CWE-755.

Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread

• Apache Software Foundation Apache ZooKeeper
• CWE-755

HCL BigFix AEX is affected by multiple security vulnerabilities.

• HCL Software BigFix AEX
• Information disclosure
• CWE-391

Routinator may exit on malformed ranges

• NLnet Labs Routinator
• CWE-755

Routinator HTTP server becomes unavailable with many unclosed connections

• NLnet Labs Routinator
• CWE-755

Routinator exits on malformed rsync URIs

• NLnet Labs Routinator
• CWE-755

Routinator stores TA certificate in cache without validation

• NLnet Labs Routinator
• CWE-755

Routinator exits when parsing an incorrect or very large CRL file

• NLnet Labs Routinator
• CWE-755

Routinator incorrectly handles delta updates

• NLnet Labs Routinator
• CWE-755

Routinator exits when requesting the output repeatedly

• NLnet Labs Routinator
• CWE-755

Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization

• GDATASoftwareAG motornet
• CWE-755

Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping

• GDATASoftwareAG motornet
• CWE-755

Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers

• GDATASoftwareAG motornet
• CWE-755

RCE via stale global state

• PHP
• Memory corruption
• CWE-755

RCE via OOM corruption

• PHP
• Memory corruption
• CWE-755

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

• CWE-248
• CWE-755

>=1.9.4, <1.14.5 · fixed in 1.14.5

libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

• js-libp2p
• @libp2p webrtc
• CWE-248
• CWE-755

Out-of-Range Timestamp Claim Handling in auth0/java-jwt

• Auth0 java-jwt
• CWE-20
• CWE-755

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

• CWE-20
• CWE-693

>=3.4.0, <3.8.0 · fixed in 3.8.0

Apache log4net: Request validation failure drops the event in the aspnet-request converter

• Apache Software Foundation Apache log4net
• CWE-755

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

• CWE-20
• CWE-248

<0.30.0 · fixed in 0.30.0

Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception

• Apache Software Foundation Apache Thrift
• CWE-248
• CWE-755

Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-248

Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection

• Apache Software Foundation Apache Thrift
• CWE-248
• CWE-755

Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-755

Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-248

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

• CWE-248
• CWE-755

>=5.8.0, <5.9.3 · fixed in 5.9.3

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

• CWE-755

>=2.9.0, <2.14.0 · fixed in 2.14.0

A malformed Session header permanently orphans one packet-pool block per RTSP request

• Eclipse Foundation Eclipse ThreadX NetX Duo
• Denial of service
• CWE-755

ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition

• ag-ui
• CWE-755

Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition

• Trusted Domain Project OpenDMARC
• CWE-755

Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition

• Trusted Domain Project OpenDMARC
• CWE-755

Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection

• OISF suricata
• CWE-755

Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

• CWE-755

>=4.0.0, <4.3.0 · fixed in 4.3.0

Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)

• CWE-755

>=4.0.0, <4.3.0 · fixed in 4.3.0

mport verify can compare stale checksum data after hashing failures

• MidnightBSD mport
• CWE-354
• CWE-755

mport index decompression can leave partial or corrupt index data after zstd failures

• MidnightBSD mport
• CWE-354
• CWE-755

Panic via negative shared-string index in github.com/xuri/excelize

• CWE-248
• CWE-755

<2.11.0 · fixed in 2.11.0

Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

• maziggy bambuddy
• CWE-636
• CWE-755

Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request

• Belden Hirschmann HiOS Switch Platform
• CWE-755

Improper handling of exceptional conditions in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• CWE-755

baseline-browser-mapping process termination on invalid input causes denial of service

• CWE-705
• CWE-755

>=2.0.0, <2.11.0 · fixed in 2.11.0

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

• CWE-248
• CWE-755

>=10.0.5, <10.0.14 · fixed in 10.0.14

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

• Memory corruption
• CWE-755

<10.0.14 · fixed in 10.0.14

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

• Denial of service
• CWE-20

<1.13.0 · fixed in 1.13.0

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

• CWE-20
• CWE-755

<10.0.9 · fixed in 10.0.9

epmd permanent DoS via EMFILE on accept(2) in erts

• Erlang OTP
• Denial of service
• CWE-755

Valibot: record() issue paths can make flatten() throw for inherited Object property names

• CWE-755

<1.4.2 · fixed in 1.4.2

Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-755

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

• Denial of service
• CWE-755

<3.3.0 · fixed in 3.3.0

ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

• CWE-248
• CWE-755

<4.40.1 · fixed in 4.40.1

chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)

• CWE-252
• CWE-253

<0.6.0 · fixed in 0.6.0

ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder

• ImageMagick
• Memory corruption
• CWE-754

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

• CWE-248
• CWE-754

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

• CWE-460
• CWE-755

>=2.0.0, <2.13.0 · fixed in 2.13.0

@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

• CWE-755

<1.4.0 · fixed in 1.4.0

Nimiq network-libp2p: Untrusted peer can wedge DHT

• nimiq core-rs-albatross
• CWE-755

An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later).

• CWE-755

Routinator crashes when encountering maliciously crafted RRDP XML files

• Denial of service
• CWE-755

<0.15.2 · fixed in 0.15.2

Routinator exits when accepting an incoming HTTP or RTR connection fails

• NLnet Labs Routinator
• CWE-755

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws

• RURBAN Cpanel::JSON::XS
• Memory corruption
• CWE-755