GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-789

Allowed

Memory Allocation with Excessive Size Value

Abstraction: Variant · Status: Draft

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

437 vulnerabilities reference this CWE, most recent first.

GHSA-C38H-7XM3-HV7V

Vulnerability from github – Published: 2026-07-15 15:33 – Updated: 2026-07-15 15:33
VLAI
Details

DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-58559"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-15T13:17:31Z",
    "severity": "MODERATE"
  },
  "details": "DoS vulnerability in the vibration service.\u00a0Impact: Successful exploitation of this vulnerability may affect availability.",
  "id": "GHSA-c38h-7xm3-hv7v",
  "modified": "2026-07-15T15:33:06Z",
  "published": "2026-07-15T15:33:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58559"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletin/2026/7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C7PR-383R-XGG3

Vulnerability from github – Published: 2026-03-12 18:30 – Updated: 2026-03-27 18:31
VLAI
Details

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-28253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-12T18:16:23Z",
    "severity": "HIGH"
  },
  "details": "A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition",
  "id": "GHSA-c7pr-383r-xgg3",
  "modified": "2026-03-27T18:31:22Z",
  "published": "2026-03-12T18:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28253"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-C9H3-C6QJ-HH7Q

Vulnerability from github – Published: 2022-09-21 00:00 – Updated: 2024-05-08 17:44
VLAI
Summary
Apache Kafka vulnerability can lead to brokers hitting OutOfMemoryException, causing Denial of Service
Details

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.kafka:kafka"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.kafka:kafka"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.kafka:kafka"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.kafka:kafka"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2.0"
            },
            {
              "fixed": "3.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-34917"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770",
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-21T21:15:52Z",
    "nvd_published_at": "2022-09-20T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.",
  "id": "GHSA-c9h3-c6qj-hh7q",
  "modified": "2024-05-08T17:44:34Z",
  "published": "2022-09-21T00:00:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34917"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/kafka/commit/14951a83e3fdead212156e5532359500d72f68bc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/kafka/commit/2bfa24b2bd416e7b8c4a0c566b984c43904fdecb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/kafka/commit/aaceb6b79bfcb1d32874ccdbc8f3138d1c1c00fb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/kafka/commit/c1295662768e64b4467e27c3d5158f95f2307657"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/KAFKA-14063"
    },
    {
      "type": "WEB",
      "url": "https://kafka.apache.org/cve-list"
    },
    {
      "type": "WEB",
      "url": "https://kafka.apache.org/cve-list#CVE-2022-34917"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Kafka vulnerability can lead to brokers hitting OutOfMemoryException, causing Denial of Service"
}

GHSA-C9VX-X9Q2-FFX8

Vulnerability from github – Published: 2026-02-25 18:31 – Updated: 2026-02-25 18:31
VLAI
Details

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper processing when parsing SNMP requests. An attacker could exploit this vulnerability by continuously sending SNMP queries to a specific MIB of an affected device. A successful exploit could allow the attacker to cause a kernel panic on the device, resulting in a reload and a DoS condition. Note: This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMPv1 or SNMPv2c, the attacker must have a valid read-only SNMP community string for the affected system. To exploit this vulnerability through SNMPv3, the attacker must have valid SNMP user credentials for the affected system.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-20048"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-25T17:25:25Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\n\nThis vulnerability is due to improper processing when parsing SNMP requests. An attacker could exploit this vulnerability by continuously sending SNMP queries\u0026nbsp;to a specific MIB of an affected device. A successful exploit could allow the attacker to cause a kernel panic on the device, resulting in a reload and a\u0026nbsp;DoS condition.\nNote: This vulnerability affects SNMP versions 1, 2c, and 3. To exploit\u0026nbsp;this vulnerability through SNMPv1 or\u0026nbsp;SNMPv2c, the attacker must have a valid read-only SNMP community string for the affected system. To exploit this vulnerability through SNMPv3, the attacker must have valid SNMP user credentials for the affected system.",
  "id": "GHSA-c9vx-x9q2-ffx8",
  "modified": "2026-02-25T18:31:38Z",
  "published": "2026-02-25T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20048"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-dsnmp-cNN39Uh"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CF4R-4Q6G-M584

