Monthly
Unbounded memory leak in the msgpack-python C extension (msgpack._cmsgpack) allows a remote attacker to exhaust process memory by repeatedly sending malformed MessagePack maps, with approximately 4 MiB retained per failed parse and roughly 100 MiB after 25 failed parses as measured by the reporter. The flaw is triggered when strict_map_key=True (the default) rejects a map key that is neither str nor bytes: the decoded value has already been constructed and is never released, affecting both unpackb() and the streaming Unpacker API in releases up to 1.2.2. No public exploit code or active exploitation is identified in the available data, but the CVSS of 7.5 is availability-only (C:N/I:N/A:H), so impact is limited to denial of service rather than data disclosure or code execution; a public proof-of-concept reference exists in the advisory, though it is not verified as working exploit code.
Memory exhaustion in the Perl JSON module Cpanel::JSON::XS before 4.80 lets unauthenticated remote input strand allocations of a size the sender chooses inside a long-running process. The leak is conditional: the application must enable the non-default allow_tags option, register a class whose THAW method dies on attacker-supplied tagged input, and catch the resulting decode error so the process keeps running - only then does each rejected document accumulate in memory. No public exploit identified at time of analysis, no CISA KEV entry, and EPSS is 0.17% (6th percentile), but the vuln.today decision label is act_now; note that the headline CVSS 9.1 includes C:H, which the CWE-401 missing-release root cause does not support, and the realistic impact is availability only.
Cpanel::JSON::XS, a Perl JSON encoder/decoder, leaks memory in its encode_stringify path across versions 3.0202 through 4.7x: encoding a blessed object that carries a "" (stringification) overload and is handled via allow_stringify, convert_blessed (for objects without TO_JSON) or allow_bignum takes an extra reference that is never released, so the object and everything it references stays alive forever - and from 4.10 the module also never frees its own copy of the stringified value. Affected applications are those that enable one of those non-default stringify options and repeatedly encode structures containing such overloaded blessed objects inside a long-lived process, where memory grows without bound until exhaustion. The supplied CVSS 8.1 score overstates real-world risk and its confidentiality metric does not match the observed mechanism; the assessed severity is an availability-only denial-of-service condition (AC:H, PR:N, C:N), with no public exploit code identified at time of analysis and a very low EPSS of 0.17% (6th percentile).
Memory exhaustion in Cpanel::JSON::XS 4.28 through 4.79 allows unauthenticated remote attackers to grow a Perl process's memory without bound when an application explicitly enables the non-default dupkeys_as_arrayref option and decodes attacker-supplied JSON containing a duplicate object key with a large value. Each decode, including one that fails after encountering a duplicate key, leaks the array that collects the duplicate values along with everything stored in it, so repeated decoding eventually exhausts process memory. Exposure is confined to deployments that opt into dupkeys_as_arrayref, EPSS is 0.17% (6th percentile), and no public exploit identified at time of analysis.
Memory exhaustion in Cpanel::JSON::XS versions before 4.80 lets unauthenticated remote attackers gradually consume the memory of a long-running Perl process by repeatedly supplying JSON documents that are rejected during object decoding. Each rejected document leaks a single decoded key scalar - only for keys of 24 bytes or more, or keys containing a non-ASCII byte or an escape sequence - so a daemon, mod_perl/Plack worker or job consumer that survives the failed decode accumulates one sender-sized key per request until the process exhausts memory; short-lived CGI processes that exit per request do not accumulate the leak. The vendor fix is version 4.80, EPSS is low at 0.17%, and no public exploit was identified at the time of analysis.
Memory exhaustion in the Juniper Networks Junos OS and Junos OS Evolved l2cpd process allows an unauthenticated attacker on the same Layer 2 segment to disrupt Layer 2 control-plane operations by sending LLDP traffic, but only when the non-default LLDP fast-receive-processing feature is enabled. No authentication or user interaction is required, and the impact is limited to availability (CVSS 3.1 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect. A vendor patch is available through Juniper advisory JSA112187, and no public exploit code has been identified at time of analysis.
