Furl 3.15 fixes memory exhaustion in Perl HTTP decompression
Furl versions through 3.15 allow memory exhaustion via unbounded decompression of HTTP responses (CVE-2026-65059).
Stories per day · 30 days
Relatedperl4algorithm-uratanitakeda1cve1decompression1denial-of-service1furl1gocardless1http1information-leak1text-csv-xs1use-after-free1webhooks1
12 stories, newest first · one card per story
Stories tagged #memory-exhaustion
Business::GoCardless before 1.01 has three Perl webhook flaws
Empty webhook secrets accept forgeries, and unsigned legacy payloads can exhaust memory before verification.
Perl Algorithm::UrataniTakeda before 0.1.7 can exhaust memory
Versions from 0.1.5 before 0.1.7 keep a failure shift cache that is never cleared during search.
Text::CSV_XS versions before 1.65 for Perl (8 CVEs)
Perl Text::CSV_XS before 1.65 has multiple flaws, including memory exhaustion, use-after-free, and data leakage.
CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
Apache CXF attachment header limits can be bypassed, allowing denial of service via memory exhaustion.
Fwd: Vulnerabilities in golang.org/x/net
Go released golang.org/x/net v0.60.0 to fix HTTP/2 server memory exhaustion caused by Trailer headers.
USN-8869-1: RabbitMQ Server vulnerability
Ubuntu warns RabbitMQ mishandles HTTP/2 headers, possibly letting attackers exhaust memory and cause a denial of service.
CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode
A tiny BER response can exhaust memory in Apache Directory LDAP API before 1.2.9, causing denial of service.
CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies
Apache MINA SSHD SFTP clients can be memory-exhausted by unsolicited replies before 2.20.0 and 3.0.0-M6.
CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
Apache Neethi before 3.2.4 copies unlimited content inside policy assertions without size checks, allowing crafted documents to exhaust the heap.
CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.
CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table
CVE-2026-16028: Protocol::HTTP2 Perl library before 1.14 lets closed streams linger in the connection table, enabling remote memory exhaustion.