Common Weakness Enumeration

CWE-789

Allowed

Memory Allocation with Excessive Size Value

Abstraction: Variant · Status: Draft

API response cwe.mitre.org

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

320 vulnerabilities reference this CWE, most recent first.

GHSA-QVX2-59G8-8HPH

Vulnerability from github – Published: 2022-12-25 21:30 – Updated: 2024-03-01 14:21
VLAI
Summary
docconv vulnerable to Memory Allocation with Excessive Size Value
Details

A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 can address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/sajari/docconv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.sajari.com/docconv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-4741"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-30T17:19:54Z",
    "nvd_published_at": "2022-12-25T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function `ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText`. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 can address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779.",
  "id": "GHSA-qvx2-59g8-8hph",
  "modified": "2024-03-01T14:21:08Z",
  "published": "2022-12-25T21:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4741"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sajari/docconv/pull/111"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sajari/docconv/commit/42bcff666855ab978e67a9041d0cdea552f20301"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sajari/docconv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sajari/docconv/releases/tag/v1.2.1"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2022-1188"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.216779"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.216779"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "docconv vulnerable to Memory Allocation with Excessive Size Value"
}

GHSA-QX2Q-88MX-VHG7

Vulnerability from github – Published: 2025-08-05 15:22 – Updated: 2025-08-06 14:31
VLAI
Summary
Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder
Details

Description

When using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder.

The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash.

Steps to Reproduce

Create a POST request handler that accepts x-www-form-urlencoded data

package main

import (
    "fmt"
    "net/http"

    "github.com/gofiber/fiber/v2"
)

type RequestBody struct {
    NestedContent []*struct{} `form:"test"`
}

func main() {
    app := fiber.New()

    app.Post("/", func(c *fiber.Ctx) error {
        formData := RequestBody{}
        if err := c.BodyParser(&formData); err != nil {
            fmt.Println(err)
            return c.SendStatus(http.StatusUnprocessableEntity)
        }
        return nil
    })

    fmt.Println(app.Listen(":3000"))
}

Run the server and send a POST request with a large numeric key in form data, such as:

curl -v -X POST localhost:3000 --data-raw 'test.18446744073704' \
  -H 'Content-Type: application/x-www-form-urlencoded'

Relevant Code Snippet

Within the decoder's decode method:

idx := parts[0].index
if v.IsNil() || v.Len() < idx+1 {
    value := reflect.MakeSlice(t, idx+1, idx+1)  // <-- Panic/crash occurs here when idx is huge
    if v.Len() < idx+1 {
        reflect.Copy(value, v)
    }
    v.Set(value)
}

The idx is not validated before use, leading to unsafe slice allocation for extremely large values.

Impact

  • Application panic or crash on malicious or malformed input.
  • Potential denial of service (DoS) via memory exhaustion or server crash.
  • Lack of defensive checks in the parsing code causes instability.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.52.8"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gofiber/fiber/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.52.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54801"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-05T15:22:21Z",
    "nvd_published_at": "2025-08-06T00:15:31Z",
    "severity": "HIGH"
  },
  "details": "### Description\n\nWhen using Fiber\u0027s `Ctx.BodyParser` to parse form data containing a large numeric key that represents a slice index (e.g., `test.18446744073704`), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder.\n\nThe root cause is that the decoder attempts to allocate a slice of length `idx + 1` without validating whether the index is within a safe or reasonable range. If `idx` is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash.\n\n\n### Steps to Reproduce\n\nCreate a POST request handler that accepts `x-www-form-urlencoded` data\n\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"net/http\"\n\n\t\"github.com/gofiber/fiber/v2\"\n)\n\ntype RequestBody struct {\n\tNestedContent []*struct{} `form:\"test\"`\n}\n\nfunc main() {\n\tapp := fiber.New()\n\n\tapp.Post(\"/\", func(c *fiber.Ctx) error {\n\t\tformData := RequestBody{}\n\t\tif err := c.BodyParser(\u0026formData); err != nil {\n\t\t\tfmt.Println(err)\n\t\t\treturn c.SendStatus(http.StatusUnprocessableEntity)\n\t\t}\n\t\treturn nil\n\t})\n\n\tfmt.Println(app.Listen(\":3000\"))\n}\n\n```\n\nRun the server and send a POST request with a large numeric key in form data, such as:\n\n```bash\ncurl -v -X POST localhost:3000 --data-raw \u0027test.18446744073704\u0027 \\\n  -H \u0027Content-Type: application/x-www-form-urlencoded\u0027\n```\n\n\n### Relevant Code Snippet\n\nWithin the decoder\u0027s [decode method](https://github.com/gofiber/fiber/blob/v2.52.8/internal/schema/decoder.go#L249):\n\n```go\nidx := parts[0].index\nif v.IsNil() || v.Len() \u003c idx+1 {\n    value := reflect.MakeSlice(t, idx+1, idx+1)  // \u003c-- Panic/crash occurs here when idx is huge\n    if v.Len() \u003c idx+1 {\n        reflect.Copy(value, v)\n    }\n    v.Set(value)\n}\n```\n\nThe `idx` is not validated before use, leading to unsafe slice allocation for extremely large values.\n\n---\n\n### Impact\n\n- Application panic or crash on malicious or malformed input.\n- Potential denial of service (DoS) via memory exhaustion or server crash.\n- Lack of defensive checks in the parsing code causes instability.",
  "id": "GHSA-qx2q-88mx-vhg7",
  "modified": "2025-08-06T14:31:40Z",
  "published": "2025-08-05T15:22:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-qx2q-88mx-vhg7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54801"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gofiber/fiber"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder"
}

GHSA-QXRV-GP6X-RC23

Vulnerability from github – Published: 2024-07-22 17:42 – Updated: 2024-09-11 16:08
VLAI
Summary
SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder
Details

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.

Patches

Has the problem been patched? What versions should users upgrade to?

The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Before calling Image.Decode(Async), use Image.Identify to determine the image dimensions in order to enforce a limit.

References

Are there any links users can visit to find out more? - https://github.com/SixLabors/ImageSharp/pull/2759 - https://github.com/SixLabors/ImageSharp/pull/2764 - https://github.com/SixLabors/ImageSharp/pull/2770 - ImageSharp: Security Considerations - ImageSharp.Web: Securing Processing Commands

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "SixLabors.ImageSharp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "SixLabors.ImageSharp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-41132"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770",
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-22T17:42:33Z",
    "nvd_published_at": "2024-07-22T15:15:04Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThe problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nBefore calling `Image.Decode(Async)`, use `Image.Identify` to determine the image dimensions in order to enforce a limit.\n\n### References\n_Are there any links users can visit to find out more?_\n- https://github.com/SixLabors/ImageSharp/pull/2759\n- https://github.com/SixLabors/ImageSharp/pull/2764\n- https://github.com/SixLabors/ImageSharp/pull/2770\n- ImageSharp: [Security Considerations](https://docs.sixlabors.com/articles/imagesharp/security.html)\n- ImageSharp.Web: [Securing Processing Commands](https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands)",
  "id": "GHSA-qxrv-gp6x-rc23",
  "modified": "2024-09-11T16:08:19Z",
  "published": "2024-07-22T17:42:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-qxrv-gp6x-rc23"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41132"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/pull/2759"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/pull/2764"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/pull/2770"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a"
    },
    {
      "type": "WEB",
      "url": "https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands"
    },
    {
      "type": "WEB",
      "url": "https://docs.sixlabors.com/articles/imagesharp/security.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SixLabors/ImageSharp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder"
}

GHSA-R46P-8F7G-VVVG

Vulnerability from github – Published: 2026-03-23 21:08 – Updated: 2026-05-13 16:16
VLAI
Summary
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
Details

Impact

When serving files through Active Storage's Blobs::ProxyController, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. bytes=0-) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by Hackerone user pirikara

Severity
6.6 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "activestorage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.0.beta1"
            },
            {
              "fixed": "8.1.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "activestorage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0.beta1"
            },
            {
              "fixed": "8.0.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "activestorage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33174"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-23T21:08:54Z",
    "nvd_published_at": "2026-03-24T00:16:28Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nWhen serving files through Active Storage\u0027s `Blobs::ProxyController`, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\n### Credit\nThis issue was responsibly reported by Hackerone user [pirikara](https://hackerone.com/pirikara)",
  "id": "GHSA-r46p-8f7g-vvvg",
  "modified": "2026-05-13T16:16:08Z",
  "published": "2026-03-23T21:08:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33174"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rails/rails"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33174.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests"
}

GHSA-R7PQ-3X6P-7JCM

Vulnerability from github – Published: 2022-06-17 21:45 – Updated: 2022-09-01 20:12
VLAI
Summary
Memory Allocation with Excessive Size Value in OPCFoundation.NetStandard.Opc.Ua.Core
Details

A vulnerability was discovered in the OPC UA .NET Standard Stack that allows a malicious client to cause a server to trigger an out of memory exception with a carefully crafted message.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.4.368.53"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "OPCFoundation.NetStandard.Opc.Ua.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.368.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-29863"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-17T21:45:15Z",
    "nvd_published_at": "2022-06-16T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability was discovered in the OPC UA .NET Standard Stack that allows a malicious client to cause a server to trigger an out of memory exception with a carefully crafted message.",
  "id": "GHSA-r7pq-3x6p-7jcm",
  "modified": "2022-09-01T20:12:37Z",
  "published": "2022-06-17T21:45:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OPCFoundation/UA-.NETStandard/security/advisories/GHSA-r7pq-3x6p-7jcm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29863"
    },
    {
      "type": "WEB",
      "url": "https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29863.pdf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OPCFoundation/UA-.NETStandard"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Memory Allocation with Excessive Size Value in OPCFoundation.NetStandard.Opc.Ua.Core"
}

GHSA-RRH7-4PJ2-XXQ8

Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-05-27 18:31
VLAI
Details

Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.

_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.

A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-9538"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-26T02:16:41Z",
    "severity": "HIGH"
  },
  "details": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry\u0027s payload with $handle-\u003eread($$data, $block), where $block is derived from the entry\u0027s 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.",
  "id": "GHSA-rrh7-4pj2-xxq8",
  "modified": "2026-05-27T18:31:35Z",
  "published": "2026-05-26T13:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9538"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/26/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RRJR-V56M-WW88

Vulnerability from github – Published: 2026-04-24 16:39 – Updated: 2026-05-11 13:29
VLAI
Summary
ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width
Details

DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service.

This affects applications using ParquetSharp to read untrusted Parquet files in a network service.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "ParquetSharp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "18.1.0"
            },
            {
              "fixed": "23.0.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42241"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T16:39:55Z",
    "nvd_published_at": "2026-05-07T20:16:44Z",
    "severity": "MODERATE"
  },
  "details": "`DecimalConverter.ReadDecimal` makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service.\n\nThis affects applications using ParquetSharp to read untrusted Parquet files in a network service.",
  "id": "GHSA-rrjr-v56m-ww88",
  "modified": "2026-05-11T13:29:39Z",
  "published": "2026-04-24T16:39:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42241"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/G-Research/ParquetSharp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width"
}

GHSA-RW3H-MQC5-V5G3

Vulnerability from github – Published: 2025-07-29 18:30 – Updated: 2025-07-29 18:30
VLAI
Details

IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-2533"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-29T18:15:27Z",
    "severity": "MODERATE"
  },
  "details": "IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.",
  "id": "GHSA-rw3h-mqc5-v5g3",
  "modified": "2025-07-29T18:30:35Z",
  "published": "2025-07-29T18:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2533"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7240947"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RWVP-R38J-9RGG

Vulnerability from github – Published: 2025-10-10 12:30 – Updated: 2025-12-11 19:44
VLAI
Summary
rardecode: DoS risk due to unrestricted RAR dictionary sizes
Details

rardecode versions <= 2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nwaples/rardecode/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nwaples/rardecode"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-11579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-11T00:32:44Z",
    "nvd_published_at": "2025-10-10T12:15:37Z",
    "severity": "MODERATE"
  },
  "details": "rardecode versions \u003c= 2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.",
  "id": "GHSA-rwvp-r38j-9rgg",
  "modified": "2025-12-11T19:44:54Z",
  "published": "2025-10-10T12:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11579"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nwaples/rardecode/commit/52fb4e825c936636f251f7e7deded39ab11df9a9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nwaples/rardecode"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-4020"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "rardecode: DoS risk due to unrestricted RAR dictionary sizes"
}

GHSA-V24H-PJJV-MCP6

Vulnerability from github – Published: 2021-05-27 18:44 – Updated: 2023-10-02 12:27
VLAI
Summary
Denial of service in Tendermint
Details

Description

Denial of Service 1

Tendermint 0.33.2 and earlier does not limit the number of P2P connection requests. For each p2p connection, Tendermint allocates XXX bytes. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions.

Tendermint 0.33.3 (and 0.32.10) limits the total number of P2P incoming connection requests to to p2p.max_num_inbound_peers + len(p2p.unconditional_peer_ids).

Notes:

  • Tendermint does not rate limit P2P connection requests per IP (an attacker can saturate all the inbound slots);
  • Tendermint does not rate limit HTTP(S) requests. If you expose any RPC endpoints to the public, please make sure to put in place some protection (https://www.nginx.com/blog/rate-limiting-nginx/). We may implement this in the future (https://github.com/tendermint/tendermint/issues/1696).

Denial of Service 2

Tendermint 0.33.2 and earlier does not reclaim activeID of a peer after it's removed in Mempool reactor. This does not happen all the time. It only happens when a connection fails (for any reason) before the Peer is created and added to all reactors. RemovePeer is therefore called before AddPeer, which leads to always growing memory (activeIDs map). The activeIDs map has a maximum size of 65535 and the node will panic if this map reaches the maximum. An attacker can create a lot of connection attempts (exploiting Denial of Service 1), which ultimately will lead to the node panicking.

Tendermint 0.33.3 (and 0.32.10) claims activeID for a peer in InitPeer, which is executed before MConnection is started.

Notes:

  • InitPeer function was added to all reactors to combat a similar issue - https://github.com/tendermint/tendermint/issues/3338;
  • Denial of Service 2 is independent of Denial of Service 1 and can be executed without it.

Specific Go Packages Affected

github.com/tendermint/tendermint/p2p

Impact

  • All full nodes (except for validators who are behind closed networks)
  • Node's memory usage increases, then it panics either in the mempool or due to OOM.

Patches

  • v0.33.3
  • v0.32.10
  • v0.31.12

Workarounds

No workarounds.

References

  • https://hackerone.com/reports/820317 (not disclosed yet)
  • https://github.com/tendermint/tendermint/issues/3338
  • https://github.com/tendermint/tendermint/issues/1696

For more information

If you have any questions or comments about this advisory: * Open an issue in tendermint/tendermint * Email us at security@tendermint.com

More information can be found here.

Credits

  • fudongbai for discovering and reporting Denial of Service 2
  • Ethan Buchman (@ebuchman) for writing a test case for Denial of Service 2 and Tess Rinearson (@tessr) for fixing it
  • Anton Kaliaev (@melekes) for fixing Denial of Service 1
Severity
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/tendermint/tendermint"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.33.0"
            },
            {
              "fixed": "0.33.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/tendermint/tendermint"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.31.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/tendermint/tendermint"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.32.0"
            },
            {
              "fixed": "0.32.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787",
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-24T21:16:50Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Description\n\n**Denial of Service 1**\n\nTendermint 0.33.2 and earlier does not limit the number of P2P connection requests. For each p2p connection, Tendermint allocates XXX bytes. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions. \n\nTendermint 0.33.3 (and 0.32.10) limits the total number of P2P incoming connection requests to to `p2p.max_num_inbound_peers + len(p2p.unconditional_peer_ids)`.\n\nNotes:\n\n- Tendermint does not rate limit P2P connection requests per IP (an attacker can saturate all the inbound slots);\n- Tendermint does not rate limit HTTP(S) requests. If you expose any RPC endpoints to the public, please make sure to put in place some protection (https://www.nginx.com/blog/rate-limiting-nginx/). We may implement this in the future (https://github.com/tendermint/tendermint/issues/1696).\n\n**Denial of Service 2**\n\nTendermint 0.33.2 and earlier does not reclaim `activeID` of a peer after it\u0027s removed in `Mempool` reactor. This does not happen all the time. It only happens when a connection fails (for any reason) before the `Peer` is created and added to all reactors. `RemovePeer` is therefore called before `AddPeer`, which leads to always growing memory (`activeIDs` map). The `activeIDs` map has a maximum size of 65535 and the node will panic if this map reaches the maximum. An attacker can create a lot of connection attempts (exploiting Denial of Service 1), which ultimately will lead to the node panicking.\n\nTendermint 0.33.3 (and 0.32.10) claims `activeID` for a peer in `InitPeer`, which is executed before `MConnection` is started.\n\nNotes: \n\n- `InitPeer` function was added to all reactors to combat a similar issue - https://github.com/tendermint/tendermint/issues/3338;\n- Denial of Service 2 is independent of Denial of Service 1 and can be executed without it.\n\n### Specific Go Packages Affected\ngithub.com/tendermint/tendermint/p2p\n\n### Impact\n\n- All full nodes (except for validators who are behind closed networks)\n- Node\u0027s memory usage increases, then it panics either in the mempool or due to OOM.\n\n### Patches\n\n- v0.33.3\n- v0.32.10\n- v0.31.12\n\n### Workarounds\n\nNo workarounds.\n\n### References\n\n- https://hackerone.com/reports/820317 (not disclosed yet)\n- https://github.com/tendermint/tendermint/issues/3338\n- https://github.com/tendermint/tendermint/issues/1696\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [tendermint/tendermint](https://github.com/tendermint/tendermint)\n* Email us at [security@tendermint.com](mailto:security@tendermint.com)\n\nMore information can be found [here](https://tendermint.com/security/).\n\n### Credits\n\n- [fudongbai](https://hackerone.com/fudongbai) for discovering and reporting Denial of Service 2\n- Ethan Buchman (@ebuchman) for writing a test case for Denial of Service 2 and Tess Rinearson (@tessr) for fixing it\n- Anton Kaliaev (@melekes) for fixing Denial of Service 1",
  "id": "GHSA-v24h-pjjv-mcp6",
  "modified": "2023-10-02T12:27:32Z",
  "published": "2021-05-27T18:44:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tendermint/tendermint/security/advisories/GHSA-v24h-pjjv-mcp6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5303"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tendermint/tendermint/issues/1696"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tendermint/tendermint/issues/3338"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tendermint/tendermint/commit/e2d6859afd7dba4cf97c7f7d412e7d8fc908d1cd"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/820317"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tendermint/tendermint"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tendermint/tendermint/blob/master/CHANGELOG.md#denial-of-service-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Denial of service in Tendermint"
}
Mitigation
Implementation Architecture and Design

Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.

Mitigation
Operation

Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list