Common Weakness Enumeration
CWE-789
AllowedMemory Allocation with Excessive Size Value
Abstraction: Variant · Status: Draft
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
530 vulnerabilities reference this CWE, most recent first.
CVE-2026-111279 (GCVE-0-2026-111279)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-15 21:43
VLAI
EPSS
VEX
Title
Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
Summary
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
Severity
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/dragonflydb/dragonfly/issues/8578 | issue-tracking |
| https://github.com/dragonflydb/dragonfly/blob/8ce… | technical-description |
| https://github.com/dragonflydb/dragonfly/blob/8ce… | technical-description |
| https://github.com/dragonflydb/dragonfly/blob/8ce… | technical-description |
| https://github.com/dragonflydb/dragonfly | product |
| https://www.vulncheck.com/advisories/dragonfly-th… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dragonflydb | dragonfly |
Affected:
0 , ≤ 2.0.2
(semver)
cpe:2.3:a:dragonflydb:dragonfly:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "dragonfly",
"repo": "https://github.com/dragonflydb/dragonfly",
"vendor": "dragonflydb",
"versions": [
{
"lessThanOrEqual": "2.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dragonflydb:dragonfly:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "jsp_0"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:23.862Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #8578",
"tags": [
"issue-tracking"
],
"url": "https://github.com/dragonflydb/dragonfly/issues/8578"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/hset_family.cc#L1436-L1483"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/zset_family.cc#L1519-L1522"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/set_family.cc#L957-L984"
},
{
"tags": [
"product"
],
"url": "https://github.com/dragonflydb/dragonfly"
},
{
"name": "VulnCheck Advisory: Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dragonfly-through-2.0.2-unbounded-memory-allocation-via-negative-count-in-hrandfield-zrandmember-and-srandmember"
}
],
"title": "Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111279",
"datePublished": "2026-10-15T21:43:23.862Z",
"dateReserved": "2026-10-15T19:46:06.408Z",
"dateUpdated": "2026-10-15T21:43:23.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110258 (GCVE-0-2026-110258)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 16:10
VLAI
EPSS
VEX
Title
OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions
Summary
OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:10 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.ow2.org/asm/asm/-/merge_requests/458 | patch |
| https://gitlab.ow2.org/asm/asm/-/commit/4dabfe0ae… | patch |
| https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/… | technical-description |
| https://asm.ow2.io/versions.html | release-notes |
| https://www.vulncheck.com/advisories/ow2-asm-3.0-… | third-party-advisory |
Date Public
2026-08-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110258",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:10:34.452535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:10:48.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.ow2.asm/asm",
"product": "ASM",
"repo": "https://gitlab.ow2.org/asm/asm",
"vendor": "OW2",
"versions": [
{
"lessThan": "9.11",
"status": "affected",
"version": "3.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eric Bruneton"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:31.636Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://gitlab.ow2.org/asm/asm/-/merge_requests/458"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.ow2.org/asm/asm/-/commit/4dabfe0aef14f8cccb0617640a4add8fbcc4ed36"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/Label.java#L568"
},
{
"name": "ASM 9.11 Release Notes",
"tags": [
"release-notes"
],
"url": "https://asm.ow2.io/versions.html"
},
{
"name": "VulnCheck Advisory: OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-excessive-memory-allocation-via-multiple-ret-instructions"
}
],
"title": "OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110258",
"datePublished": "2026-10-14T14:16:31.636Z",
"dateReserved": "2026-10-13T18:33:55.549Z",
"dateUpdated": "2026-10-14T16:10:48.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110257 (GCVE-0-2026-110257)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 15:55
VLAI
EPSS
VEX
Title
OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute
Summary
OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB allocation, causing an OutOfMemoryError that crashes the JVM or consuming thread.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:49 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.ow2.org/asm/asm/-/merge_requests/456 | patch |
| https://gitlab.ow2.org/asm/asm/-/commit/eb5fa95bb… | patch |
| https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/… | technical-description |
| https://asm.ow2.io/versions.html | release-notes |
| https://www.vulncheck.com/advisories/ow2-asm-5.0-… | third-party-advisory |
Date Public
2026-08-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:49:40.338728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:55:22.107Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.ow2.asm/asm",
"product": "ASM",
"repo": "https://gitlab.ow2.org/asm/asm",
"vendor": "OW2",
"versions": [
{
"lessThan": "9.11",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB allocation, causing an OutOfMemoryError that crashes the JVM or consuming thread."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:30.933Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://gitlab.ow2.org/asm/asm/-/merge_requests/456"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.ow2.org/asm/asm/-/commit/eb5fa95bb0670eaec2ecf9b8a3a501b48e5a967c"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/ClassReader.java#L3497"
