# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServerApp.dll, TechnitiumLibrary.Net/Dns/DnsClient.cs components](https://agentprime.io/advisories/CVE-2026-36478.md) `CVE-2026-36478` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service - [An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via supplying a crafted PSD file.](https://agentprime.io/advisories/CVE-2026-30041.md) `CVE-2026-30041` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service - [ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition](https://agentprime.io/advisories/GHSA-q62c-h75r-2xhc.md) `GHSA-q62c-h75r-2xhc`, `CVE-2026-53460` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [ImageMagick Vulnerable to Stack Overflow in its MVG Decoder](https://agentprime.io/advisories/GHSA-h36c-3666-h489.md) `GHSA-h36c-3666-h489`, `CVE-2026-48734` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 5.5 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [ImageMagick has an Infinite Loop in subimage-search with crafted image](https://agentprime.io/advisories/GHSA-5v62-8fq6-cp9m.md) `GHSA-5v62-8fq6-cp9m`, `CVE-2026-48733` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 4.7 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic](https://agentprime.io/advisories/GHSA-47q9-m4ww-924m.md) `GHSA-47q9-m4ww-924m`, `CVE-2026-48702`, `GO-2026-5778` · Go `github.com/sigstore/rekor`: affected `>=0.3.0, <1.5.2`, fixed in `1.5.2` · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings](https://agentprime.io/advisories/GHSA-q2h6-ghwm-5qm8.md) `GHSA-q2h6-ghwm-5qm8`, `CVE-2026-48516` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions](https://agentprime.io/advisories/GHSA-cxmj-83gh-fp49.md) `GHSA-cxmj-83gh-fp49`, `CVE-2026-48515` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length](https://agentprime.io/advisories/GHSA-w567-gjr2-hm5j.md) `GHSA-w567-gjr2-hm5j`, `CVE-2026-48514` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement](https://agentprime.io/advisories/GHSA-wfr3-xj75-pfwh.md) `GHSA-wfr3-xj75-pfwh`, `CVE-2026-48513` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement](https://agentprime.io/advisories/GHSA-cj9g-3mj2-g8vv.md) `GHSA-cj9g-3mj2-g8vv`, `CVE-2026-48512` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps](https://agentprime.io/advisories/GHSA-2x83-8g95-xh59.md) `GHSA-2x83-8g95-xh59`, `CVE-2026-48511` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths](https://agentprime.io/advisories/GHSA-v72x-2h86-7f8m.md) `GHSA-v72x-2h86-7f8m`, `CVE-2026-48510` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service, CWE-409 - [MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth](https://agentprime.io/advisories/GHSA-vh6j-jc39-fggf.md) `GHSA-vh6j-jc39-fggf`, `CVE-2026-48506` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation](https://agentprime.io/advisories/GHSA-w9wp-h8wv-79jx.md) `GHSA-w9wp-h8wv-79jx`, `CVE-2026-48504` · crates.io `opentelemetry_sdk`: affected `<0.32.1`, fixed in `0.32.1` · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows](https://agentprime.io/advisories/GHSA-382j-8mxh-c7x2.md) `GHSA-382j-8mxh-c7x2`, `CVE-2026-48502` · NuGet `MessagePack`: affected `>=3.0, <3.1.7`, fixed in `3.1.7` · CVSS 8.2 High · Not analysed yet · Published 25 Jun 2026 · Tags: Memory corruption, Denial of service, Code injection, Insecure deserialization - [jq: stack overflow in deep structural equality](https://agentprime.io/advisories/CVE-2026-47770.md) `CVE-2026-47770` · CVE record: jqlang jq · CVSS 6.8 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets](https://agentprime.io/advisories/CVE-2026-13351.md) `CVE-2026-13351` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits](https://agentprime.io/advisories/CVE-2026-54024.md) `CVE-2026-54024` · CVE record: danny-avila LibreChat · CVSS 6.5 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork](https://agentprime.io/advisories/CVE-2026-54037.md) `CVE-2026-54037` · CVE record: danny-avila LibreChat · CVSS 6.5 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Reachable assertion in Schneider Electric PowerLogic™ P7](https://agentprime.io/advisories/CVE-2026-9718.md) `CVE-2026-9718` · CVE record: Schneider Electric PowerLogic™ P7 · CVSS 6.