Advisories · Weakness
CWE-405.
Every Advisory and CVE whose sources give the weakness CWE-405, newest first.
- CVSS 6.9 Medium
minimatch has potential denial of service via globparts amplification
- CWE-405
>=7.0.0, <11.0.1 · fixed in 11.0.1
GHSA-g3hv-75wg-m249 · CVE-2026-118764 - CVSS 7.1 High
pypdf has possible large memory usage for exceptions in strict mode
- Denial of service
- CWE-405
<6.21.3 · fixed in 6.21.3
GHSA-4vqv-7265-gm2w · CVE-2026-119207 - CVSS 5.9 Medium
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
- Denial of service
- CWE-405
>=5.15.0, <6.29.1 || >=7.0.0, <7.30.1 || >=8.0.0, <8.12.2 · fixed in 6.29.1, 7.30.1, 8.12.2
GHSA-9fm3-97px-rjf6 · CVE-2026-109932 - CVSS 7.5 High
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key
- Denial of service
- CWE-405
- CVSS 8.2 High
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
- Denial of service
- CWE-405
<=19.2.25 || >=20.0.0, <20.3.33 || >=21.0.0, <21.2.25 || >=22.0.0, <22.2.1 · fixed in 20.3.33, 21.2.25, 22.2.1
GHSA-62vg-58rm-qff7 · CVE-2026-111752 - CVSS 7.5 High
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum
- CWE-405
- CVSS 7.5 High
Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
- CWE-405
>=8.0.0, <8.0.5 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.5, 9.0.21, 10.0.13, 11.0.0-rc.2
GHSA-7hqp-7c5m-4vq6 · CVE-2026-96960 - CVSS 5.9 Medium
Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
- CWE-405
>=8.0.0, <8.0.2 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.2, 9.0.21, 10.0.13, 11.0.0-rc.2
GHSA-2fmv-rv2c-59x7 · CVE-2026-70162 - CVSS 8.7 High
Misskey: Lack of rate limiting and size restrictions in RSS fetching API
- misskey
- Denial of service
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Excessive CPU consumption from repeated initial window changes in net/http
- CWE-405
<0.60.0 · fixed in 0.60.0
GO-2026-6611 · CVE-2026-78669 - CVSS 7.5 High
Reject malformed ECH outer extension references in crypto/tls
- CWE-405
<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2
GO-2026-6607 · CVE-2026-97031 - CVSS 7.5 High
HTTP/2 server memory exhaustion due to Trailer headers in net/http
- CWE-405
<0.60.0 · fixed in 0.60.0
GO-2026-6603 · CVE-2026-78659 - CVSS 7.5 High
IBM DataPower Gateway Denial of Service
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- CWE-405
- CVSS 6.9 Medium
wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion
- wolfSSL Inc. wolfSSH
- Denial of service
- CWE-372
- CVSS 7.5 High
Apache Struts: Disproportionate response size when rendering BigDecimal request parameters
- Apache Software Foundation Apache Struts
- CWE-405
- CVSS 8.7 High
Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
- ZcashFoundation zebra
- CWE-405
- CVSS 6.9 Medium
Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
- ZcashFoundation zebra
- CWE-405
- CVSS 8.7 High
Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification
- ZcashFoundation zebra
- CWE-405
- CVSS 7.5 High
Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords
- Apache Software Foundation Apache Directory LDAP API
- CWE-405
- CVSS 5.3 Medium
Message parser retains every identical singleton RDATA, enabling wire-to-work amplification
- ISC BIND 9
- CWE-405
- CVSS 2.1 Low
Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search
- Concrete CMS
- CWE-405
- CVSS 7.5 High
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
- Denial of service
- CWE-405
>=0.9.0, <0.11.1 · fixed in 0.11.1
GHSA-3g9q-v48f-hh9w · CVE-2026-87011 - CVSS 6.9 Medium
commonmark 2.0.0 before 2.8.4 Denial of Service via XML
- thephpleague commonmark
- CWE-405
- CVSS 4.3 Medium
Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries
- Denial of service
- CWE-405
- CVSS 4.8 Medium
pypdf: Possible long runtimes/large memory usage when retrieving outlines
- Denial of service
- CWE-405
<6.16.1 · fixed in 6.16.1
GHSA-23w6-3w8w-8484 · CVE-2026-84310 - CVSS 6.6 Medium
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
- Denial of service
- CWE-405
<0.5.0 · fixed in 0.5.0
GHSA-vcc3-ghjq-m6fr · CVE-2026-45822 - CVSS 7.5 High
Excessive Memory Use Buffering DTLS Records for a Future Epoch
- OpenSSL
- CWE-405
- CVSS 5.1 Medium
Frontend DoS via the validate.api.exists action
- Zabbix
- CWE-405
- CVSS 5.3 Medium
Frontend DoS via the popup.testtriggerexpr action
- Zabbix
- CWE-405
- CVSS 7.5 High
Mastodon: Exhausting data by an unauthenticated request to the admin retention API
- mastodon
- Denial of service
- CWE-405
- CVSS 5.3 Medium
league/commonmark: Denial of service via deeply nested XML output
- CWE-405
>=2.0.0, <2.9.0 · fixed in 2.9.0
GHSA-mj63-m3rc-8ppr - CVSS 5.3 Medium
AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock
- Significant-Gravitas AutoGPT
- Denial of service
- CWE-405
- CVSS 7.1 High
Denial of Service in UBB.threads
- UBB Systems UBB.threads
- CWE-405
- CVSS 7.5 High
Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification
- envoy
- Denial of service
- CWE-405
- CVSS 6.2 Medium
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters
- NEZUMI Text::LineFold
- Denial of service
- CWE-405
- CVSS 5.3 Medium
Nerdbank.MessagePack has a memory amplification DoS in collection deserialization
- CWE-405
<1.1.78 · fixed in 1.1.78
GHSA-qjvr-435c-5fjh - CVSS 6.9 Medium
Technitium DNS Server excessive DNSSEC requests
- Technitium DNS Server
- Denial of service
- CWE-405
- CVSS 7.5 High
Deskflow: TLS multiplexer DoS on failed `SSL_accept`
- deskflow
- Denial of service
- CWE-405
- CVSS 5.3 Medium
Duplicate Advisory: OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling
- CWE-405
<2026.3.22 · fixed in 2026.3.22
GHSA-36cp-mh65-x882 - CVSS 6.9 Medium
OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant)
- Denial of service
- CWE-405
<2026.3.24 · fixed in 2026.3.24
GHSA-w6m8-cqvj-pg5v · CVE-2026-35665 - CVSS 6.9 Medium
OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling
- Denial of service
- CWE-405
<2026.3.22 · fixed in 2026.3.22
GHSA-rm59-992w-x2mv · CVE-2026-35626 - CVSS 5.3 Medium
Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.
- CWE-405
- CVSS 8.7 High
Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server
- MongoDB Inc MongoDB Server
- CWE-405
- CVSS 6.5 Medium
Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools)
- SAP_SE SAP BusinessObjects Business Intelligence Platform (AdminTools)
- CWE-405
- CVSS 7.5 High
Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform
- SAP_SE SAP BusinessObjects BI Platform
- CWE-405
- CVSS 7.5 High
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
- CWE-405
>=5.1.0, <5.6.2 · fixed in 5.6.2
GHSA-g2pg-6438-jwpf · CVE-2026-22775 - CVSS 7.5 High
Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse
- CWE-20
- CWE-405
>=5.3.0, <5.6.2 · fixed in 5.6.2
GHSA-vw5p-8cq8-m7mv · CVE-2026-22774 - CVSS 5.3 Medium
Marshmallow has DoS in Schema.load(many)
- CWE-405
>=3.0.0rc1, <3.26.2 || >=4.0.0, <4.1.2 · fixed in 3.26.2, 4.1.2
GHSA-428g-f7cq-pgp5 · CVE-2025-68480 - CVSS 7.1 High
Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger)
- SAP_SE SAP S/4 HANA Private Cloud (Financials General Ledger)
- CWE-405
- CVSS 7.9 High
Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius)
- SAP_SE SAP NetWeaver (remote service for Xcelsius)
- CWE-405
- CVSS 5.9 Medium
Denial of Service (DoS) in SAPUI5 framework (Markdown-it component)
- SAP_SE SAPUI5 framework (Markdown-it component)
- CWE-405
- CVSS 7.5 High
Sigstore Timestamp Authority allocates excessive memory during request parsing
- CWE-405
<2.0.3 · fixed in 2.0.3
GHSA-4qg8-fj49-pxjh · CVE-2025-66564 - CVSS 7.5 High
Fulcio allocates excessive memory during token parsing
- CWE-405
<1.8.3 · fixed in 1.8.3
GHSA-f83f-xpx7-ffpw · CVE-2025-66506 - CVSS 6.0 Medium
Frontend DoS vulnerability due to asymmetric resource consumption
- Zabbix
- CWE-405
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Resource exhaustion via malformed DNSKEY handling
- ISC BIND 9
- CWE-405
- CVSS 8.3 High
Atlassian Confluence Data Center: This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of…
- Atlassian Confluence Data Center
- CWE-405
- CVSS 5.3 Medium
CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
- NetApp StorageGRID
- CWE-405
- CVSS 4.8 Medium
HCL Connections Docs is vulnerable to a Denial of Service (DoS) attack
- HCL Software Connections Docs
- CWE-405
- CVSS 8.7 High
Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager
- CWE-405
<0.1.4 · fixed in 0.1.4
GHSA-r7fm-3pqm-ww5w · CVE-2025-53633 - CVSS 6.0 Medium
net-imap rubygem vulnerable to possible DoS by memory exhaustion
- Denial of service
- CWE-405
<0.2.5 || >=0.3.0, <0.3.9 || >=0.4.0, <0.4.20 || >=0.5.0, <0.5.7 · fixed in 0.2.5, 0.3.9, 0.4.20, 0.5.7
GHSA-j3g3-5qv5-52mj · CVE-2025-43857