CWE-1284 Improper Validation of Specified Quantity in Input

swoosh has email-derived URL path injection in Microsoft Graph endpoint

sprintf-js vulnerable to denial of service through unbounded precision specifiers

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

source-map-js allows event-loop denial of service through indexed source-map section offsets

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

File Browser has a DoS Vulnerability via Public Login API

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag

Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

Craft Commerce: Partial Payment Amount Without Lower Bound Validation

spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation

python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

iskorotkov/avro: Integer Overflow in Decoder

iskorotkov/avro: CPU Exhaustion in Decoder

Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

iskorotkov/avro: Denial-of-Service Vulnerability in Decoder

Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)

rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length