CWE-789 Memory Allocation with Excessive Size Value

swoosh has email-derived URL path injection in Microsoft Graph endpoint

music-metadata: Uncontrolled memory allocation in APEv2 parser

music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion

ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions

Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

SIPGO: DoS via unvalidated WebSocket frame length

SIPGO: DoS via unvalidated Content-Length in the stream parser

psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation

ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

rclone: S3 multipart declared-length memory exhaustion

kafka-python vulnerable to denial of service through an unvalidated protocol frame length

Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

vouch-proxy has an Unbounded Multipart Cookie Allocation DoS