},
{
"name": "ASM 9.11 Release Notes",
"tags": [
"release-notes"
],
"url": "https://asm.ow2.io/versions.html"
},
{
"name": "VulnCheck Advisory: OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ow2-asm-5.0-before-9.11-excessive-memory-allocation-via-bootstrapmethods-attribute"
}
],
"title": "OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110257",
"datePublished": "2026-10-14T14:16:30.933Z",
"dateReserved": "2026-10-13T18:33:55.549Z",
"dateUpdated": "2026-10-14T15:55:22.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109149 (GCVE-0-2026-109149)
Vulnerability from cvelistv5 – Published: 2026-10-13 09:30 – Updated: 2026-10-13 09:30
VLAI
EPSS
VEX
Title
beautifier js-beautify memory allocation
Summary
A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416885 | vdb-entry |
| https://vuldb.com/vuln/416885/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109149 | third-party-advisory |
| https://vuldb.com/submit/978621 | third-party-advisory |
| https://github.com/beautifier/js-beautify/issues/2522 | issue-tracking |
| https://github.com/beautifier/js-beautify/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| beautifier | js-beautify |
Affected:
1.15.0
Affected: 1.15.1 Affected: 2.0.0 Affected: 2.0.1 Affected: 2.0.2 Affected: 2.0.3 cpe:2.3:a:beautifier:js-beautify:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:beautifier:js-beautify:*:*:*:*:*:*:*:*"
],
"product": "js-beautify",
"vendor": "beautifier",
"versions": [
{
"status": "affected",
"version": "1.15.0"
},
{
"status": "affected",
"version": "1.15.1"
},
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohammedix88 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T09:30:16.051Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416885 | beautifier js-beautify memory allocation",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/416885"
},
{
"name": "VDB-416885 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416885/cti"
},
{
"name": "CVE-2026-109149 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109149"
},
{
"name": "Submit #978621 | beautifier js-beautify 1.15.1 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/978621"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/beautifier/js-beautify/issues/2522"
},
{
"tags": [
"product"
],
"url": "https://github.com/beautifier/js-beautify/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T13:41:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "beautifier js-beautify memory allocation",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109149",
"datePublished": "2026-10-13T09:30:16.051Z",
"dateReserved": "2026-10-12T11:36:30.201Z",
"dateUpdated": "2026-10-13T09:30:16.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108683 (GCVE-0-2026-108683)
Vulnerability from cvelistv5 – Published: 2026-10-11 14:30 – Updated: 2026-10-13 13:45 X_Open Source
VLAI
EPSS
VEX
Title
zhayujie CowAgent Media Download memory allocation
Summary
A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:44 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416391 | vdb-entry |
| https://vuldb.com/vuln/416391/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108683 | third-party-advisory |
| https://vuldb.com/submit/958015 | third-party-advisory |
| https://github.com/lche511/cve/tree/main/CowAgent… | exploit |
| https://github.com/zhayujie/CowAgent/commit/b7967… | patch |
| https://github.com/zhayujie/CowAgent/releases/tag/2.2.0 | patch |
| https://github.com/zhayujie/CowAgent/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108683",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:44:42.419814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:45:23.936Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*"
],
"modules": [
"Media Download Handler"
],
"product": "CowAgent",
"vendor": "zhayujie",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.1.1"
},
{
"status": "affected",
"version": "2.1.2"
},
{
"status": "affected",
"version": "2.1.3"
},
{
"status": "affected",
"version": "2.1.4"
},
{
"status": "affected",
"version": "2.1.5"
},
{
"status": "affected",
"version": "2.1.6"
},
{
"status": "affected",
"version": "2.1.7"
},
{
"status": "affected",
"version": "2.1.8"
},
{
"status": "affected",
"version": "2.1.9"
},
{
"status": "unaffected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pengguogood (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T14:30:23.145Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416391 | zhayujie CowAgent Media Download memory allocation",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/416391"
},
{
"name": "VDB-416391 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416391/cti"
},
{
"name": "CVE-2026-108683 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108683"
},
{
"name": "Submit #958015 | zhayujie CowAgent 2.1.6 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/958015"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lche511/cve/tree/main/CowAgent_Channel_Media_Download_DoS_Report"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zhayujie/CowAgent/commit/b7967210268fc4c0afea1078223e74e7e96a8a54"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zhayujie/CowAgent/releases/tag/2.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/zhayujie/CowAgent/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-10T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-10T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-10T23:27:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "zhayujie CowAgent Media Download memory allocation",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108683",
