# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption](https://agentprime.io/advisories/CVE-2026-9071.md)
  `CVE-2026-9071` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 7.5 High · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service
- [Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.](https://agentprime.io/advisories/CVE-2024-54178.md)
  `CVE-2024-54178` · CVE record: IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data · CVSS 6.5 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service
- [Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly](https://agentprime.io/advisories/GHSA-4w2j-m93h-cj5j.md)
  `GHSA-4w2j-m93h-cj5j`, `CVE-2026-25800`, `RUSTSEC-2026-0185` · crates.io `quinn-proto`: affected `>=0.0.0-0, <0.11.15`, fixed in `0.11.15` · CVSS 7.5 High · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service
- [Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service](https://agentprime.io/advisories/GHSA-vfm7-4h43-gp6m.md)
  `GHSA-vfm7-4h43-gp6m` · PyPI `vllm`: affected `>=0.6.3, <0.9.0`, fixed in `0.9.0` · CVSS 4.3 Medium · Withdrawn · Not analysed yet · Published 20 Jun 2026 · Tags: Denial of service
- [SurrealDB: Denial of Service via deep operator chains](https://agentprime.io/advisories/GHSA-jv2j-mqmw-xvv5.md)
  `GHSA-jv2j-mqmw-xvv5`, `CVE-2026-63737` · crates.io `surrealdb`: affected `>=3.0.0, <3.1.5`, fixed in `3.1.5` · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size](https://agentprime.io/advisories/GHSA-4xgf-cpjx-pc3j.md)
  `GHSA-4xgf-cpjx-pc3j`, `CVE-2026-58203` · PyPI `pydantic-settings`: affected `>=2.12.0, <2.14.2`, fixed in `2.14.2` · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Path traversal, Denial of service
- [SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in \`web_url_read\`](https://agentprime.io/advisories/GHSA-xcqx-9jf5-w339.md)
  `GHSA-xcqx-9jf5-w339`, `CVE-2026-58483` · npm `mcp-searxng`: affected `<1.7.1`, fixed in `1.7.1` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [OpenBao: Transit secrets engine crashes on key creation with \`derived: true\` for asymmetric key types](https://agentprime.io/advisories/GHSA-8w8f-r2xv-4q4j.md)
  `GHSA-8w8f-r2xv-4q4j`, `BIT-openbao-2026-55776`, `CVE-2026-55776`, `GO-2026-5267` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260617104123-db57c62602b2 || >=0.1.0, <=2.5.4`, fixed in `0.0.0-20260617104123-db57c62602b2` · CVSS 6.5 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [Grafana Tempo vulnerable to an out-of-memory crash](https://agentprime.io/advisories/GHSA-6xff-cpcq-vpw2.md)
  `GHSA-6xff-cpcq-vpw2`, `CVE-2026-27878`, `GO-2026-6325` · Go `github.com/grafana/tempo`: affected `<1.5.1-0.20260303204923-b13f74291d48`, fixed in `1.5.1-0.20260303204923-b13f74291d48` · CVSS 6.5 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [Langflow: Unauthenticated DoS through multipart form boundary file upload](https://agentprime.io/advisories/GHSA-qwqc-p3q8-wcg9.md)
  `GHSA-qwqc-p3q8-wcg9`, `CVE-2026-55446`, `PYSEC-2026-223` · PyPI `langflow`: affected `<1.0.19`, fixed in `1.0.19` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [py7zr: O(n^2) algorithmic complexity DoS in PackInfo.\_read()](https://agentprime.io/advisories/GHSA-h4gh-22qq-72r7.md)
  `GHSA-h4gh-22qq-72r7`, `CVE-2026-55206`, `PYSEC-2026-2973` · PyPI `py7zr`: affected `<1.1.3`, fixed in `1.1.3` · CVSS 8.7 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser](https://agentprime.io/advisories/GHSA-p5wc-9w9r-m232.md)
  `GHSA-p5wc-9w9r-m232` · PyPI `ultimate-sitemap-parser`: affected `<1.8.1`, fixed in `1.8.1` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit](https://agentprime.io/advisories/GHSA-8823-qg2x-pv9f.md)
  `GHSA-8823-qg2x-pv9f` · PyPI `ultimate-sitemap-parser`: affected `<1.8.1`, fixed in `1.8.1` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [Concurrent Ruby : \`AtomicReference#update\` livelocks when the stored value is \`Float::NAN\`](https://agentprime.io/advisories/GHSA-h8w8-99g7-qmvj.md)
  `GHSA-h8w8-99g7-qmvj`, `CVE-2026-54904` · RubyGems `concurrent-ruby`: affected `<1.3.7`, fixed in `1.3.7` · CVSS 8.2 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)](https://agentprime.io/advisories/GHSA-v52w-28xh-v562.md)
