CWE-1325

26 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

Critical 2High 8Medium 16Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-109619
RCE via stale global state
PHP Group · PHP
ExploitedCritical9.2
CVE-2026-109618
RCE via OOM corruption
PHP Group · PHP
ExploitedCritical9.2
CVE-2026-92707
MessagePack: Nested arrays can blow past buffer length limits
MessagePack-CSharp · MessagePack-CSharp
Medium5.3
CVE-2026-96421
Improperly Controlled Sequential Memory Allocation in Wireshark
Wireshark Foundation · Wireshark
Medium5.5
CVE-2026-71436
Mermaid XY Charts are vulnerable to an infinite loop DoS
mermaid-js · mermaid
Medium5.3
CVE-2026-18772
Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.
Samsung Open Source · rlottie
Medium6.5
CVE-2026-54081
veraPDF Parser DoS via PostScript Type 1 Font Programs
veraPDF · veraPDF-parser
Medium6.9
CVE-2026-54080
veraPDF Parser DoS via PostScript CMap Streams
veraPDF · veraPDF-parser
Medium6.9
CVE-2026-13056
A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM
MongoDB · MongoDB Server
High7.1
CVE-2026-34183
Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler
OpenSSL · OpenSSL
High7.5