# CWE-406.

Every Advisory and CVE whose sources give the weakness CWE-406, newest first.

## Records, newest first

- [Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server](https://agentprime.io/advisories/CVE-2026-106465.md)
  `CVE-2026-106465` · CVE record: Eclipse Foundation Eclipse ThreadX NetX Duo · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-406
- [hickory-resolver: Unbounded TC-retry loop in \`NameServerPool::try_send\` (resource-exhaustion DoS)](https://agentprime.io/advisories/GHSA-6w6g-hm98-mhgm.md)
  `GHSA-6w6g-hm98-mhgm` · crates.io `hickory-resolver`: affected `>=0.26.0-beta.1, <0.26.2`, fixed in `0.26.2` · CVSS 4.0, no score published · Not analysed yet · Published 5 Oct 2026 · Tags: Denial of service, CWE-406
- [ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack](https://agentprime.io/advisories/CVE-2026-16515.md)
  `CVE-2026-16515` · CVE record: zephyrproject zephyr · CVSS 4.7 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-406
- [Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service](https://agentprime.io/advisories/CVE-2026-68080.md)
  `CVE-2026-68080` · CVE record: Apache Software Foundation Apache Qpid Broker-J · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-406
- [QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding](https://agentprime.io/advisories/GHSA-85rg-p3fr-xc2f.md)
  `GHSA-85rg-p3fr-xc2f`, `CVE-2026-54609`, `PYSEC-2026-3615` · Maven `com.quietterminal:qti-neon` and 2 more: affected `=1.0.0`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service, CWE-406
- ['max-global-quota' reset by DNSSEC validation restarts](https://agentprime.io/advisories/CVE-2026-50045.md)
  `CVE-2026-50045` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-406
- [Technitium DNS Server excessive DNSSEC requests](https://agentprime.io/advisories/CVE-2026-45557.md)
  `CVE-2026-45557` · CVE record: Technitium DNS Server · CVSS 6.9 Medium · Not analysed yet · Published 19 May 2026 · Tags: Denial of service, CWE-405, CWE-406
- [PocketMine-MP: Network amplification vulnerability with \`ActorEventPacket\`](https://agentprime.io/advisories/GHSA-7hmv-4j2j-pp6f.md)
  `GHSA-7hmv-4j2j-pp6f`, `CVE-2026-86202`, `PKSA-yw3m-b28c-y6hc` · Packagist `pocketmine/pocketmine-mp`: affected `<5.39.2`, fixed in `5.39.2` · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-406
- [OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check](https://agentprime.io/advisories/GHSA-h656-5vcf-cm23.md)
  `GHSA-h656-5vcf-cm23` · npm `openclaw`: affected `<2026.2.24`, fixed in `2026.2.24` · No CVSS score · Not analysed yet · Published 3 Mar 2026 · Tags: Denial of service, CWE-208, CWE-406
- [DoS Vulnerability in ntpd-rs](https://agentprime.io/advisories/GHSA-4855-q42w-5vr4.md)
  `GHSA-4855-q42w-5vr4`, `CVE-2025-58066` · crates.io `ntpd-rs`: affected `>=1.2.0, <1.6.2`, fixed in `1.6.2` · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: CWE-406
- [Possible External service interaction Vulnerability in OpenText iManager](https://agentprime.io/advisories/CVE-2021-38135.md)
  `CVE-2021-38135` · CVE record: OpenText iManager · CVSS 8.6 High · Not analysed yet · Published 22 Nov 2024 · Tags: Server-side request forgery (SSRF), CWE-406
- [Technitium 11.5.3 allows remote attackers to cause a denial of service (bandwidth amplification) because the DNSBomb manipulation causes accumulation of low-rate DNS queries such that there is a larg…](https://agentprime.io/advisories/CVE-2023-49203.md)
  `CVE-2023-49203` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2024 · Tags: CWE-406
- [An issue was discovered in Technitium through 11.0.2.](https://agentprime.io/advisories/CVE-2023-28456.md)
  `CVE-2023-28456` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2024 · Tags: CWE-406
- [An issue was discovered in Technitium through 11.0.2.](https://agentprime.io/advisories/CVE-2023-28455.md)
  `CVE-2023-28455` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2024 · Tags: CWE-406
- [IBM MQ denial of service](https://agentprime.io/advisories/CVE-2024-25015.md)
  `CVE-2024-25015` · CVE record: IBM MQ · CVSS 7.5 High · Not analysed yet · Published 1 May 2024 · Tags: CWE-406
- [drybjed ansible-ntp main.yml amplification](https://agentprime.io/advisories/CVE-2014-125036.md)
  `CVE-2014-125036` · CVE record: drybjed ansible-ntp · CVSS 2.6 Low · Not analysed yet · Published 2 Jan 2023 · Tags: CWE-406
- [PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering](https://agentprime.io/advisories/CVE-2022-0028.md)
  `CVE-2022-0028` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 8.6 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 10 Aug 2022 · Tags: CWE-406
- [OpenVPN Access Server: OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple…](https://agentprime.io/advisories/CVE-2021-4234.md)
  `CVE-2021-4234` · CVE record: OpenVPN Access Server · No CVSS score · Not analysed yet · Published 6 Jul 2022 · Tags: CWE-406
- [Jenkins vulnerable to UDP amplification reflection attack](https://agentprime.io/advisories/GHSA-gpxv-776p-7gc7.md)
  `GHSA-gpxv-776p-7gc7`, `BIT-jenkins-2020-2100`, `CVE-2020-2100` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.204.2 || >=2.205, <2.219`, fixed in `2.204.2`, `2.219` · CVSS 5.8 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-406
- [OCI OpenDDS Secure Network Amplification](https://agentprime.io/advisories/CVE-2021-38429.md)
  `CVE-2021-38429` · CVE record: OCI OpenDDS · CVSS 6.6 Medium · Not analysed yet · Published 5 May 2022 · Tags: CWE-406
- [eProsima Fast DDS Network Amplification](https://agentprime.io/advisories/CVE-2021-38425.md)
  `CVE-2021-38425` · CVE record: eProsima Fast DDS · CVSS 7.5 High · Not analysed yet · Published 5 May 2022 · Tags: CWE-406
- [TwinOaks Computing CoreDX DDS Secure Network Amplification](https://agentprime.io/advisories/CVE-2021-43547.md)
  `CVE-2021-43547` · CVE record: TwinOaks Computing CoreDX DDS · CVSS 7.5 High · Not analysed yet · Published 5 May 2022 · Tags: CWE-406
- [Potential Network Amplification and Information Exposure in RTI Connext Professional and Connext Micro](https://agentprime.io/advisories/CVE-2021-38487.md)
  `CVE-2021-38487` · CVE record: RTI Connext Professional and 1 more · CVSS 8.8 High · Not analysed yet · Published 5 May 2022 · Tags: CWE-406, CWE-923
- [A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1.](https://agentprime.io/advisories/CVE-2019-14850.md)
  `CVE-2019-14850` · CVE record: nbdkit · No CVSS score · Not analysed yet · Published 18 Mar 2021 · Tags: CWE-406
- [unbound: An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux…](https://agentprime.io/advisories/CVE-2020-10772.md)
  `CVE-2020-10772` · CVE record: unbound · No CVSS score · Not analysed yet · Published 27 Nov 2020 · Tags: CWE-406

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-406>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-406/>. Everything for agents: <https://agentprime.io/llms.txt>.