Monthly
Stack-based buffer overflow in GNU libextractor before 1.15 allows remote, unauthenticated attackers to crash any application that uses libextractor to extract metadata from a crafted StarOffice document. The vulnerability resides in the process_star_office function, which allocates a variable-length stack array sized from attacker-controlled OLE2 stream data - enabling up to 4 MB of forced stack allocation, exhausting stack space and causing a process crash. A publicly available exploit exists (referenced as libextractor-ole2-rce on GitHub), and a vendor patch has been released in version 1.15, though no CISA KEV listing has been identified at time of analysis.
Unauthenticated remote memory exhaustion in Apache Storm Worker (org.apache.storm:storm-client 3.0.0-3.0.x) allows any TCP peer reachable to a worker slot port to drive arbitrarily large JVM heap allocations with a single crafted frame. The Netty pipeline installs the message decoder ahead of SASL authentication handlers, and the default value of storm.messaging.netty.authentication is false, meaning no credentials are required regardless of configuration. Impact is availability-only - worker process crash or severe GC pressure at the 768 MB default heap - with no code execution or data exfiltration path. No public exploit has been identified at time of analysis; the vulnerability was discovered via automated Claude agent security research and validated by the Apache Storm project.
SymSpellModelSerializer in Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 crashes the host JVM with an OutOfMemoryError when deserializing a crafted SymSpell binary model file whose unigramCount or bigramCount field is set to Integer.MAX_VALUE, forcing a 4-8 GB heap allocation attempt. The root cause (CWE-789: Uncontrolled Memory Allocation) is that these two 32-bit count fields are validated only for non-negativity - no upper bound prevents attacker-controlled pre-sizing of a LinkedHashMap before any dictionary entries are consumed. The attack payload is described by the advisory as under 100 bytes, requires no prior authentication if the target application accepts externally supplied model bytes, and is effective against every deserialization code path in the opennlp-spellcheck extension. No public exploit has been identified at time of analysis, and exposure is substantially limited to the small population running pre-release milestone builds.
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or host memory and permanently block request handlers by sending UploadPart requests that declare a large Content-Length but deliver no body bytes. The handler in cmd/serve/s3/multipart.go pre-allocates lib/pool pages sized to the attacker-controlled Content-Length header before any body bytes arrive, and the waitForTurn scheduling mechanism admits one additional oversized part even when --multipart-streaming-buffer-limit is active, partially bypassing the intended cap. The issue is fixed in rclone v1.75.1; no public exploit or CISA KEV listing has been identified.
Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system memory by sending crafted mux packets with arbitrarily large declared packet counts to the Demuxer::addMuxPacket() function. The demultiplexer trusts the integer value in the mux header without a ceiling, causing the process to reserve memory for each declared packet slot. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed by CISA KEV.
Uncontrolled memory allocation in MOOS core-moos through 10.4.0 exposes MOOSDB servers to pre-authentication denial of service. The CMOOSCommPkt::OnBytesWritten() function reads the packet length field directly from untrusted wire data and passes it without any upper-bound check to new unsigned char[], allowing unbounded heap allocation before any client authentication handshake occurs. An unauthenticated network attacker can craft packets with arbitrarily large declared lengths to exhaust server memory and crash the MOOSDB process; no public exploit has been identified at time of analysis, and an upstream patch is available via GitHub commit e7ea624.
Uncontrolled memory allocation in the jahlives openssl_encrypt PHP library (versions before 1.4.9) exposes any application processing QR codes to remote denial of service. The library fails to validate the 'total' field within QR JSON payloads before allocating memory for range materialization, allowing an unauthenticated attacker to supply a crafted QR image containing an arbitrarily large 'total' value and exhaust host memory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is low-complexity and requires no authentication, making automated exploitation plausible against any internet-facing service that accepts QR input.
Uncontrolled memory allocation in the openssl-encrypt Python package (pip, versions ≤1.4.8) exposes any service invoking its `decrypt --stego-extract` command to unauthenticated denial of service via a crafted FLAC file. The STREAMINFO total_samples field - a 36-bit value fully controlled by the file author - is passed without bounds validation directly to NumPy as an array dimension, causing allocations of tens of gigabytes from a ~50-byte input. A vendor-released patch exists in version 1.4.9; no public exploit code has been identified at time of analysis, though the attack requires no authentication and minimal complexity.
Remote denial-of-service in vouch-proxy v0.47.2 and earlier crashes the server process with a single unauthenticated HTTP request. The /validate endpoint's multipart cookie reassembly routine in pkg/cookie/cookie.go parses the total part count directly from the attacker-controlled Cookie header name - an N value of 10 billion passed as VouchCookie_1of10000000000 triggers a make([]string, N) call requesting approximately 160 GB of heap, immediately raising a Go runtime fatal out-of-memory error. No authentication, session token, or prior interaction is required; a fully working PoC with Docker reproduction artifacts is publicly disclosed in the GitHub Security Advisory, though no CISA KEV listing is confirmed at time of analysis.
Uncontrolled heap memory preallocation in Amazon ion-java's binary Ion stream cursor exposes any application parsing untrusted Ion binary data to remote denial of service. Versions 1.9.0 through 1.11.x are affected; a crafted Ion binary document with an inflated declared-length field forces the JVM to preallocate excessive heap memory before input validation occurs, exhausting available resources and crashing the host service. No public exploit code has been identified, but the CVSS 4.0 vector confirms unauthenticated remote exploitation with low complexity, and a vendor-released patch is available in version 1.12.0.
Stack-based buffer overflow in GNU libextractor before 1.15 allows remote, unauthenticated attackers to crash any application that uses libextractor to extract metadata from a crafted StarOffice document. The vulnerability resides in the process_star_office function, which allocates a variable-length stack array sized from attacker-controlled OLE2 stream data - enabling up to 4 MB of forced stack allocation, exhausting stack space and causing a process crash. A publicly available exploit exists (referenced as libextractor-ole2-rce on GitHub), and a vendor patch has been released in version 1.15, though no CISA KEV listing has been identified at time of analysis.
Unauthenticated remote memory exhaustion in Apache Storm Worker (org.apache.storm:storm-client 3.0.0-3.0.x) allows any TCP peer reachable to a worker slot port to drive arbitrarily large JVM heap allocations with a single crafted frame. The Netty pipeline installs the message decoder ahead of SASL authentication handlers, and the default value of storm.messaging.netty.authentication is false, meaning no credentials are required regardless of configuration. Impact is availability-only - worker process crash or severe GC pressure at the 768 MB default heap - with no code execution or data exfiltration path. No public exploit has been identified at time of analysis; the vulnerability was discovered via automated Claude agent security research and validated by the Apache Storm project.
SymSpellModelSerializer in Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 crashes the host JVM with an OutOfMemoryError when deserializing a crafted SymSpell binary model file whose unigramCount or bigramCount field is set to Integer.MAX_VALUE, forcing a 4-8 GB heap allocation attempt. The root cause (CWE-789: Uncontrolled Memory Allocation) is that these two 32-bit count fields are validated only for non-negativity - no upper bound prevents attacker-controlled pre-sizing of a LinkedHashMap before any dictionary entries are consumed. The attack payload is described by the advisory as under 100 bytes, requires no prior authentication if the target application accepts externally supplied model bytes, and is effective against every deserialization code path in the opennlp-spellcheck extension. No public exploit has been identified at time of analysis, and exposure is substantially limited to the small population running pre-release milestone builds.
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or host memory and permanently block request handlers by sending UploadPart requests that declare a large Content-Length but deliver no body bytes. The handler in cmd/serve/s3/multipart.go pre-allocates lib/pool pages sized to the attacker-controlled Content-Length header before any body bytes arrive, and the waitForTurn scheduling mechanism admits one additional oversized part even when --multipart-streaming-buffer-limit is active, partially bypassing the intended cap. The issue is fixed in rclone v1.75.1; no public exploit or CISA KEV listing has been identified.
Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system memory by sending crafted mux packets with arbitrarily large declared packet counts to the Demuxer::addMuxPacket() function. The demultiplexer trusts the integer value in the mux header without a ceiling, causing the process to reserve memory for each declared packet slot. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed by CISA KEV.
Uncontrolled memory allocation in MOOS core-moos through 10.4.0 exposes MOOSDB servers to pre-authentication denial of service. The CMOOSCommPkt::OnBytesWritten() function reads the packet length field directly from untrusted wire data and passes it without any upper-bound check to new unsigned char[], allowing unbounded heap allocation before any client authentication handshake occurs. An unauthenticated network attacker can craft packets with arbitrarily large declared lengths to exhaust server memory and crash the MOOSDB process; no public exploit has been identified at time of analysis, and an upstream patch is available via GitHub commit e7ea624.
Uncontrolled memory allocation in the jahlives openssl_encrypt PHP library (versions before 1.4.9) exposes any application processing QR codes to remote denial of service. The library fails to validate the 'total' field within QR JSON payloads before allocating memory for range materialization, allowing an unauthenticated attacker to supply a crafted QR image containing an arbitrarily large 'total' value and exhaust host memory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is low-complexity and requires no authentication, making automated exploitation plausible against any internet-facing service that accepts QR input.
Uncontrolled memory allocation in the openssl-encrypt Python package (pip, versions ≤1.4.8) exposes any service invoking its `decrypt --stego-extract` command to unauthenticated denial of service via a crafted FLAC file. The STREAMINFO total_samples field - a 36-bit value fully controlled by the file author - is passed without bounds validation directly to NumPy as an array dimension, causing allocations of tens of gigabytes from a ~50-byte input. A vendor-released patch exists in version 1.4.9; no public exploit code has been identified at time of analysis, though the attack requires no authentication and minimal complexity.
Remote denial-of-service in vouch-proxy v0.47.2 and earlier crashes the server process with a single unauthenticated HTTP request. The /validate endpoint's multipart cookie reassembly routine in pkg/cookie/cookie.go parses the total part count directly from the attacker-controlled Cookie header name - an N value of 10 billion passed as VouchCookie_1of10000000000 triggers a make([]string, N) call requesting approximately 160 GB of heap, immediately raising a Go runtime fatal out-of-memory error. No authentication, session token, or prior interaction is required; a fully working PoC with Docker reproduction artifacts is publicly disclosed in the GitHub Security Advisory, though no CISA KEV listing is confirmed at time of analysis.
Uncontrolled heap memory preallocation in Amazon ion-java's binary Ion stream cursor exposes any application parsing untrusted Ion binary data to remote denial of service. Versions 1.9.0 through 1.11.x are affected; a crafted Ion binary document with an inflated declared-length field forces the JVM to preallocate excessive heap memory before input validation occurs, exhausting available resources and crashing the host service. No public exploit code has been identified, but the CVSS 4.0 vector confirms unauthenticated remote exploitation with low complexity, and a vendor-released patch is available in version 1.12.0.