  `GHSA-v52w-28xh-v562` · npm `kozou` and 3 more: affected `<1.8.1`, fixed in `1.8.1` · CVSS 4.0, no score published · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service, CWE-272, CWE-346, CWE-1188
- [CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake](https://agentprime.io/advisories/GHSA-p86g-xrr2-pf7c.md)
  `GHSA-p86g-xrr2-pf7c`, `CVE-2026-54772` · NuGet `CoreWCF.NetFramingBase`: affected `<1.8.1 || >=1.9.0, <1.9.1`, fixed in `1.8.1`, `1.9.1` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [Python Liquid: Infinite loop when parsing malformed \`{% case %}\` tags](https://agentprime.io/advisories/GHSA-vq2f-vcc9-j8mv.md)
  `GHSA-vq2f-vcc9-j8mv`, `CVE-2026-55865`, `PYSEC-2026-3035` · PyPI `python-liquid`: affected `<2.2.1`, fixed in `2.2.1` · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [libde265 has an unbounded memory leak via orphaned slice headers in \`read_slice_NAL\`](https://agentprime.io/advisories/CVE-2026-49337.md)
  `CVE-2026-49337` · CVE record: strukturag libde265 · CVSS 4.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters](https://agentprime.io/advisories/GHSA-98m9-hrrm-r99r.md)
  `GHSA-98m9-hrrm-r99r`, `CVE-2026-54297` · RubyGems `faraday`: affected `>=1.0.0, <1.10.6 || >=2.0.0, <2.14.3`, fixed in `1.10.6`, `2.14.3` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [symfony/ux-live-component: Denial of service via unbounded batch action requests](https://agentprime.io/advisories/GHSA-mm82-c99c-h2cf.md)
  `GHSA-mm82-c99c-h2cf`, `CVE-2026-49209`, `PKSA-tv34-cfvx-rr9r` · Packagist `symfony/ux-live-component`: affected `>=2.5.0, <2.36.0 || >=3.0.0, <3.1.0`, fixed in `2.36.0`, `3.1.0` · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [containerd image-triggered runtime DoS via unbounded group parsing](https://agentprime.io/advisories/GHSA-jpcc-p29g-p8mq.md)
  `GHSA-jpcc-p29g-p8mq`, `CVE-2026-47262`, `GO-2026-5475` · Go `github.com/containerd/containerd` and 1 more: affected `>=1.7.0, <1.7.33`, fixed in `1.7.33` · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [parse-server: Denial of service via exponential-time processing of deeply nested query operators](https://agentprime.io/advisories/GHSA-cgxm-vr2f-6fj8.md)
  `GHSA-cgxm-vr2f-6fj8`, `BIT-parse-2026-57480`, `CVE-2026-57480` · npm `parse-server`: affected `<8.6.82 || >=9.0.0, <9.9.1-alpha.12`, fixed in `8.6.82`, `9.9.1-alpha.12` · CVSS 8.7 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [undici WebSocket client vulnerable to denial of service via fragment count bypass](https://agentprime.io/advisories/GHSA-vxpw-j846-p89q.md)
  `GHSA-vxpw-j846-p89q`, `CVE-2026-12151` · npm `undici`: affected `<6.27.0 || >=7.0.0, <7.28.0 || >=8.0.0, <8.5.0`, fixed in `6.27.0`, `7.28.0`, `8.5.0` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [Memory leak in NI grpc-device BeginSidebandStream](https://agentprime.io/advisories/CVE-2026-48141.md)
  `CVE-2026-48141` · CVE record: NI grpc-device and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform](https://agentprime.io/advisories/CVE-2025-7737.md)
  `CVE-2025-7737` · CVE record: Hitachi Hitachi Virtual Storage Platform E990, E1090, E1090H and 4 more · CVSS 8.6 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service
- [PHP JWT Library: PBES2-HS\*+A\*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service](https://agentprime.io/advisories/GHSA-3prj-6hqw-cm82.md)
  `GHSA-3prj-6hqw-cm82` · Packagist `web-token/jwt-framework` and 1 more: affected `<3.4.10 || >=4.0.0, <4.0.7 || >=4.1.0, <4.1.7`, fixed in `3.4.10`, `4.0.7`, `4.1.7` · CVSS 4.0, no score published · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation](https://agentprime.io/advisories/GHSA-g7m4-839x-ch6v.md)
  `GHSA-g7m4-839x-ch6v`, `PKSA-kbc7-dq62-pt7d` · Packagist `spomky-labs/otphp`: affected `<11.4.3`, fixed in `11.4.3` · CVSS 4.0, no score published · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service, CWE-1284
- [Uncontrolled resource consumption in node](https://agentprime.io/advisories/CVE-2026-48937.md)
  `CVE-2026-48937` · CVE record: nodejs node · CVSS 5.3 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [pam_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication](https://agentprime.io/advisories/CVE-2026-48986.md)
  `CVE-2026-48986` · CVE record: mcdope pam_usb · CVSS 4.7 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [AutoGPT has a DoS vulnerability in MediaDurationBlock](https://agentprime.io/advisories/CVE-2025-32437.md)
  `CVE-2025-32437` · CVE record: Significant-Gravitas AutoGPT · CVSS 8.7 High · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [AutoGPT has a DoS vulnerability in AddAudioToVideoBlock](https://agentprime.io/advisories/CVE-2025-32436.md)
  `CVE-2025-32436` · CVE record: Significant-Gravitas AutoGPT · CVSS 7.1 High · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock](https://agentprime.io/advisories/CVE-2025-32424.md)
  `CVE-2025-32424` · CVE record: Significant-Gravitas AutoGPT · CVSS 8.7 High · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock](https://agentprime.io/advisories/CVE-2025-32422.md)
  `CVE-2025-32422` · CVE record: Significant-Gravitas AutoGPT · CVSS 8.7 High · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [AutoGPT has a DoS vulnerability in LoopVideoBlock](https://agentprime.io/advisories/CVE-2025-32392.md)
  `CVE-2025-32392` · CVE record: Significant-Gravitas AutoGPT · CVSS 8.7 High · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint](https://agentprime.io/advisories/CVE-2026-55205.md)
  `CVE-2026-55205` · CVE record: nesquena hermes-webui · CVSS 6.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [pypdf: Missing stream length values ignore defined limits](https://agentprime.io/advisories/GHSA-jm82-fx9c-mx94.md)
  `GHSA-jm82-fx9c-mx94`, `CVE-2026-57204` · PyPI `pypdf`: affected `<6.13.3`, fixed in `6.13.3` · CVSS 6.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [undici WebSocket client vulnerable to denial of service via cumulative fragment bypass](https://agentprime.io/advisories/GHSA-38rv-x7px-6hhq.md)
  `GHSA-38rv-x7px-6hhq`, `CVE-2026-9675` · npm `undici`: affected `>=8.0.0, <8.5.0`, fixed in `8.5.0` · CVSS 7.5 High · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables](https://agentprime.io/advisories/GHSA-47qp-hqvx-6r3f.md)
  `GHSA-47qp-hqvx-6r3f`, `CVE-2026-56740` · Maven `org.jline:jline-remote-telnet`: affected `>=4.1.0, <4.2.1 || >=4.0.0, <4.0.16 || <3.30.14`, fixed in `4.2.1`, `4.0.16`, `3.30.14` · CVSS 7.5 High · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry](https://agentprime.io/advisories/GHSA-2r2c-cx56-8933.md)
  `GHSA-2r2c-cx56-8933`, `CVE-2026-56741` · Maven `org.jline:jline-remote-telnet`: affected `>=4.1.0, <4.2.1 || >=4.0.0, <4.0.16 || <3.30.14`, fixed in `4.2.1`, `4.0.16`, `3.30.14` · CVSS 7.5 High · Not analysed yet · Published 18 Jun 2026 · Tags: Denial of service
- [NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation](https://agentprime.io/advisories/GHSA-3w5p-95mh-gq75.md)
  `GHSA-3w5p-95mh-gq75`, `CVE-2026-55254` · NuGet `NCalc.Core` and 1 more: affected `<6.1.1`, fixed in `6.1.1` · CVSS 4.8 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Memory corruption, Denial of service
- [HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS](https://agentprime.io/advisories/GHSA-fxj4-p9xp-37v5.md)
  `GHSA-fxj4-p9xp-37v5`, `CVE-2026-55470` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.convertors` and 3 more: affected `<6.9.10`, fixed in `6.9.10` · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: Denial of service
- [libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler](https://agentprime.io/advisories/CVE-2026-55199.md)
  `CVE-2026-55199` · CVE record: libssh2 libssh2 · CVSS 8.2 High · Not analysed yet · Published 17 Jun 2026 · Tags: Denial of service
- [Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak](https://agentprime.io/advisories/GHSA-x223-p2gf-v735.md)
  `GHSA-x223-p2gf-v735`, `CVE-2026-55450`, `PYSEC-2026-224` · PyPI `langflow`: affected `<1.9.1`, fixed in `1.9.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Information disclosure, Authentication bypass, Denial of service
- [Multer vulnerable to Denial of Service via deeply nested field names](https://agentprime.io/advisories/GHSA-72gw-mp4g-v24j.md)
  `GHSA-72gw-mp4g-v24j`, `CVE-2026-5079` · npm `multer`: affected `>=1.0.0, <2.2.0 || >=3.0.0-alpha.1, <3.0.0-alpha.2`, fixed in `2.2.0`, `3.0.0-alpha.2` · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: Denial of service