Vulnerability from github – Published: 2026-05-16 18:31 – Updated: 2026-05-16 18:31
VLAI
Details

Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350000 repeated characters and paste it twice into a new note to trigger an application crash on iOS devices.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2021-47973"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-16T16:16:22Z",
    "severity": "HIGH"
  },
  "details": "Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350000 repeated characters and paste it twice into a new note to trigger an application crash on iOS devices.",
  "id": "GHSA-cf4r-4q6g-m584",
  "modified": "2026-05-16T18:31:38Z",
  "published": "2026-05-16T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47973"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/49978"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/sticky-notes-widget-denial-of-service-via-buffer-overflow"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-CFGW-6MRW-577F

Vulnerability from github – Published: 2026-04-07 18:31 – Updated: 2026-04-07 18:31
VLAI
Details

NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a server crash. A successful exploit of this vulnerability might lead to denial of service.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-24146"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-07T18:16:39Z",
    "severity": "HIGH"
  },
  "details": "NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a server crash. A successful exploit of this vulnerability might lead to denial of service.",
  "id": "GHSA-cfgw-6mrw-577f",
  "modified": "2026-04-07T18:31:38Z",
  "published": "2026-04-07T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24146"
    },
    {
      "type": "WEB",
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5816"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24146"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CH3Q-CW5R-F4HG

Vulnerability from github – Published: 2026-06-12 21:02 – Updated: 2026-07-08 17:35
VLAI
Summary
ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation
Details

Summary

The SSH protocol parser trusted attacker-controlled length and count fields without first checking that the declared values fit within the containing packet.

When a client connects to a malicious or compromised SSH server, the server can send a small, malformed packet containing an inner field whose declared length is much larger than the packet itself. The Kaitai Struct Java runtime attempts to allocate a byte array using the declared length before it discovers that the input is truncated. A sufficiently large value can therefore cause excessive memory allocation or an uncaught OutOfMemoryError, potentially terminating the application process that uses the library.

Applications that enable SSH agent forwarding have an additional attack path: the connected server can send malformed agent protocol messages containing the same class of oversized inner length.

Details

SSH uses unsigned 32-bit length prefixes for strings and other protocol structures. Before the fix, several Kaitai Struct definitions passed these lengths directly to generated parsing code. For example, the byte-string definition read a uint32 followed by an array of that size without validating the size against the bytes remaining in the current stream.

The SSH transport limits the size of an outer packet, but an inner field in that packet could still declare a length approaching the Java array size limit. The Kaitai runtime allocates the destination array before reading from the bounded input stream. Consequently, an attacker does not need to transmit an equally large packet to trigger the allocation attempt.

Malformed count fields could also cause parsers to attempt an unreasonable number of repeated elements. The fix validates both byte lengths and element counts against the size of their containing stream.

Parsing failures previously surfaced inconsistently as unchecked runtime exceptions. The fixed version converts malformed SSH packets to a transport protocol error and returns an SSH agent failure response for malformed agent requests.

Attack Requirements

For the general SSH packet path:

  • A user or application must initiate a connection to an attacker-controlled or compromised SSH server.
  • Authentication is not required.
  • No optional library feature is required.
  • The server only needs to return a malformed SSH packet containing an oversized inner length or count.

For the agent protocol path, SSH agent forwarding must additionally be enabled.

Impact

Successful exploitation can cause excessive heap allocation and loss of availability of the application process. In constrained environments, a single small malicious packet can cause an OutOfMemoryError.

No confidentiality or integrity impact has been demonstrated.

Remediation

Upgrade to version 0.3.1 or later.

