Résumé
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Détails de l’avis
Summary
Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.
Impact
All wings users who have an egg with a non-file parser configuration file setting.
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-55407
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
- HIGHCVE-2026-71314
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
- HIGHCVE-2026-54448
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
- MEDIUMCVE-2026-71486
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
- HIGHCVE-2026-67446
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
- MEDIUMCVE-2026-73228
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`