# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first

- [Regexp2: Unbounded memory amplification via large \`{m}\` quantifier on a zero-width subexpression](https://agentprime.io/advisories/CVE-2026-77299.md)
  `CVE-2026-77299` · CVE record: dlclark regexp2 · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2026 · Tags: Denial of service
- [Heap buffer overflow in dBASE index import](https://agentprime.io/advisories/CVE-2026-76181.md)
  `CVE-2026-76181` · CVE record: The Document Foundation LibreOffice · CVSS 5.4 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service, Memory corruption
- [FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length](https://agentprime.io/advisories/CVE-2026-116787.md)
  `CVE-2026-116787` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, Denial of service
- [ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder](https://agentprime.io/advisories/CVE-2026-123273.md)
  `CVE-2026-123273` · CVE record: ImageMagick ImageMagick · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [filecoin-pin: Unbounded DAG pinning can exhaust server resources](https://agentprime.io/advisories/GHSA-m5ph-mmg5-6w5h.md)
  `GHSA-m5ph-mmg5-6w5h`, `CVE-2026-62300` · npm `filecoin-pin`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Malformed Wi-Fi Beacon Causes Crash on WF200](https://agentprime.io/advisories/CVE-2026-107359.md)
  `CVE-2026-107359` · CVE record: Silicon Labs WF200 FW · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing](https://agentprime.io/advisories/CVE-2026-82965.md)
  `CVE-2026-82965` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth](https://agentprime.io/advisories/CVE-2026-49407.md)
  `CVE-2026-49407` · CVE record: tinyhumansai openhuman · CVSS 7.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, Denial of service
- [Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache](https://agentprime.io/advisories/CVE-2026-110932.md)
  `CVE-2026-110932` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop](https://agentprime.io/advisories/CVE-2026-110931.md)
  `CVE-2026-110931` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop](https://agentprime.io/advisories/CVE-2026-107602.md)
  `CVE-2026-107602` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing](https://agentprime.io/advisories/CVE-2026-107123.md)
  `CVE-2026-107123` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response](https://agentprime.io/advisories/CVE-2026-123096.md)
  `CVE-2026-123096` · CVE record: anacrolix torrent · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()](https://agentprime.io/advisories/CVE-2026-122330.md)
  `CVE-2026-122330` · CVE record: Blosc c-blosc2 · CVSS 6.8 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression](https://agentprime.io/advisories/CVE-2026-64860.md)
  `CVE-2026-64860` · CVE record: espressif esp-protocols · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode](https://agentprime.io/advisories/CVE-2026-74841.md)
  `CVE-2026-74841` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Apache OFBiz: Unbounded multi-form row count from a parameter name](https://agentprime.io/advisories/CVE-2026-82904.md)
  `CVE-2026-82904` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service, Broken access control
- [Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling](https://agentprime.io/advisories/CVE-2026-73095.md)
  `CVE-2026-73095` · CVE record: Apache Software Foundation Apache Juneau · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [vault-java-driver: stored deeply nested JSON kills every thread that reads it](https://agentprime.io/advisories/CVE-2026-112072.md)
  `CVE-2026-112072` · CVE record: jopenlibs vault-java-driver · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Samsung Semiconductor Exynos 850 and others](https://agentprime.io/advisories/CVE-2026-33971.md)
  `CVE-2026-33971` · CVE record: Samsung Semiconductor Exynos 850 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Infinite loop in Samsung Semiconductor Exynos 850 and others](https://agentprime.io/advisories/CVE-2026-33969.md)
  `CVE-2026-33969` · CVE record: Samsung Semiconductor Exynos 850 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Cost](https://agentprime.io/advisories/CVE-2026-122309.md)
  `CVE-2026-122309` · CVE record: kyverno kyverno · CVSS 8.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching](https://agentprime.io/advisories/CVE-2026-122306.md)
  `CVE-2026-122306` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop](https://agentprime.io/advisories/CVE-2026-122305.md)
  `CVE-2026-122305` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [laspy LAS File lasreader.py memory allocation](https://agentprime.io/advisories/CVE-2026-122052.md)
  `CVE-2026-122052` · CVE record: laspy · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients](https://agentprime.io/advisories/CVE-2026-76893.md)
  `CVE-2026-76893` · CVE record: tsparticles tsparticles and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS](https://agentprime.io/advisories/CVE-2026-63655.md)
  `CVE-2026-63655` · CVE record: tsparticles tsparticles and 1 more · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of service](https://agentprime.io/advisories/CVE-2026-122020.md)
  `CVE-2026-122020` · CVE record: NST Labs Tech Nstbrowser · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [h2o: heap exhaustion using capsules](https://agentprime.io/advisories/CVE-2026-55367.md)
  `CVE-2026-55367` · CVE record: h2o h2o · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Multiple vulnerabilities that affects IBM Db2 Genius Hub](https://agentprime.io/advisories/CVE-2026-108838.md)
  `CVE-2026-108838` · CVE record: IBM Db2 Genius Hub · CVSS 3.3 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder](https://agentprime.io/advisories/CVE-2026-122129.md)
  `CVE-2026-122129` · CVE record: CESNET ipfixcol2 · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser](https://agentprime.io/advisories/CVE-2026-97705.md)
  `CVE-2026-97705` · CVE record: moleculerjs moleculer · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests](https://agentprime.io/advisories/CVE-2026-97701.md)
  `CVE-2026-97701` · CVE record: zulip zulip · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [BIG-HKSCS decoding hang on crafted input](https://agentprime.io/advisories/CVE-2026-122054.md)
  `CVE-2026-122054` · CVE record: The GNU C Library glibc · CVSS 5.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)](https://agentprime.io/advisories/CVE-2026-106554.md)
  `CVE-2026-106554` · CVE record: FasterXML jackson-dataformat-cbor · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest](https://agentprime.io/advisories/CVE-2026-121960.md)
  `CVE-2026-121960` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame](https://agentprime.io/advisories/CVE-2026-121959.md)
  `CVE-2026-121959` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event](https://agentprime.io/advisories/CVE-2026-121951.md)
  `CVE-2026-121951` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto](https://agentprime.io/advisories/GHSA-cxjx-vmm2-qr8r.md)
  `GHSA-cxjx-vmm2-qr8r`, `CVE-2026-118391`, `EEF-CVE-2026-118391` · Hex `ecto`: affected `>=3.4.0, <3.14.3`, fixed in `3.14.3` · CVSS 8.9 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV](https://agentprime.io/advisories/CVE-2026-121944.md)
  `CVE-2026-121944` · CVE record: irontec sngrep · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling](https://agentprime.io/advisories/CVE-2026-100302.md)
  `CVE-2026-100302` · CVE record: Apache Software Foundation Apache ZooKeeper · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable](https://agentprime.io/advisories/CVE-2026-115448.md)
  `CVE-2026-115448` · CVE record: Apache Software Foundation Apache ZooKeeper · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)](https://agentprime.io/advisories/CVE-2026-103582.md)
  `CVE-2026-103582` · CVE record: Apache Software Foundation Apache ActiveMQ NMS OpenWire Client Library · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM](https://agentprime.io/advisories/CVE-2026-108949.md)
  `CVE-2026-108949` · CVE record: Apache Software Foundation Apache ActiveMQ and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Pre-authentication upload parsing permits resource exhaustion](https://agentprime.io/advisories/CVE-2026-114426.md)
  `CVE-2026-114426` · CVE record: SEPPmail AG SEPPmail Secure Email Gateway (SEG) · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability](https://agentprime.io/advisories/CVE-2026-62126.md)
  `CVE-2026-62126` · CVE record: miniOrange SAML SP Single Sign On · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Resource exhaustion vulnerability in HTTP request handling impacts Qt HTTP Server (QHttpServer)](https://agentprime.io/advisories/CVE-2026-110944.md)
  `CVE-2026-110944` · CVE record: qt Qt Framework · CVSS 2.7 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service](https://agentprime.io/advisories/CVE-2026-87044.md)
  `CVE-2026-87044` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set](https://agentprime.io/advisories/CVE-2026-120651.md)
  `CVE-2026-120651` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service
- [CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits](https://agentprime.io/advisories/CVE-2026-120650.md)
  `CVE-2026-120650` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service
- [CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list](https://agentprime.io/advisories/CVE-2026-120645.md)
  `CVE-2026-120645` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service, CWE-625
- [CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type](https://agentprime.io/advisories/CVE-2026-120632.md)
  `CVE-2026-120632` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service
- [CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse](https://agentprime.io/advisories/CVE-2026-120631.md)
  `CVE-2026-120631` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service, CWE-625
- [Tanium addressed an uncontrolled resource consumption vulnerability in Discover.](https://agentprime.io/advisories/CVE-2026-116668.md)
  `CVE-2026-116668` · CVE record: Tanium Discover · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service
- [Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.](https://agentprime.io/advisories/CVE-2026-116646.md)
  `CVE-2026-116646` · CVE record: Tanium Threat Response · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service
- [Uncontrolled recursion in Google Chrome](https://agentprime.io/advisories/CVE-2026-121092.md)
  `CVE-2026-121092` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service
- [Resource leak in Devolutions Server](https://agentprime.io/advisories/CVE-2026-119636.md)
  `CVE-2026-119636` · CVE record: Devolutions Server · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service
- [Unescaped header separators in whatstk build a regular expression that backtracks exponentially](https://agentprime.io/advisories/CVE-2026-121577.md)
  `CVE-2026-121577` · CVE record: lucasrodes whatstk · CVSS 6.7 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service
- [isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)](https://agentprime.io/advisories/CVE-2026-63475.md)
  `CVE-2026-63475` · CVE record: isomorphic-git isomorphic-git · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service
- [isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)](https://agentprime.io/advisories/CVE-2026-63476.md)
  `CVE-2026-63476` · CVE record: isomorphic-git isomorphic-git · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service

Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTExLTAzVDE5OjQ0OjA2LjkwODAwMFoiLCJDVkUtMjAyNi02MzQ3NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/>. Everything for agents: <https://agentprime.io/llms.txt>.