CVE-2026-42931
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
CVSS
6.5
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 13 ago 2026 · Última mod.: 13 ago 2026 · CWE-770
Sin historial EPSS suficiente todavía.
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-198305.3 MED—
———A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component bftpd. The manipulation of the argument USERLIMIT_GLOBAL results in allocation of resources. It is possible to launch the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.9hCVE-2026-728386.5 MED—
———FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.15hCVE-2026-196175.5 MED—
———A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.9hCVE-2026-568627.5 ALT—
———Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.11hCVE-2026-568597.5 ALT—
———Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.11hCVE-2026-568537.5 ALT—
———When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.11h