CVE-2026-121824

HighCVSS 8.7/10Last modified Nov 10, 2026

Description

A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

Vendor	Product	Versions
LY Corporation	Armeria	>= 1.43.0, < *

References

Timeline

Published: Nov 6, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1218256.1OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provide CVE-2026-121839.8Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability CVE-2026-1218374.3A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @Secur CVE-2026-1218417.3Other issue in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218428.8Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218438.8Privilege escalation in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218488.8The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the cho CVE-2026-121858.6In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bo CVE-2026-1218535.3The AppPresser WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors t CVE-2026-1218574.2The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returni CVE-2026-1218586.3The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries i CVE-2026-121868.8A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/