Alertas de Seguridad de la Información

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56324] Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that a…

Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device_id parameter. Attackers can send multiple requests per second by changing device_id values to flood the channel_devices table and cause database exhaustion.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-48514] MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatt…

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatterBase.Deserialize reads an attacker-controlled byteLength from an extension payload and allocates an array based on that value before validating it against the extension header length or remaining payload bytes. The outer extension header is bounded by available input, but that bound is not used…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-48515] MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CShar…

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's multi-dimensional array formatters read dimension lengths directly from the payload and allocate T[,], T[,,], or T[,,,] before validating that the dimension product matches the encoded element count. The formatter reads a guarded element array header, but allocation of the target multi-dimension…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-48510] MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-…

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large un…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54277] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it …

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS…

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

22/06/2026

[CVE-2026-54283] Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts ma…

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54273] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no …

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54274] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if …

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

22/06/2026

[CVE-2026-42127] The public dashboard query endpoint does not limit request body size before processing, allowing una…

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2025-7737] DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects …

DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E1090, E1090H: before DKCMAIN Ver.93-07-21-80/00-05, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-07-01-80/00-07, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-06-82-80/00-06, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-06-63-80/00-04, CHB(iSCSI)…

nvdaltovulnerabilidad CVSS 8.6 NVD

E Alto vulnerabilidad

17/06/2026

[CVE-2026-47774] Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to vers…

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and denial of service. The issue arises from the co…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

17/06/2026

[CVE-2026-9675] Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumul…

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of servic…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

17/06/2026

[CVE-2026-12151] Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragment…

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory ex…

nvdaltovulnerabilidad CVSS 7.5 NVD

W Alto vulnerabilidad

17/06/2026

[CVE-2026-48779] ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not…

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-50011] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge ini…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-48748] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-46340] Netty is a network application framework for development of protocol servers and clients. In version…

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragm…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-45416] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLengt…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

11/06/2026

[CVE-2026-44250] Netty is a network application framework for development of protocol servers and clients. In netty-c…

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

11/06/2026

[CVE-2026-44890] Netty is a network application framework for development of protocol servers and clients. In netty-c…

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Version…

nvdaltovulnerabilidad CVSS 7.5 NVD