Summary
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Advisory details
Summary
Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.
Impact
All wings users who have an egg with a non-file parser configuration file setting.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-55407
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
- HIGHCVE-2026-71314
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
- HIGHCVE-2026-54448
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
- MEDIUMCVE-2026-71486
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
- HIGHCVE-2026-67446
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
- MEDIUMCVE-2026-73228
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`