs. This can eventually consume all available disk space on the server, leading to service disruption. The vulnerability requires valid user credentials to exploit, limiting exposure to authenticated threat actors.

• CVE-2026-13322LOW 3.8

  A memory exhaustion vulnerability exists in KubeVirt's downward metrics virtio-serial server. When a guest VM has this device enabled, a local attacker can repeatedly write data without line breaks, forcing the virt-handler process to allocate unbounded memory until the process crashes. This requires prior VM access and affects deployments where the downward metrics feature is configured.

• CVE-2026-42546LOW 3.8

  OP-TEE, a security component that protects sensitive operations on Arm-based processors, contains a memory leak in its cleanup logic. When the system processes certain types of shared memory requests from the regular Linux kernel, it fails to properly release internal memory references. This causes memory to gradually accumulate and become unusable, eventually forcing the system to restart. The vulnerability only affects systems using non-FF-A configurations with non-contiguous shared memory support and requires local access to trigger.

• CVE-2026-12590LOW 3.7

  body-parser, a widely used Node.js middleware for parsing incoming request bodies, contains a flaw in how it validates the 'limit' configuration option. When administrators accidentally configure the limit parameter with an invalid value—such as an unparseable string or NaN—the parser silently fails to enforce size restrictions instead of raising an alarm. This means requests of any size will be accepted and processed, potentially consuming massive amounts of memory and CPU and causing the application to become unresponsive. The vulnerability affects versions before 1.20.6 (in the 1.x line) and before 2.3.0 (in the 2.x line).

• CVE-2026-60000LOW 3.7

  OpenSSH versions before 10.4 contain a flaw in how they handle the MaxAuthTries configuration setting when GSSAPI authentication is enabled. An unauthenticated attacker on the network can send a large number of authentication requests to consume server resources, potentially degrading SSH service availability. The vulnerability requires specific conditions (GSSAPI must be configured) and has limited impact, but represents a denial-of-service vector that should be addressed during normal patching cycles.

• CVE-2026-42145LOW 3.1

  Coolify, a self-hosted server and application management platform, contains a vulnerability in its database backup upload feature that allows authenticated users to upload files without proper validation. An attacker with valid credentials could upload oversized or malicious files to disrupt service availability. The flaw affects all versions before 4.0.0-beta.474 and requires user authentication, limiting the immediate threat surface but remaining a denial-of-service risk in environments where insider risk or credential compromise is a concern.