Memory exhaustion in the l2ald (Layer 2 address learning) daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a denial of service against the device by sending crafted packets, but only when the non-default static MAC-IP EVPN feature is configured. The flaw is tracked as CWE-401 (Missing Release of Memory after Effective Lifetime), meaning the daemon fails to free memory it has allocated, so repeated crafted traffic can drain resources and disrupt the l2ald process; per the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) impact is availability-only and the attacker must sit on the same Layer-2 segment as the target. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is limited because the static MAC-IP feature is not enabled by default and routed/remote attackers cannot reach the vulnerable path.
Sustained high connections-per-second churn can drive a per-session memory leak in the packet forwarding engine (PFE) of Juniper Junos OS, exhausting PFE memory and causing a complete denial of service on SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3. The flaw is reachable by unauthenticated, network-based remote attackers (CVSS vector includes PR:N/UI:N, so no credentials or user interaction are required), but only on devices where at least one application service such as ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE is actually configured. Affected releases are 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2/25.2R2; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
Memory exhaustion in the Windows DHCP Client service allows an unauthenticated attacker who can deliver crafted DHCP responses to progressively degrade or deny service on Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core installations). The vulnerability is availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with no data exposure or code execution, and the effect builds gradually as leaked memory accumulates rather than causing an immediate crash. There is no public exploit identified at time of analysis and CISA SSVC records no observed exploitation, but the attack is rated automatable, so hosts that have not been updated past their fixed build remain a practical target for anyone positioned to answer DHCP traffic on the local segment; vendor-released patches are available.
A memory-leak flaw (CWE-401) in the Microsoft Windows DNS Server service lets an unauthenticated, remote attacker gradually exhaust server memory by sending repeated DNS queries, ultimately degrading or denying DNS resolution on affected hosts. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H), no credentials or user interaction are required, and any default DNS-server deployment reachable on the network is exposed; however, this is a slow resource-exhaustion condition rather than an instantaneous crash, so the practical impact scales with sustained traffic and available memory. An independent assessment rates this as a genuine but second-tier priority: SSVC indicates no known exploitation, no publicly available exploit code has been identified at time of analysis, and a vendor patch is available, making timely patching the decisive control.
Unbounded memory leak in the msgpack-python C extension (msgpack._cmsgpack) allows a remote attacker to exhaust process memory by repeatedly sending malformed MessagePack maps, with approximately 4 MiB retained per failed parse and roughly 100 MiB after 25 failed parses as measured by the reporter. The flaw is triggered when strict_map_key=True (the default) rejects a map key that is neither str nor bytes: the decoded value has already been constructed and is never released, affecting both unpackb() and the streaming Unpacker API in releases up to 1.2.2. No public exploit code or active exploitation is identified in the available data, but the CVSS of 7.5 is availability-only (C:N/I:N/A:H), so impact is limited to denial of service rather than data disclosure or code execution; a public proof-of-concept reference exists in the advisory, though it is not verified as working exploit code.
Memory exhaustion in the Perl JSON module Cpanel::JSON::XS before 4.80 lets unauthenticated remote input strand allocations of a size the sender chooses inside a long-running process. The leak is conditional: the application must enable the non-default allow_tags option, register a class whose THAW method dies on attacker-supplied tagged input, and catch the resulting decode error so the process keeps running - only then does each rejected document accumulate in memory. No public exploit identified at time of analysis, no CISA KEV entry, and EPSS is 0.17% (6th percentile), but the vuln.today decision label is act_now; note that the headline CVSS 9.1 includes C:H, which the CWE-401 missing-release root cause does not support, and the realistic impact is availability only.
Cpanel::JSON::XS, a Perl JSON encoder/decoder, leaks memory in its encode_stringify path across versions 3.0202 through 4.7x: encoding a blessed object that carries a "" (stringification) overload and is handled via allow_stringify, convert_blessed (for objects without TO_JSON) or allow_bignum takes an extra reference that is never released, so the object and everything it references stays alive forever - and from 4.10 the module also never frees its own copy of the stringified value. Affected applications are those that enable one of those non-default stringify options and repeatedly encode structures containing such overloaded blessed objects inside a long-lived process, where memory grows without bound until exhaustion. The supplied CVSS 8.1 score overstates real-world risk and its confidentiality metric does not match the observed mechanism; the assessed severity is an availability-only denial-of-service condition (AC:H, PR:N, C:N), with no public exploit code identified at time of analysis and a very low EPSS of 0.17% (6th percentile).
Memory exhaustion in Cpanel::JSON::XS 4.28 through 4.79 allows unauthenticated remote attackers to grow a Perl process's memory without bound when an application explicitly enables the non-default dupkeys_as_arrayref option and decodes attacker-supplied JSON containing a duplicate object key with a large value. Each decode, including one that fails after encountering a duplicate key, leaks the array that collects the duplicate values along with everything stored in it, so repeated decoding eventually exhausts process memory. Exposure is confined to deployments that opt into dupkeys_as_arrayref, EPSS is 0.17% (6th percentile), and no public exploit identified at time of analysis.
Memory exhaustion in Cpanel::JSON::XS versions before 4.80 lets unauthenticated remote attackers gradually consume the memory of a long-running Perl process by repeatedly supplying JSON documents that are rejected during object decoding. Each rejected document leaks a single decoded key scalar - only for keys of 24 bytes or more, or keys containing a non-ASCII byte or an escape sequence - so a daemon, mod_perl/Plack worker or job consumer that survives the failed decode accumulates one sender-sized key per request until the process exhausts memory; short-lived CGI processes that exit per request do not accumulate the leak. The vendor fix is version 4.80, EPSS is low at 0.17%, and no public exploit was identified at the time of analysis.
Memory exhaustion in the Juniper Networks Junos OS and Junos OS Evolved l2cpd process allows an unauthenticated attacker on the same Layer 2 segment to disrupt Layer 2 control-plane operations by sending LLDP traffic, but only when the non-default LLDP fast-receive-processing feature is enabled. No authentication or user interaction is required, and the impact is limited to availability (CVSS 3.1 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect. A vendor patch is available through Juniper advisory JSA112187, and no public exploit code has been identified at time of analysis.
Memory exhaustion in the l2ald (Layer 2 address learning) daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a denial of service against the device by sending crafted packets, but only when the non-default static MAC-IP EVPN feature is configured. The flaw is tracked as CWE-401 (Missing Release of Memory after Effective Lifetime), meaning the daemon fails to free memory it has allocated, so repeated crafted traffic can drain resources and disrupt the l2ald process; per the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) impact is availability-only and the attacker must sit on the same Layer-2 segment as the target. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is limited because the static MAC-IP feature is not enabled by default and routed/remote attackers cannot reach the vulnerable path.
Sustained high connections-per-second churn can drive a per-session memory leak in the packet forwarding engine (PFE) of Juniper Junos OS, exhausting PFE memory and causing a complete denial of service on SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3. The flaw is reachable by unauthenticated, network-based remote attackers (CVSS vector includes PR:N/UI:N, so no credentials or user interaction are required), but only on devices where at least one application service such as ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE is actually configured. Affected releases are 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2/25.2R2; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
Memory exhaustion in the Windows DHCP Client service allows an unauthenticated attacker who can deliver crafted DHCP responses to progressively degrade or deny service on Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core installations). The vulnerability is availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with no data exposure or code execution, and the effect builds gradually as leaked memory accumulates rather than causing an immediate crash. There is no public exploit identified at time of analysis and CISA SSVC records no observed exploitation, but the attack is rated automatable, so hosts that have not been updated past their fixed build remain a practical target for anyone positioned to answer DHCP traffic on the local segment; vendor-released patches are available.
A memory-leak flaw (CWE-401) in the Microsoft Windows DNS Server service lets an unauthenticated, remote attacker gradually exhaust server memory by sending repeated DNS queries, ultimately degrading or denying DNS resolution on affected hosts. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H), no credentials or user interaction are required, and any default DNS-server deployment reachable on the network is exposed; however, this is a slow resource-exhaustion condition rather than an instantaneous crash, so the practical impact scales with sustained traffic and available memory. An independent assessment rates this as a genuine but second-tier priority: SSVC indicates no known exploitation, no publicly available exploit code has been identified at time of analysis, and a vendor patch is available, making timely patching the decisive control.