Skip to content
Threat Feed
Subscribe

Tag

Memory Exhaustion

9 briefs RSS
medium threat

js-libp2p Gossipsub Memory Exhaustion via Subscription Flood

A memory exhaustion vulnerability exists in `@libp2p/gossipsub` due to unbounded subscription handling, allowing a single attacker to exhaust a Node.js heap by flooding unique topic subscriptions, leading to denial-of-service.

js-libp2p +1 dos memory-exhaustion libp2p
1r 2t
medium advisory

Mailpit Unauthenticated Remote Memory Exhaustion DoS Vulnerability

Mailpit is vulnerable to an unauthenticated remote memory-exhaustion denial-of-service attack due to missing size limits on incoming SMTP DATA and HTTP requests, leading to unbounded memory and disk growth, potentially crashing the application.

mailpit dos memory exhaustion cve-2026-45713
3r 1t
medium advisory

Avro Map Decoder Vulnerable to Denial-of-Service via Unbounded Memory Allocation

The Avro map decoder accepted attacker-controlled block-element counts, leading to unbounded map growth and potential denial-of-service via memory exhaustion; upgrading to v2.33.0 requires explicit configuration of MaxMapAllocSize to mitigate the vulnerability.

avro +1 denial-of-service memory-exhaustion data-serialization
2r 1t
high advisory

vm2 Sandbox Escape via Buffer.alloc Memory Exhaustion

A vulnerability exists in the vm2 npm package (<= 3.10.5) where sandboxed code can bypass the timeout protection by calling Buffer.alloc() with an arbitrary size, leading to memory exhaustion on the host system.

vm2 sandbox-escape dos memory-exhaustion
3r 2t
medium advisory

Prosody Memory Exhaustion Vulnerability (CVE-2026-43506)

Prosody versions before 0.12.6, versions 1.0.0 through 13.0.0, and before version 13.0.5 are vulnerable to a denial of service due to memory leaks from unauthenticated connections, leading to memory exhaustion.

Prosody denial-of-service memory exhaustion
2r 1t 1c
high advisory

Memory Exhaustion Vulnerability in Widely Used Python Library

A memory exhaustion vulnerability (CVE-2026-33155) exists in a widely used Python library, affecting services like SageMaker, DataHub, and acryl-datahub due to an incomplete patch for CVE-2025-58367, requiring pinning to version 8.6.2.

memory-exhaustion vulnerability denial-of-service python supply-chain
2r 1t
medium advisory

Micronaut TimeConverterRegistrar Memory Exhaustion via Accept-Language Header

Micronaut's `TimeConverterRegistrar` has an unbounded `formattersCache` that allows memory exhaustion via a crafted `Accept-Language` header, where an unauthenticated attacker can crash the JVM by sending requests with novel locale tags to `@Format`-annotated endpoints, growing the cache until heap memory is exhausted, affecting Micronaut applications with `micronaut-context` versions 4.3.0 and above, up to but not including 4.10.22.

micronaut-context dos memory-exhaustion micronaut
3r 2t
medium advisory

Bandit WebSocket Memory Exhaustion Vulnerability

An unauthenticated attacker can exhaust server memory by sending unbounded WebSocket continuation frames in Bandit-fronted applications, leading to a denial of service.

Phoenix Channels +1 denial-of-service websocket memory-exhaustion
2r 2t
medium advisory

Hickory DNS NSEC3 Validation Vulnerability Leads to DoS

A vulnerability in Hickory DNS's NSEC3 closest-encloser proof validation allows a remote attacker to cause a denial of service by exhausting memory when processing crafted DNS responses with mismatched SOA records.

hickory-proto +1 denial-of-service dnssec memory-exhaustion
2r 1t