"datePublished": "2026-10-11T14:30:23.145Z",
"dateReserved": "2026-10-10T21:22:18.046Z",
"dateUpdated": "2026-10-13T13:45:23.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108106 (GCVE-0-2026-108106)
Vulnerability from cvelistv5 – Published: 2026-10-09 14:33 – Updated: 2026-10-13 16:51
VLAI
EPSS
VEX
Title
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Summary
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 16:50 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/xerial/snappy-java/security/ad… | vendor-advisory |
| https://github.com/xerial/snappy-java/commit/943c… | patch |
| https://github.com/xerial/snappy-java/releases/ta… | release-notes |
| https://github.com/xerial/snappy-java/blob/v1.1.1… | technical-description |
| https://github.com/xerial/snappy-java | product |
| https://www.vulncheck.com/advisories/xerial-snapp… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xerial | snappy-java |
Affected:
0 , < 1.1.10.9
(custom)
Unaffected: 1.1.10.9 (custom) cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:* |
Date Public
2026-10-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:50:47.015019Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:51:17.678Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.xerial.snappy/snappy-java",
"product": "snappy-java",
"vendor": "xerial",
"versions": [
{
"lessThan": "1.1.10.9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.1.10.9",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.10.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
},
{
"lang": "en",
"type": "finder",
"value": "1seal"
},
{
"lang": "en",
"type": "finder",
"value": "EndlssNightmare"
},
{
"lang": "en",
"type": "finder",
"value": "taer"
},
{
"lang": "en",
"type": "finder",
"value": "apvxlab"
},
{
"lang": "en",
"type": "finder",
"value": "trnguyencflt"
}
],
"datePublic": "2026-10-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T14:33:29.499Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q233-g92q-qxp6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75"
},
{
"name": "snappy-java v1.1.10.9 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517"
},
{
"tags": [
"product"
],
"url": "https://github.com/xerial/snappy-java"
},
{
"name": "VulnCheck Advisory: Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service"
}
],
"title": "Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108106",
"datePublished": "2026-10-09T14:33:29.499Z",
"dateReserved": "2026-10-09T13:44:40.883Z",
"dateUpdated": "2026-10-13T16:51:17.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107390 (GCVE-0-2026-107390)
Vulnerability from cvelistv5 – Published: 2026-10-08 19:09 – Updated: 2026-10-09 11:47
VLAI
EPSS
VEX
Title
music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length
Summary
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom fits within its parent or the available input. A tiny MP4-family file can route an oversized length into payload parsing for atoms including mvhd, stsd, stsz, and date, causing a large allocation attempt or process failure before end-of-input validation. Applications that parse untrusted MP4-family media can therefore be denied service. This issue is fixed in version 11.16.0.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 11:47 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Borewit/music-metadata/securit… | x_refsource_CONFIRM |
| https://github.com/Borewit/music-metadata/pull/2746 | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/commit/… | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Borewit | music-metadata |
Affected:
< 11.16.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107390",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T11:47:01.110193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T11:47:21.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-qc8q-pw95-mq6c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "music-metadata",
"vendor": "Borewit",
"versions": [
{
"status": "affected",
"version": "\u003c 11.16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom fits within its parent or the available input. A tiny MP4-family file can route an oversized length into payload parsing for atoms including mvhd, stsd, stsz, and date, causing a large allocation attempt or process failure before end-of-input validation. Applications that parse untrusted MP4-family media can therefore be denied service. This issue is fixed in version 11.16.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:09:08.729Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-qc8q-pw95-mq6c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-qc8q-pw95-mq6c"
},
{
"name": "https://github.com/Borewit/music-metadata/pull/2746",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/pull/2746"
},
{
"name": "https://github.com/Borewit/music-metadata/commit/0f19ad66d71889b1c5f3ba84d4824f079ac4c005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/commit/0f19ad66d71889b1c5f3ba84d4824f079ac4c005"
},
{
"name": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"
}
],
"source": {
"advisory": "GHSA-qc8q-pw95-mq6c",
"discovery": "UNKNOWN"
},
"title": "music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107390",
"datePublished": "2026-10-08T19:09:08.729Z",
"dateReserved": "2026-10-07T21:07:54.988Z",
"dateUpdated": "2026-10-09T11:47:21.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107389 (GCVE-0-2026-107389)
Vulnerability from cvelistv5 – Published: 2026-10-08 19:05 – Updated: 2026-10-09 18:32
VLAI
EPSS
VEX
Title
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
Summary
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 18:32 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Borewit/music-metadata/securit… | x_refsource_CONFIRM |