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2](https://agentprime.io/advisories/CVE-2026-47153.md) `CVE-2026-47153` · CVE record: Silicon Labs EmberZNet · CVSS 7.1 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Level Control Move divide-by-zero in EmberZNet v9.0.2](https://agentprime.io/advisories/CVE-2026-47152.md) `CVE-2026-47152` · CVE record: Silicon Labs EmberZNet · CVSS 7.1 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Color Control color-temperature assertion abort in EmberZNet v9.0.2](https://agentprime.io/advisories/CVE-2026-47146.md) `CVE-2026-47146` · CVE record: Silicon Labs EmberZNet · CVSS 7.1 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Color Control hue/saturation assertion abort in EmberZNet v9.0.2](https://agentprime.io/advisories/CVE-2026-47145.md) `CVE-2026-47145` · CVE record: Silicon Labs EmberZNet · CVSS 7.1 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Denial of service via crafted DoH3 queries](https://agentprime.io/advisories/CVE-2026-40211.md) `CVE-2026-40211` · CVE record: PowerDNS DNSdist · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Denial of service via IXFR queries](https://agentprime.io/advisories/CVE-2026-40209.md) `CVE-2026-40209` · CVE record: PowerDNS DNSdist · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Insufficient input validation of internal web server](https://agentprime.io/advisories/CVE-2026-42005.md) `CVE-2026-42005` · CVE record: PowerDNS Authoritative · CVSS 4.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure](https://agentprime.io/advisories/CVE-2026-53229.md) `CVE-2026-53229` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [mptcp: allow subflow rcv wnd to shrink](https://agentprime.io/advisories/CVE-2026-53183.md) `CVE-2026-53183` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [timers/migration: Fix livelock in tmigr_handle_remote_up()](https://agentprime.io/advisories/CVE-2026-53180.md) `CVE-2026-53180` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [vsock/virtio: fix potential unbounded skb queue](https://agentprime.io/advisories/CVE-2026-53132.md) `CVE-2026-53132` · CVE record: Linux Linux · CVSS 7.1 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [A reachable unwrap in the \_\_assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted string.](https://agentprime.io/advisories/CVE-2026-38640.md) `CVE-2026-38640` · CVE record · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.](https://agentprime.io/advisories/CVE-2026-38637.md) `CVE-2026-38637` · CVE record · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control](https://agentprime.io/advisories/CVE-2026-10642.md) `CVE-2026-10642` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Denial of service - [Sentry: Inefficient Regular Expression Complexity in sentry](https://agentprime.io/advisories/CVE-2026-52794.md) `CVE-2026-52794` · CVE record: getsentry sentry · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: Denial of service - [AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features](https://agentprime.io/advisories/CVE-2026-33235.md) `CVE-2026-33235` · CVE record: Significant-Gravitas AutoGPT · CVSS 7.7 High · Not analysed yet · Published 24 Jun 2026 · Tags: Denial of service - [Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200](https://agentprime.io/advisories/CVE-2026-12760.md) `CVE-2026-12760` · CVE record: TP-Link Systems Inc. Tapo C200 v3 · CVSS 7.1 High · Not analysed yet · Published 24 Jun 2026 · Tags: Denial of service - [neigh: let neigh_xmit take skb ownership](https://agentprime.io/advisories/CVE-2026-52981.md) `CVE-2026-52981` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: Denial of service - [net: tls: fix strparser anchor skb leak on offload RX setup failure](https://agentprime.io/advisories/CVE-2026-52974.md) `CVE-2026-52974` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: Denial of service - [ceph: put folios not suitable for writeback](https://agentprime.io/advisories/CVE-2026-52960.md) `CVE-2026-52960` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: Denial of service - [Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on \`POST /two-factor\`](https://agentprime.io/advisories/GHSA-mr8g-2mj4-pcq2.md) `GHSA-mr8g-2mj4-pcq2`, `CVE-2026-49870`, `PKSA-35bw-hh2v-5kbx` · Packagist `snipe/snipe-it`: affected `<8.6.0`, fixed in `8.6.0` · CVSS 5.9 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service - [opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent](https://agentprime.io/advisories/GHSA-f2r5-5m7w-p5cx.md) `GHSA-f2r5-5m7w-p5cx`, `CVE-2026-48496`, `GO-2026-5343` · Go `go.opentelemetry.io/ebpf-profiler`: affected `>=0.0.202527, <0.0.202622`, fixed in `0.0.202622` · CVSS 6.2 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service - [tarfile