The fix:

  • Validates length-prefixed fields against the remaining bytes in their containing Kaitai stream.
  • Validates repeated-element counts against the minimum encoded size of each element.
  • Validates SSH transport and agent frame lengths and padding constraints.
  • Converts malformed SSH packet parsing failures into TransportException.
  • Returns SSH_AGENT_FAILURE for malformed forwarded-agent requests instead of allowing parser exceptions to escape.
Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.connectbot.sshlib:sshlib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54700"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T21:02:01Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe SSH protocol parser trusted attacker-controlled length and count fields without first checking that the declared values fit within the containing packet.\n\nWhen a client connects to a malicious or compromised SSH server, the server can send a small, malformed packet containing an inner field whose declared length is much larger than the packet itself. The Kaitai Struct Java runtime attempts to allocate a byte array using the declared length before it discovers that the input is truncated. A sufficiently large value can therefore cause excessive memory allocation or an uncaught `OutOfMemoryError`, potentially terminating the application process that uses the library.\n\nApplications that enable SSH agent forwarding have an additional attack path: the connected server can send malformed agent protocol messages containing the same class of oversized inner length.\n\n## Details\n\nSSH uses unsigned 32-bit length prefixes for strings and other protocol structures. Before the fix, several Kaitai Struct definitions passed these lengths directly to generated parsing code. For example, the byte-string definition read a `uint32` followed by an array of that size without validating the size against the bytes remaining in the current stream.\n\nThe SSH transport limits the size of an outer packet, but an inner field in that packet could still declare a length approaching the Java array size limit. The Kaitai runtime allocates the destination array before reading from the bounded input stream. Consequently, an attacker does not need to transmit an equally large packet to trigger the allocation attempt.\n\nMalformed count fields could also cause parsers to attempt an unreasonable number of repeated elements. The fix validates both byte lengths and element counts against the size of their containing stream.\n\nParsing failures previously surfaced inconsistently as unchecked runtime exceptions. The fixed version converts malformed SSH packets to a transport protocol error and returns an SSH agent failure response for malformed agent requests.\n\n## Attack Requirements\n\nFor the general SSH packet path:\n\n- A user or application must initiate a connection to an attacker-controlled or compromised SSH server.\n- Authentication is not required.\n- No optional library feature is required.\n- The server only needs to return a malformed SSH packet containing an oversized inner length or count.\n\nFor the agent protocol path, SSH agent forwarding must additionally be enabled.\n\n## Impact\n\nSuccessful exploitation can cause excessive heap allocation and loss of availability of the application process. In constrained environments, a single small malicious packet can cause an `OutOfMemoryError`.\n\nNo confidentiality or integrity impact has been demonstrated.\n\n## Remediation\n\nUpgrade to version `0.3.1` or later.\n\nThe fix:\n\n- Validates length-prefixed fields against the remaining bytes in their containing Kaitai stream.\n- Validates repeated-element counts against the minimum encoded size of each element.\n- Validates SSH transport and agent frame lengths and padding constraints.\n- Converts malformed SSH packet parsing failures into `TransportException`.\n- Returns `SSH_AGENT_FAILURE` for malformed forwarded-agent requests instead of allowing parser exceptions to escape.",
  "id": "GHSA-ch3q-cw5r-f4hg",
  "modified": "2026-07-08T17:35:55Z",
  "published": "2026-06-12T21:02:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/connectbot/cbssh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation"
}

GHSA-CJM8-JXPW-G43M

Vulnerability from github – Published: 2026-05-18 09:31 – Updated: 2026-06-01 15:09
VLAI
Summary
Mattermost doesn't validate 7zip archive structure before processing
Details

