CVE-2026-121820

HighCVSS 8.7/10Last modified Nov 10, 2026

Description

A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size before signature validation, allowing an unauthenticated remote attacker to exhaust server memory and cause a denial of service.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

Vendor	Product	Versions
LY Corporation	Armeria	—

References

Timeline

Published: Nov 6, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1218215.3A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path CVE-2026-1218222.4A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross CVE-2026-1218238.7A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthentic CVE-2026-1218248.7A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memo CVE-2026-1218256.1OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provide CVE-2026-121839.8Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability CVE-2026-1218374.3A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @Secur CVE-2026-1218417.3Other issue in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218428.8Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218438.8Privilege escalation in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218488.8The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the cho CVE-2026-121858.6In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bo