Security vulnerabilities and automated fixes for dos issues
6 posts found
CVE-2026-54283 is a high-severity Denial of Service vulnerability in Starlette where form size limits set on `request.form()` were silently ignored for `application/x-www-form-urlencoded` content, allowing attackers to submit arbitrarily large payloads that could exhaust server resources. The fix upgrades Starlette from version 0.49.1 to 0.50.0, where the form parser correctly enforces configured limits for both multipart and URL-encoded content types. This change was applied to `agent/sandbox/u
CVE-2026-69152 exposed a critical Denial of Service vulnerability in the brace-expansion library that bypassed the previous CVE-2026-14257 mitigation through unbounded intermediate arrays. This vulnerability affected multiple versions of brace-expansion used throughout the dependency tree via minimatch, requiring coordinated upgrades across four major version lines (1.1.18, 2.1.4, 3.0.6, and 5.0.9) to eliminate the attack surface.
Python-SocketIO versions prior to 5.16.2 contained a critical vulnerability where binary attachments could accumulate without bounds, allowing attackers to exhaust server memory and trigger a denial of service. This vulnerability has been patched through a dependency upgrade that implements proper resource limits on attachment handling.
CVE-2026-14257 is a denial-of-service vulnerability in the brace-expansion library that allows attackers to crash applications through unbounded expansion of brace patterns. By upgrading from version 2.1.2 to 2.1.3 and 5.0.6 to 5.0.8, we eliminated the risk of memory exhaustion attacks targeting glob pattern expansion in build tools and scripts.
CVE-2026-44240 is a client-side denial of service vulnerability in the basic-ftp Node.js library that allows attackers to crash FTP clients by sending malformed, unterminated multiline FTP responses. Upgrading from version 5.0.5 to 5.3.1 patches this critical flaw that could have disrupted any application using the vulnerable library for FTP operations.
A medium-severity vulnerability in a file transfer receiver allowed attackers to exhaust server resources by sending maliciously crafted import files with no size limits, no JSON depth restrictions, and millions of entries loaded directly into memory. The fix introduces explicit input validation guards that reject unauthenticated or malformed requests before any disk or network operations begin. Understanding this class of vulnerability is essential for any developer building file ingestion pipe