Security vulnerabilities and automated fixes for memory exhaustion issues
4 posts found
node-tar versions 7.5.11 through 7.5.18 are vulnerable to a denial-of-service attack through maliciously crafted gzip archives that decompress to disproportionately large sizes. An attacker can exploit this to exhaust memory and CPU resources by submitting a small, highly compressed archive that expands beyond configured limits during extraction.
CVE-2026-39244 is a high-severity denial of service vulnerability in the adm-zip npm package that allows attackers to crash Node.js applications by uploading maliciously crafted ZIP files. The fix upgrades adm-zip from version 0.5.16 to 0.6.0, which adds proper memory bounds checking to prevent excessive allocation during archive extraction.
A high-severity vulnerability in `quinn-proto` allowed remote attackers to exhaust server memory by sending carefully crafted out-of-order QUIC stream data, triggering unbounded buffer growth during reassembly. The fix upgrades `rustls-webpki` from `0.103.10` to `0.103.13` in `Cargo.lock`, closing a related denial-of-service primitive that could be chained with the stream reassembly weakness. Together, these changes harden the QUIC stack against memory exhaustion attacks that require no authenti
A high-severity memory exhaustion vulnerability (CVE-2026-49476) was discovered in Soup Sieve version 2.8.3, affecting Python applications that parse CSS selectors from user-controlled input. The vulnerability allows attackers to craft malicious selector lists that consume excessive memory, potentially causing denial of service. The fix involves upgrading to soupsieve 2.8.4, which implements proper resource limits on selector parsing.