CWE-770 Allocation of Resources Without Limits or Throttling

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

Contao: The registration module re-sends activation mails

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

Vikunja: Denial of service via decompression bomb in the data import

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

Undertow MadeYouReset HTTP/2 DDoS Vulnerability

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization