Most recent entries from all

fkie_cve-2023-54404

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.

GHSA-mrhx-c7xc-m3w5 — Zod can exhaust memory while validating oversized constrained collections

Affected: npm: zod

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.

RHSA-2026:90321 — Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.

zod: zod: Denial of service via unbounded array validation axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function bouncycastle: Bouncy Castle: Denial of Service via untrusted keystore length allocation undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: org.bouncycastle/bc-fips: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction @fastify/static: @fastify/static: Information disclosure via route guard bypass org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests undici: undici: Denial of Service via unrequested WebSocket subprotocol net/mail: golang: Go net/mail: Denial of Service via crafted email inputs github.com/open-teleme…