CVE-2026-120440
Description
A flaw was found in QuickJS-NG. This vulnerability allows an attacker capable of running JavaScript code to cause a Denial of Service (DoS) through memory exhaustion. The issue occurs when the JavaScript engine fails to release allocated memory upon encountering an error during atomic storage operations. By repeatedly executing these operations with manipulated memory buffers, an attacker can exhaust system memory, causing the application to crash or become unresponsive.
Statement
Red Hat has evaluated this vulnerability as having a Moderate impact because triggering the memory exhaustion requires an attacker to supply and execute untrusted JavaScript code, limiting the blast radius to a denial of service without integrity or confidentiality loss. QuickJS-NG is not shipped as part of core Red Hat Enterprise Linux distributions and is primarily utilized within community repositories or specialized analysis utilities. Applications embedding this engine remain unaffected unless they process unvetted scripts without memory allocation limits.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
