# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol](https://agentprime.io/advisories/CVE-2026-13708.md) `CVE-2026-13708` · CVE record: TONYC Imager::File::JPEG · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5](https://agentprime.io/advisories/GHSA-c59h-fq4p-r36r.md) `GHSA-c59h-fq4p-r36r`, `CVE-2026-56810`, `EEF-CVE-2026-56810` · Hex `mint`: affected `>=0.5.0, <1.9.1`, fixed in `1.9.1` · CVSS 8.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [Uncontrolled Resource Consumption vulnerability in Apache IoTDB.](https://agentprime.io/advisories/PYSEC-2026-2079.md) `PYSEC-2026-2079`, `CVE-2026-24012` · PyPI `apache-iotdb`: affected `>=1.3.3, <2.0.8`, fixed in `2.0.8` · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax](https://agentprime.io/advisories/GHSA-jj2p-32j7-whj2.md) `GHSA-jj2p-32j7-whj2`, `CVE-2026-58226`, `EEF-CVE-2026-58226` · Hex `hpax`: affected `>=0.1.1, <1.0.4`, fixed in `1.0.4` · CVSS 8.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service](https://agentprime.io/advisories/CVE-2026-9165.md) `CVE-2026-9165` · CVE record: Red Hat Red Hat Advanced Cluster Security 4.9 and 3 more · CVSS 7.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [GPAC TeXML File load_text.c txtin_probe_duration divide by zero](https://agentprime.io/advisories/CVE-2026-14801.md) `CVE-2026-14801` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [GPAC Media File write_nhml.c nhmldump_send_frame null pointer dereference](https://agentprime.io/advisories/CVE-2026-14790.md) `CVE-2026-14790` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service, Memory corruption - [Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder](https://agentprime.io/advisories/CVE-2026-14803.md) `CVE-2026-14803` · CVE record: SRI Mojo::JSON · CVSS 6.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [Unbounded page slicing from attacker-controlled CSS height causes denial of service](https://agentprime.io/advisories/GHSA-j5cx-ph8g-95v3.md) `GHSA-j5cx-ph8g-95v3`, `CVE-2026-68523`, `RUSTSEC-2026-0200` · crates.io `fulgur`: affected `>=0.0.0-0, <0.19.0`, fixed in `0.19.0` · CVSS 7.5 High · Not analysed yet · Published 5 Jul 2026 · Tags: Denial of service - [Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)](https://agentprime.io/advisories/GHSA-4rf6-qx84-q9fv.md) `GHSA-4rf6-qx84-q9fv`, `CVE-2026-68537`, `RUSTSEC-2026-0201` · crates.io `fulgur`: affected `>=0.0.0-0, <0.26.0`, fixed in `0.26.0` · CVSS 7.5 High · Not analysed yet · Published 5 Jul 2026 · Tags: Denial of service - [HdrHistogram AbstractHistogram.java memory allocation](https://agentprime.io/advisories/CVE-2026-14684.md) `CVE-2026-14684` · CVE record: HdrHistogram · CVSS 4.8 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Denial of service - [HdrHistogram AbstractHistogram.java memory allocation](https://agentprime.io/advisories/CVE-2026-14683.md) `CVE-2026-14683` · CVE record: HdrHistogram · CVSS 4.8 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Denial of service - [connorskees grass visitor denial of service](https://agentprime.io/advisories/CVE-2026-14651.md) `CVE-2026-14651` · CVE record: connorskees grass · CVSS 4.8 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Denial of service - [connorskees grass UTF-8 Character raw_to_parse_error denial of service](https://agentprime.io/advisories/CVE-2026-14650.md) `CVE-2026-14650` · CVE record: connorskees grass · CVSS 4.8 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Denial of service - [RT-Thread Parameter lwp_syscall.c sys_ioctl divide by zero](https://agentprime.io/advisories/CVE-2026-14629.md) `CVE-2026-14629` · CVE record: RT-Thread · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Denial of service - [NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service](https://agentprime.io/advisories/CVE-2026-14626.md) `CVE-2026-14626` · CVE record: NousResearch hermes-agent · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Denial of service - [omec-project amf NGSetupRequest handler.go denial of service](https://agentprime.io/advisories/CVE-2026-14624.md) `CVE-2026-14624` · CVE record: omec-project amf · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Denial of service - [omec-project amf NGAP Message RRCInactiveTransitionReport denial of service](https://agentprime.io/advisories/CVE-2026-14623.md) `CVE-2026-14623` · CVE record: omec-project amf · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Denial of service - [Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service](https://agentprime.io/advisories/CVE-2026-14618.md) `CVE-2026-14618` · CVE record: Open5GS · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Denial of service - [Gitea git grep searches allow server resource exhaustion](https://agentprime.io/advisories/GHSA-h9c5-x7g8-4q7f.md) `GHSA-h9c5-x7g8-4q7f`, `CVE-2026-26307`, `GO-2026-6341` · Go `code.gitea.io/gitea`: affected `<1.25.5`, fixed in `1.25.5` · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2026 · Tags: Denial of service - [WS Auto-PONG memory exhaustion](https://agentprime.io/advisories/CVE-2026-11586.md) `CVE-2026-11586` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2026 · Tags: Denial of service - [QUIC zero-length UDP datagrams busy-loop](https://agentprime.io/advisories/CVE-2026-11352.md) `CVE-2026-11352` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2026 · Tags: Denial of service - [IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload](https://agentprime.io/advisories/CVE-2026-50721.md) `CVE-2026-50721` · CVE record: The Libreswan Project libreswan · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Weak cryptography or TLS, Denial of service - [IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload](https://agentprime.io/advisories/CVE-2026-50722.md) `CVE-2026-50722` · CVE record: The Libreswan Project libreswan · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Weak cryptography or TLS, Denial of service - [IKEv2 Denial of Service via malformed fragmentation](https://agentprime.io/advisories/CVE-2026-12413.md) `CVE-2026-12413` · CVE record: The Libreswan Project libreswan · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service, CWE-193 - [golang.org/x/image/tiff has excessive resource consumption in PackBits decompression](https://agentprime.io/advisories/GHSA-q675-qj96-32m9.md) `GHSA-q675-qj96-32m9`, `CVE-2026-46599`, `GO-2026-5032` · Go `golang.org/x/image`: affected `<0.41.0`, fixed in `0.41.0` · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch](https://agentprime.io/advisories/GHSA-j8ph-6fxj-g533.md) `GHSA-j8ph-6fxj-g533`, `CVE-2026-50196` · NuGet `Steeltoe.Discovery.Eureka`: affected `<3.4.0 || >=4.0.0, <4.2.0`, fixed in `3.4.0`, `4.2.0` · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service, CWE-20 - [SimpleSAMLphp has Possible DoS via XPath Transform](https://agentprime.io/advisories/GHSA-5cjr-mxj5-wmrx.md) `GHSA-5cjr-mxj5-wmrx`, `CVE-2026-49289`, `PKSA-11bv-m3wk-h9sn`, `PKSA-1fc7-xrz7-vw78` · Packagist `simplesamlphp/saml2` and 1 more: affected `<4.19.3 || >=4.20.0, <4.20.3`, fixed in `4.19.3`, `4.20.3` · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update](https://agentprime.io/advisories/GHSA-63wg-wjjj-7cp8.md) `GHSA-63wg-wjjj-7cp8`, `CVE-2026-52829` · crates.io `zebrad` and 1 more: affected `<4.5.0`, fixed in `4.5.0` · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service, Memory corruption - [@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation](https://agentprime.io/advisories/GHSA-x4hg-hfwf-p9mw.md) `GHSA-x4hg-hfwf-p9mw` · npm `@asymmetric-effort/nogginlessdom`: affected `<0.0.22`, fixed in `0.0.22` · CVSS 4.0, no score published · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion](https://agentprime.io/advisories/GHSA-86vw-mfpg-wwv9.md) `GHSA-86vw-mfpg-wwv9`, `CVE-2026-52746` · npm `jsonata`: affected `<1.8.9 || >=2.0.0, <2.2.0`, fixed in `1.8.9`, `2.2.0` · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [zebrad has unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention](https://agentprime.io/advisories/GHSA-65jj-fmw8-468q.md) `GHSA-65jj-fmw8-468q`, `CVE-2026-52734` · crates.io `zebrad`: affected `<4.5.0`, fixed in `4.5.0` · CVSS 5.3 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length](https://agentprime.io/advisories/GHSA-h72h-ppcx-998p.md) `GHSA-h72h-ppcx-998p` · crates.io `zebrad` and 1 more: affected `<4.5.0`, fixed in `4.5.0` · CVSS 3.7 Low · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [Pathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document Store](https://agentprime.io/advisories/CVE-2026-59094.md) `CVE-2026-59094` · CVE record: pathwaycom pathway · CVSS 8.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [zebrad has mempool transaction admission denial via single-peer inbound queue saturation](https://agentprime.io/advisories/GHSA-4fc2-h7jh-287c.md) `GHSA-4fc2-h7jh-287c`, `CVE-2026-52732` · crates.io `zebrad`: affected `<4.5.0`, fixed in `4.5.0` · CVSS 5.3 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import](https://agentprime.io/advisories/CVE-2026-58578.md) `CVE-2026-58578` · CVE record: lobehub lobehub · CVSS 7.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers](https://agentprime.io/advisories/GHSA-c8w6-x74f-vmg3.md) `GHSA-c8w6-x74f-vmg3`, `CVE-2026-104434` · crates.io `zebrad` and 1 more: affected `<4.5.0`, fixed in `4.5.0` · CVSS 7.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service, CWE-20, CWE-248, CWE-754 - [zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length](https://agentprime.io/advisories/GHSA-443g-gwgp-49x4.md) `GHSA-443g-gwgp-49x4`, `CVE-2026-104436` · crates.io `zebra-chain` and 1 more: affected `<8.0.0`, fixed in `8.0.0` · CVSS 6.3 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields](https://agentprime.io/advisories/GHSA-525m-7f82-2mf7.md) `GHSA-525m-7f82-2mf7`, `CVE-2026-49250` · npm `@conform-to/dom`: affected `>=1.8.0, <1.19.4`, fixed in `1.19.4` · CVSS 8.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [Eclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoS](https://agentprime.io/advisories/CVE-2026-58465.md) `CVE-2026-58465` · CVE record: eclipse-wakaama wakaama · CVSS 8.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [SSH SFTP server denial of service via extended channel data infinite loop](https://agentprime.io/advisories/CVE-2026-54886.md) `CVE-2026-54886` · CVE record: Erlang OTP · CVSS 5.3 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [GetEndpoints Memory Exhaustion in open62541](https://agentprime.io/advisories/CVE-2026-11946.md) `CVE-2026-11946` · CVE record: open62541 project / o6 Automation GmbH open62541 · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Eclipse Foundation Eclipse Parsson](https://agentprime.io/advisories/CVE-2026-9563.md) `CVE-2026-9563` · CVE record: Eclipse Foundation Eclipse Parsson · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [FindServers Memory Exhaustion in open62541](https://agentprime.io/advisories/CVE-2026-33592.md) `CVE-2026-33592` · CVE record: open62541 project / o6 Automation GmbH open62541 · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C component](https://agentprime.io/advisories/CVE-2026-52192.md) `CVE-2026-52192` · CVE record · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go.](https://agentprime.io/advisories/CVE-2026-38970.md) `CVE-2026-38970` · CVE record · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service - [Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)](https://agentprime.io/advisories/GHSA-28pq-6qxg-wg5r.md) `GHSA-28pq-6qxg-wg5r`, `CVE-2026-48824`, `GO-2026-5868` · Go `github.com/axllent/mailpit`: affected `<1.30.1`, fixed in `1.30.1` · CVSS 5.3 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [SurrealDB vulnerable to pre-auth memory amplification via unbounded \`/sql\` WebSocket frames](https://agentprime.io/advisories/GHSA-65rj-r9fh-jp2v.md) `GHSA-65rj-r9fh-jp2v`, `CVE-2026-63750` · crates.io `surrealdb`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 6.9 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [SurrealDB vulnerable to Denial of Service due to nested types annotations](https://agentprime.io/advisories/GHSA-q8qp-67f9-wr3f.md) `GHSA-q8qp-67f9-wr3f`, `CVE-2026-63759` · crates.io `surrealdb`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 7.1 High · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [SurrealDB has Denial of Service in JSON parser due to nested objects](https://agentprime.io/advisories/GHSA-q729-696q-g9pq.md) `GHSA-q729-696q-g9pq`, `CVE-2026-63760` · crates.io `surrealdb`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK](https://agentprime.io/advisories/GHSA-v3jc-474w-2wm6.md) `GHSA-v3jc-474w-2wm6`, `CVE-2026-54428` · Maven `org.apache.httpcomponents.core5:httpcore5-h2`: affected `<5.4.3 || >=5.5-alpha1, <5.5-beta2`, fixed in `5.4.3`, `5.5-beta2` · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service](https://agentprime.io/advisories/GHSA-hf6x-8p5f-cgmf.md) `GHSA-hf6x-8p5f-cgmf`, `CVE-2026-54399` · Maven `org.apache.httpcomponents.core5:httpcore5`: affected `<5.4.3 || >=5.5-alpha1, <5.5-beta2`, fixed in `5.4.3`, `5.5-beta2` · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [Open Babel has out-of-bounds read in PQS lowerit (pre-buffer read)](https://agentprime.io/advisories/GHSA-m982-7q3h-r784.md) `GHSA-m982-7q3h-r784`, `CVE-2025-11000`, `PYSEC-2026-2785` · PyPI `openbabel`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 4.8 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Memory corruption, Denial of service - [Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt](https://agentprime.io/advisories/GHSA-55j6-rjhx-hwfh.md) `GHSA-55j6-rjhx-hwfh`, `CVE-2025-10999`, `PYSEC-2026-2772` · PyPI `openbabel`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 4.8 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service, Memory corruption - [Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines](https://agentprime.io/advisories/GHSA-j9pp-7wfg-q7fj.md) `GHSA-j9pp-7wfg-q7fj`, `CVE-2025-10998`, `PYSEC-2026-2782` · PyPI `openbabel`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 4.8 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service, Memory corruption - [Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-49090.md) `CVE-2026-49090` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-49087.md) `CVE-2026-49087` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [ClamAV InstallShield File Format Processing Resource Exhaustion Vulnerability](https://agentprime.io/advisories/CVE-2026-20216.md) `CVE-2026-20216` · CVE record: Cisco Cisco Secure Endpoint · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-56150.md) `CVE-2026-56150` · CVE record: Elastic Fleet Server · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-56149.md) `CVE-2026-56149` · CVE record: Elastic Elasticsearch · CVSS 4.9 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .