# CWE-1050. Every Advisory and CVE whose sources give the weakness CWE-1050, newest first. ## Records, newest first - [Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding](https://agentprime.io/advisories/CVE-2026-85977.md) `CVE-2026-85977` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-1050 - [kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression](https://agentprime.io/advisories/GHSA-h4r5-mxv5-8mjc.md) `GHSA-h4r5-mxv5-8mjc`, `CVE-2026-100350`, `GO-2026-6787` · Go `github.com/getkin/kin-openapi`: affected `>=0.145.0, <0.146.0`, fixed in `0.146.0` · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service, CWE-1050 - [Denial of service via unsigned underflow in libXpm's write path](https://agentprime.io/advisories/CVE-2026-94287.md) `CVE-2026-94287` · CVE record: x.org libXpm · CVSS 5.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-1050 - [Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees](https://agentprime.io/advisories/CVE-2026-81736.md) `CVE-2026-81736` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-1050 - [league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension](https://agentprime.io/advisories/GHSA-8rr7-cvq3-gmfh.md) `GHSA-8rr7-cvq3-gmfh`, `CVE-2026-86428`, `PKSA-zyf5-hrxv-hrd7` · Packagist `league/commonmark`: affected `>=1.5.0, <2.10.0`, fixed in `2.10.0` · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service, CWE-1050 - [league/commonmark: Denial of service in the SmartPunct and Attributes extensions](https://agentprime.io/advisories/GHSA-jjv6-8j6v-6j52.md) `GHSA-jjv6-8j6v-6j52`, `CVE-2026-86429`, `PKSA-nv44-1b4d-6gjg` · Packagist `league/commonmark`: affected `>=1.5.0, <2.9.1`, fixed in `2.9.1` · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service, CWE-1050 - [league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters](https://agentprime.io/advisories/GHSA-j8pm-gj4c-rq4x.md) `GHSA-j8pm-gj4c-rq4x`, `CVE-2026-86430`, `PKSA-9q1p-3s19-bp1q` · Packagist `league/commonmark`: affected `>=0.6.0, <2.9.1`, fixed in `2.9.1` · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service, CWE-1050 - [Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script.](https://agentprime.io/advisories/CVE-2026-52681.md) `CVE-2026-52681` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 3.1 Low · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-1050 - [league/commonmark: Quadratic-time denial of service when parsing crafted Markdown](https://agentprime.io/advisories/GHSA-2q4p-g7hv-5rgv.md) `GHSA-2q4p-g7hv-5rgv`, `CVE-2026-71488`, `PKSA-t21r-vtr5-3mdz` · Packagist `league/commonmark`: affected `>=0.6.0, <2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service, CWE-1050 - [ws: Memory exhaustion DoS from tiny fragments and data chunks](https://agentprime.io/advisories/GHSA-96hv-2xvq-fx4p.md) `GHSA-96hv-2xvq-fx4p`, `CVE-2026-48779` · npm `ws`: affected `>=1.1.0, <5.2.5 || >=6.0.0, <6.2.4 || >=7.0.0, <7.5.11 || >=8.0.0, <8.21.0`, fixed in `5.2.5`, `6.2.4`, `7.5.11`, `8.21.0` · CVSS 7.5 High · Not analysed yet · Published 15 Jun 2026 · Tags: Denial of service, CWE-1050 - [Unbounded name compression in certain cases causes degradation of service](https://agentprime.io/advisories/CVE-2026-44390.md) `CVE-2026-44390` · CVE record: NLnet Labs Unbound · CVSS 6.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: Denial of service, CWE-1050 - [Long list of incoming EDNS options degrades performance](https://agentprime.io/advisories/CVE-2026-41292.md) `CVE-2026-41292` · CVE record: NLnet Labs Unbound · CVSS 6.6 Medium · Not analysed yet · Published 20 May 2026 · Tags: Denial of service, CWE-1050 - [Keycloak: Application-Level DoS via Scope Processing](https://agentprime.io/advisories/GHSA-h4wv-g838-66g3.md) `GHSA-h4wv-g838-66g3`, `BIT-keycloak-2026-4634`, `CVE-2026-4634` · Maven `org.keycloak:keycloak-services`: affected `<26.5.7`, fixed in `26.5.7` · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-1050 - [Suricata http1: quadratic complexity in headers parsing over multiple packets](https://agentprime.io/advisories/CVE-2026-22263.md) `CVE-2026-22263` · CVE record: OISF suricata · CVSS 5.3 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-1050 - [Suricata eve/alert: http1 xff handling can lead to denial of service](https://agentprime.io/advisories/CVE-2026-22261.md) `CVE-2026-22261` · CVE record: OISF suricata · CVSS 3.7 Low · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-1050 - [evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API](https://agentprime.io/advisories/GHSA-m2q5-xhqg-92r2.md) `GHSA-m2q5-xhqg-92r2`, `CVE-2025-67419` · npm `@evershop/evershop`: affected `<=2.1.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 5 Jan 2026 · Tags: CWE-1050 - [ModSecurity has possible DoS vulnerability in sanitiseArg action](https://agentprime.io/advisories/CVE-2025-48866.md) `CVE-2025-48866` · CVE record: owasp-modsecurity ModSecurity · CVSS 7.5 High · Not analysed yet · Published 2 Jun 2025 · Tags: CWE-1050 - [ModSecurity Has Possible DoS Vulnerability](https://agentprime.io/advisories/CVE-2025-47947.md) `CVE-2025-47947` · CVE record: owasp-modsecurity ModSecurity · CVSS 7.5 High · Not analysed yet · Published 21 May 2025 · Tags: CWE-1050 - [Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header](https://agentprime.io/advisories/CVE-2025-32907.md) `CVE-2025-32907` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Apr 2025 · Tags: CWE-1050 - [Uncontrolled resource consumption in braces](https://agentprime.io/advisories/GHSA-grv7-fg5c-xmjg.md) `GHSA-grv7-fg5c-xmjg`, `CVE-2024-4068` · npm `braces`: affected `<3.0.3`, fixed in `3.0.3` · CVSS 7.5 High · Not analysed yet · Published 14 May 2024 · Tags: Denial of service, CWE-1050 - [A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module.](https://agentprime.io/advisories/CVE-2023-1390.md) `CVE-2023-1390` · CVE record: Linux kernel (TIPC kernel module) · CVSS 7.5 High · Not analysed yet · Published 16 Mar 2023 · Tags: CWE-1050 - [Excessive Platform Resource Consumption within a Loop in Kubernetes](https://agentprime.io/advisories/GHSA-wxc4-f4m6-wwqv.md) `GHSA-wxc4-f4m6-wwqv`, `CVE-2019-11254`, `GO-2020-0036` · Go `github.com/go-yaml/yaml` and 1 more: affected `<=2.1.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 20 Dec 2021 · Tags: CWE-1050 - [The Eclipse Foundation Eclipse Mosquitto: In versions 1.6 to 2.0.11 of Eclipse Mosquitto…](https://agentprime.io/advisories/CVE-2021-41039.md) `CVE-2021-41039` · CVE record: The Eclipse Foundation Eclipse Mosquitto · No CVSS score · Not analysed yet · Published 1 Dec 2021 · Tags: CWE-1050 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .