Security vulnerabilities and automated fixes for resource exhaustion issues
12 posts found
CVE-2026-73566 is a Denial of Service vulnerability in node-tar that allows attackers to craft specially malformed tar archives with excessively long file paths to exhaust system resources and crash applications. The fix upgrades tar from version 7.5.19 to 7.5.21, which implements proper path length validation to prevent this attack vector.
CVE-2026-69152 exposed a critical Denial of Service vulnerability in the brace-expansion library that bypassed the previous CVE-2026-14257 mitigation through unbounded intermediate arrays. This vulnerability affected multiple versions of brace-expansion used throughout the dependency tree via minimatch, requiring coordinated upgrades across four major version lines (1.1.18, 2.1.4, 3.0.6, and 5.0.9) to eliminate the attack surface.
The cc-viewer application was vulnerable to Denial of Service attacks through the adm-zip library (version 0.5.17), which could be exploited using specially crafted ZIP files that trigger excessive memory allocation. Upgrading to adm-zip 0.6.0 resolves CVE-2026-39244 by implementing proper safeguards against ZIP bomb attacks and malicious archive structures.
A high-severity vulnerability (CVE-2026-48802) in python-engineio 4.12.2 allowed attackers to exhaust system resources through unbound thread allocation, leading to denial of service. The fix upgrades the dependency to version 4.13.2, which implements thread pool limits to prevent resource exhaustion attacks against real-time WebSocket applications.
CVE-2026-14257 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where crafted input strings could trigger unbounded memory expansion, crashing the Node.js process. The fix upgrades `brace-expansion` from version `1.1.16` to `5.0.8` in the UI application's lock file, eliminating the uncapped expansion behavior. This change protects production services from availability attacks that could be triggered by user-influenced input flowing through glob or path-mat
CVE-2026-45783 is a high-severity vulnerability in `@libp2p/kad-dht` versions prior to 16.2.6 where DHT server nodes accept and store PUT_VALUE records without validating their content or enforcing storage limits, allowing any peer on the network to exhaust disk space. The fix upgrades the package from 16.1.3 to 16.2.6, which introduces proper record validation before writes are committed to disk. Developers building decentralized applications on libp2p are directly affected if they run DHT serv
CVE-2026-39827 is a high-severity resource exhaustion vulnerability in `golang.org/x/crypto` where an authenticated SSH client can repeatedly open channels to consume server resources without bound. The vulnerability was present in the `cloud/gcp/functions/acmedns` module at version `v0.49.0` and was resolved by upgrading to `v0.52.0`. Left unpatched, this flaw could allow an attacker with valid SSH credentials to degrade or deny service to other users of the affected GCP Cloud Function.
A high-severity denial-of-service vulnerability was discovered in the PH7 lexer where the `PH7_TokenizePHP()` function accepted arbitrarily large input sizes without validation. An attacker could submit gigabyte-scale PHP code, causing proportional CPU and memory exhaustion. The fix introduces a configurable input size cap enforced before lexer processing begins.
A medium-severity vulnerability in a file transfer receiver allowed attackers to exhaust server resources by sending maliciously crafted import files with no size limits, no JSON depth restrictions, and millions of entries loaded directly into memory. The fix introduces explicit input validation guards that reject unauthenticated or malformed requests before any disk or network operations begin. Understanding this class of vulnerability is essential for any developer building file ingestion pipe
A medium-severity integer overflow vulnerability was discovered and patched in a Rust file transfer receiver, where unchecked byte accumulation could allow attackers to bypass file size limits by exploiting arithmetic wraparound in release builds. The fix replaces a simple `+=` operation with Rust's `checked_add` method, which returns an error instead of silently wrapping around. This is a great reminder that even memory-safe languages like Rust can harbor subtle numeric vulnerabilities in relea
A medium-severity vulnerability was discovered and patched in the PicoW ClockMaster firmware's MQTT client, where file import functionality lacked resource limits and the broker connection lacked authentication—allowing attackers on the same network to inject spoofed motor and LED commands. The fix introduces proper input validation, file size checks, JSON depth limits, and authenticated/encrypted MQTT connections. This case is a timely reminder that IoT firmware security requires the same rigor
A medium-severity vulnerability in file import functionality left applications vulnerable to Denial of Service (DoS) attacks through maliciously crafted files. By exploiting missing resource limits and validation checks, attackers could exhaust server memory with deeply nested JSON or oversized files, potentially bringing down entire services.