PULSEUnderground Intel

EN VIVO23señales / 24h

FEED

ransomincransom reclama a q-technicians.be · BE · Professional Servicesransomincransom reclama a bpcm.com · US · Professional Servicesransomincransom reclama a www.bogard.com.mx · MX · Otherransomwhitearmor reclama a Clínica La Sagrada Familia (Colombia) · CO · Healthcareransombyod reclama a ???ransombyod reclama a Twitter · US · Technologyransomn0n reclama a Company #147 · USransomn0n reclama a Company #146 · USransomn0n reclama a Company #145 · USransomn0n reclama a Company #144 · USransomn0n reclama a Company #143 · USransomn0n reclama a Company #142 · KRransomn0n reclama a Company #141 · USransomn0n reclama a Company #140 · CAransomincransom reclama a q-technicians.be · BE · Professional Servicesransomincransom reclama a bpcm.com · US · Professional Servicesransomincransom reclama a www.bogard.com.mx · MX · Otherransomwhitearmor reclama a Clínica La Sagrada Familia (Colombia) · CO · Healthcareransombyod reclama a ???ransombyod reclama a Twitter · US · Technologyransomn0n reclama a Company #147 · USransomn0n reclama a Company #146 · USransomn0n reclama a Company #145 · USransomn0n reclama a Company #144 · USransomn0n reclama a Company #143 · USransomn0n reclama a Company #142 · KRransomn0n reclama a Company #141 · USransomn0n reclama a Company #140 · CA

← Todos los CVEs

CVE Watch30 oct 2026

CVE-2026-61902

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsi

CVSS

7.5

Alto

EPSS

0.5%

p42

KEV

—

Exploit Today

12

0-100

Publicado: 21 oct 2026 · Última mod.: 30 oct 2026 · CWE-400

EPSS · 30d

0.2%EPSS · 30 días0.5%

2026-10-222026-11-07

Descripción técnica

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. Users should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering.

Referencias oficiales

lists.apache.orghttps://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1236067.5 ALT

———The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.12h CVE-2026-1235867.5 ALT

———Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.12h CVE-2026-1235855.3 MED

———The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.12h CVE-2026-1235707.5 ALT

———The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.12h CVE-2026-1235667.5 ALT

———Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop.12h CVE-2026-1235657.5 ALT

———Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU.12h