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.5.0"
            },
            {
              "fixed": "11.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.11.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.4.0"
            },
            {
              "fixed": "11.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.0-20260325191733-fb11968f8798"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.3.2-0.20260325191733-fb11968f8798"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-6340"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-01T15:09:30Z",
    "nvd_published_at": "2026-05-18T08:16:14Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost versions 11.5.x \u003c= 11.5.1, 10.11.x \u003c= 10.11.13, 11.4.x \u003c= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573",
  "id": "GHSA-cjm8-jxpw-g43m",
  "modified": "2026-06-01T15:09:30Z",
  "published": "2026-05-18T09:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6340"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/fb11968f8798925c7b75711025bc5f991124ba26"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mattermost/mattermost"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mattermost doesn\u0027t validate 7zip archive structure before processing"
}

GHSA-CMFX-9CXF-9XXJ

Vulnerability from github – Published: 2022-03-29 00:01 – Updated: 2022-04-05 00:00
VLAI
Details

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown code of the component Portscan. The manipulation with an unknown input leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2017-20016"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770",
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-28T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown code of the component Portscan. The manipulation with an unknown input leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
  "id": "GHSA-cmfx-9cxf-9xxj",
  "modified": "2022-04-05T00:00:46Z",
  "published": "2022-03-29T00:01:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20016"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.101969"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.101974"
    },
    {
      "type": "WEB",
      "url": "http://www.computec.ch/news.php?item.117"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CPF9-PH2J-CCR9

Vulnerability from github – Published: 2026-04-16 21:09 – Updated: 2026-04-24 20:48
VLAI
Summary
zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing
Details

Summary endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected.

  • Attack Vector: Network — exploitable via a single HTTP request with a crafted Cookie header.
  • Attack Complexity: Low — no preconditions or chaining required; the attacker only needs to know the cookie name (publicly derivable from any OAuth redirect).
  • Privileges Required: None — reached before JWT validation or any authentication check.
  • User Interaction: None.
  • Scope: Unchanged — impact is confined to the affected proxy process.
  • Confidentiality Impact: None.
  • Integrity Impact: None.

Availability Impact: High — sustained or concurrent requests cause OOM process termination, taking down the proxy for all users of all shares it serves.

Affected Components - endpoints/oauthCookies.go — GetSessionCookie (line 81) - endpoints/publicProxy/authOAuth.go — handleOAuth (line 50) — call site, pre-auth - endpoints/dynamicProxy/cookies.go — getSessionCookie (line 29) — call site

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openziti/zrok"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openziti/zrok/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T21:09:08Z",
    "nvd_published_at": "2026-04-17T21:16:35Z",
    "severity": "HIGH"
  },
  "details": "**Summary**\nendpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected.\n\n- Attack Vector: Network \u2014 exploitable via a single HTTP request with a crafted Cookie header.\n- Attack Complexity: Low \u2014 no preconditions or chaining required; the attacker only needs to know the cookie name (publicly derivable from any OAuth redirect).\n- Privileges Required: None \u2014 reached before JWT validation or any authentication check.\n- User Interaction: None.\n- Scope: Unchanged \u2014 impact is confined to the affected proxy process.\n- Confidentiality Impact: None.\n- Integrity Impact: None.\n\nAvailability Impact: High \u2014 sustained or concurrent requests cause OOM process termination, taking down the proxy for all users of all shares it serves.\n\n**Affected Components**\n- endpoints/oauthCookies.go \u2014 GetSessionCookie (line 81)\n- endpoints/publicProxy/authOAuth.go \u2014 handleOAuth (line 50) \u2014 call site, pre-auth\n- endpoints/dynamicProxy/cookies.go \u2014 getSessionCookie (line 29) \u2014 call site",
  "id": "GHSA-cpf9-ph2j-ccr9",
  "modified": "2026-04-24T20:48:49Z",
  "published": "2026-04-16T21:09:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40303"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openziti/zrok"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openziti/zrok/releases/tag/v2.0.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing"
}

Mitigation
Implementation Architecture and Design

Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.

Mitigation
Operation

Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.

No CAPEC attack patterns related to this CWE.