- [Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification](https://agentprime.io/advisories/CVE-2026-47774.md)
  `CVE-2026-47774` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: Denial of service, CWE-405, CWE-409
- [Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoS](https://agentprime.io/advisories/CVE-2026-54417.md)
  `CVE-2026-54417` · CVE record: rxi microtar · CVSS 8.7 High · Not analysed yet · Published 17 Jun 2026 · Tags: Memory corruption, Denial of service
- [WEB SERVICE (HTTP) DENIAL OF SERVICE VIA SLOW HEADERS ON REGESTA SMART HD-PLC OF TELDAT](https://agentprime.io/advisories/CVE-2026-27869.md)
  `CVE-2026-27869` · CVE record: Teldat Regesta Smart HD-PLC - TLDPH16D2 · CVSS 6.9 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Google Android](https://agentprime.io/advisories/CVE-2026-28575.md)
  `CVE-2026-28575` · CVE record: Google Android · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Google Android](https://agentprime.io/advisories/CVE-2026-0064.md)
  `CVE-2026-0064` · CVE record: Google Android · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Denial of service
- [Improper privilege management in Oracle Corporation Oracle Solaris](https://agentprime.io/advisories/CVE-2026-46914.md)
  `CVE-2026-46914` · CVE record: Oracle Corporation Oracle Solaris · CVSS 7.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Denial of service
- [Missing authentication in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-46910.md)
  `CVE-2026-46910` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Information disclosure, Broken access control, Authentication bypass, Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Enterprise Manager Base Platform](https://agentprime.io/advisories/CVE-2026-46866.md)
  `CVE-2026-46866` · CVE record: Oracle Corporation Oracle Enterprise Manager Base Platform · CVSS 8.2 High · Not analysed yet · Published 16 Jun 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-46863.md)
  `CVE-2026-46863` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation MySQL Router](https://agentprime.io/advisories/CVE-2026-46862.md)
  `CVE-2026-46862` · CVE record: Oracle Corporation MySQL Router · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Denial of service
- [vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-q8gq-377p-jq3r.md)
  `GHSA-q8gq-377p-jq3r`, `CVE-2026-41523`, `PYSEC-2026-2300` · PyPI `vllm`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Code injection, Denial of service
- [Rockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-0646.md)
  `CVE-2026-0646` · CVE record: Rockwell Automation FLEX I/O EtherNet/IP Adapters · CVSS 8.7 High · Not analysed yet · Published 16 Jun 2026 · Tags: Denial of service
- [Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning](https://agentprime.io/advisories/GHSA-g75f-g53v-794x.md)
  `GHSA-g75f-g53v-794x` · PyPI `bleach`: affected `=6.3.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Denial of service
- [pypdf: Possible infinite loop when processing outlines/bookmarks in writer](https://agentprime.io/advisories/GHSA-m2v9-299j-rv96.md)
  `GHSA-m2v9-299j-rv96`, `CVE-2026-54531`, `PYSEC-2026-3022` · PyPI `pypdf`: affected `<6.13.0`, fixed in `6.13.0` · CVSS 6.9 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Denial of service
- [pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction](https://agentprime.io/advisories/GHSA-52x6-gq3r-vpf4.md)
  `GHSA-52x6-gq3r-vpf4`, `CVE-2026-54530`, `PYSEC-2026-3009` · PyPI `pypdf`: affected `<6.13.0`, fixed in `6.13.0` · CVSS 6.9 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Denial of service
- [pypdf: Possible large memory usage for form XObjects during text extraction](https://agentprime.io/advisories/GHSA-j543-4vmf-qm7v.md)
  `GHSA-j543-4vmf-qm7v`, `CVE-2026-49461`, `PYSEC-2026-3020` · PyPI `pypdf`: affected `<6.12.2`, fixed in `6.12.2` · CVSS 6.9 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTA2LTE2VDEzOjQ3OjA4LjAwMDAwMFoiLCJHSFNBLWo1NDMtNHZtZi1xbTd2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTA2LTIyVDE0OjUzOjM2LjA1NzAwMFoiLCJDVkUtMjAyNi05MzIwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTA2LTIyVDE0OjUzOjM2LjA1NzAwMFoiLCJDVkUtMjAyNi05MzIwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.