opened in streaming mode mishandles EOF](https://agentprime.io/advisories/CVE-2026-11972.md) `CVE-2026-11972` · CVE record: Python Software Foundation CPython · CVSS 8.2 High · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service, CWE-252, CWE-606 - [jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()](https://agentprime.io/advisories/GHSA-3wrr-7qpf-2prh.md) `GHSA-3wrr-7qpf-2prh`, `CVE-2026-50193` · Maven `com.fasterxml.jackson.core:jackson-databind`: affected `>=2.10.0, <2.14.0`, fixed in `2.14.0` · CVSS 6.3 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service - [MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering](https://agentprime.io/advisories/CVE-2025-71382.md) `CVE-2025-71382` · CVE record: ArtifexSoftware mupdf · CVSS 7.1 High · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service - [Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)](https://agentprime.io/advisories/GHSA-xp79-5mx3-jx52.md) `GHSA-xp79-5mx3-jx52`, `CVE-2026-52814`, `GO-2026-5765` · Go `gogs.io/gogs`: affected `<0.14.3`, fixed in `0.14.3` · CVSS 5.5 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service - [dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling](https://agentprime.io/advisories/CVE-2026-56116.md) `CVE-2026-56116` · CVE record: NetworkConfiguration dhcpcd · CVSS 7.1 High · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service - [Duplicate Advisory: ImageMagick: Memory leak in coders/txt.c without freetype](https://agentprime.io/advisories/GHSA-98gv-6gmj-cm6m.md) `GHSA-98gv-6gmj-cm6m` · NuGet `Magick.NET-Q16-AnyCPU`: affected `<14.10.3`, fixed in `14.10.3` · CVSS 0.0 None · Withdrawn · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service - [Duplicate Advisory: Traefik vulnerable to HTTP/2 request causing denial of service](https://agentprime.io/advisories/GHSA-pvrg-q6jw-42p7.md) `GHSA-pvrg-q6jw-42p7` · Go `github.com/traefik/traefik`: affected `<2.10.5`, fixed in `2.10.5` · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service - [Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy](https://agentprime.io/advisories/CVE-2026-56248.md) `CVE-2026-56248` · CVE record: Cap-go capgo · CVSS 8.7 High · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service - [An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61028.md) `CVE-2025-61028` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection, Denial of service - [An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61025.md) `CVE-2025-61025` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection, Denial of service - [Out-of-bounds read in Bluetooth Classic SDP attribute parsing (\`bt_sdp_parse_attribute\`)](https://agentprime.io/advisories/CVE-2026-10651.md) `CVE-2026-10651` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service, CWE-20 - [skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery](https://agentprime.io/advisories/GHSA-74p7-6h78-gw8p.md) `GHSA-74p7-6h78-gw8p` · crates.io `skillctl`: affected `<0.1.3`, fixed in `0.1.3` · No CVSS score · Not analysed yet · Published 22 Jun 2026 · Tags: Path traversal, Command injection, Other injection, Denial of service - [Gophish contains a denial of service vulnerability](https://agentprime.io/advisories/GHSA-42jc-v69j-g38f.md) `GHSA-42jc-v69j-g38f`, `CVE-2026-39904`, `GO-2026-6212` · Go `github.com/gophish/gophish`: affected `<=0.12.1`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service - [Capgo - Rate Limit Bypass via User-Controlled device_id Parameter](https://agentprime.io/advisories/CVE-2026-56324.md) `CVE-2026-56324` · CVE record: Capgo Capgo · CVSS 8.8 High · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service - [Capgo - Denial of Service via Unlimited Demo App Creation](https://agentprime.io/advisories/CVE-2026-56255.md) `CVE-2026-56255` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service - [Grafana: Pre-authentication denial of service in the public dashboard query handler](https://agentprime.io/advisories/GHSA-3w66-95m3-8jxg.md) `GHSA-3w66-95m3-8jxg`, `BIT-grafana-2026-42127`, `CVE-2026-42127`, `GO-2026-6541` · Go `github.com/grafana/grafana`: affected `<1.9.2-0.20260616075434-82ef13993059 || >=2.0.0-beta1 || >=12.0.0 || >=12.3.0 || >=12.4.0 || >=13.0.0`, fixed in `1.9.2-0.20260616075434-82ef13993059` · CVSS 7.5 High · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service - [IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-9320.md) `CVE-2026-9320` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .