CVE-2021-33910
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdup
CVSS
5.5
Medio
EPSS
8.8%
p95
KEV
—
Exploit Today
29
0-100
Publicado: 20 jul 2021 · Última mod.: 14 oct 2026 · CWE-770
8.8%EPSS · 30 días8.8%
2026-10-012026-10-28
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
- packetstormsecurity.comhttp://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2021/08/04/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2021/08/17/3
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2021/09/07/3
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
- github.comhttps://github.com/systemd/systemd-stable/commit/4a1c5f34bd3e1daed4490e9d97918e504d19733b
- github.comhttps://github.com/systemd/systemd-stable/commit/764b74113e36ac5219a4b82a05f311b5a92136ce
- github.comhttps://github.com/systemd/systemd-stable/commit/b00674347337b7531c92fdb65590ab253bb57538
- github.comhttps://github.com/systemd/systemd-stable/commit/cfd14c65374027b34dbbc4f0551456c5dc2d1f61
- github.comhttps://github.com/systemd/systemd/commit/b34a4f0e6729de292cb3b0c03c1d48f246ad896b
- github.comhttps://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2LSDMHAKI4LGFOCSPXNVVSEWQFAVFWR7/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/
- security.gentoo.orghttps://security.gentoo.org/glsa/202107-48
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20211104-0008/
- www.debian.orghttps://www.debian.org/security/2021/dsa-4942
- www.openwall.comhttps://www.openwall.com/lists/oss-security/2021/07/20/2
- packetstormsecurity.comhttp://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2021/08/04/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2021/08/17/3
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-107312——
———Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.3hCVE-2026-119209——
———pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.10hCVE-2026-909916.5 MED—
———IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.13hCVE-2026-1191346.2 MED—
———Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.10hCVE-2026-1191197.5 ALT—
———Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.15hCVE-2026-1190515.9 MED—
———flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.15h