| https://github.com/Borewit/music-metadata/pull/2735 | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/commit/… | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/commit/… | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Borewit | music-metadata |
Affected:
< 11.16.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107389",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T18:32:35.247883Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T18:32:42.251Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "music-metadata",
"vendor": "Borewit",
"versions": [
{
"status": "affected",
"version": "\u003c 11.16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:05:23.816Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
},
{
"name": "https://github.com/Borewit/music-metadata/pull/2735",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/pull/2735"
},
{
"name": "https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58"
},
{
"name": "https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df"
},
{
"name": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"
}
],
"source": {
"advisory": "GHSA-5gfj-9q3v-qfp3",
"discovery": "UNKNOWN"
},
"title": "music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107389",
"datePublished": "2026-10-08T19:05:23.816Z",
"dateReserved": "2026-10-07T21:07:54.988Z",
"dateUpdated": "2026-10-09T18:32:42.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107388 (GCVE-0-2026-107388)
Vulnerability from cvelistv5 – Published: 2026-10-08 19:00 – Updated: 2026-10-14 02:44
VLAI
EPSS
VEX
Title
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
Summary
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 01:14 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Borewit/music-metadata/securit… | x_refsource_CONFIRM |
| https://github.com/Borewit/music-metadata/pull/2743 | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/commit/… | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Borewit | music-metadata |
Affected:
< 11.16.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107388",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T01:14:14.370552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T02:44:54.960Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "music-metadata",
"vendor": "Borewit",
"versions": [
{
"status": "affected",
"version": "\u003c 11.16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:00:24.725Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55"
},
{
"name": "https://github.com/Borewit/music-metadata/pull/2743",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/pull/2743"
},
{
"name": "https://github.com/Borewit/music-metadata/commit/b033db675b913a9dba1d29135ec3c10eae7095a7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/commit/b033db675b913a9dba1d29135ec3c10eae7095a7"
},
{
"name": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"
}
],
"source": {
"advisory": "GHSA-jjpr-9cvf-cq55",
"discovery": "UNKNOWN"
},
"title": "music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107388",
"datePublished": "2026-10-08T19:00:24.725Z",
"dateReserved": "2026-10-07T21:07:54.988Z",
"dateUpdated": "2026-10-14T02:44:54.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107387 (GCVE-0-2026-107387)
Vulnerability from cvelistv5 – Published: 2026-10-08 18:58 – Updated: 2026-10-08 19:32
VLAI
EPSS
VEX
Title
music-metadata: Uncontrolled memory allocation in APEv2 parser
Summary
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. The demonstrated impact is availability loss only. This issue is fixed in version 11.16.0.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 19:31 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Borewit/music-metadata/securit… | x_refsource_CONFIRM |
| https://github.com/Borewit/music-metadata/pull/2744 | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/commit/… | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Borewit | music-metadata |
Affected:
< 11.16.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107387",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T19:31:49.869252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:32:13.101Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-53v6-4h7p-p4gj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "music-metadata",
"vendor": "Borewit",
"versions": [
{
"status": "affected",
"version": "\u003c 11.16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. The demonstrated impact is availability loss only. This issue is fixed in version 11.16.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T18:58:29.009Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-53v6-4h7p-p4gj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-53v6-4h7p-p4gj"
},
{
"name": "https://github.com/Borewit/music-metadata/pull/2744",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/pull/2744"
},
{
"name": "https://github.com/Borewit/music-metadata/commit/b3bf52cb6021b046f33ba47583e19ab8f10dd235",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/commit/b3bf52cb6021b046f33ba47583e19ab8f10dd235"
},
{
"name": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"
}
],
"source": {
"advisory": "GHSA-53v6-4h7p-p4gj",
"discovery": "UNKNOWN"
},
"title": "music-metadata: Uncontrolled memory allocation in APEv2 parser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107387",
"datePublished": "2026-10-08T18:58:29.009Z",
"dateReserved": "2026-10-07T21:07:54.988Z",
"dateUpdated": "2026-10-08T19:32:13.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Architecture and Design
Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
Mitigation
Operation
Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.
No CAPEC attack patterns related to this CWE.