# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [BIG-IP HTTP/2 vulnerability](https://agentprime.io/advisories/CVE-2026-59762.md)
  `CVE-2026-59762` · CVE record: F5 BIG-IP and 3 more · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service
- [DoS vulnerability in the vibration service.](https://agentprime.io/advisories/CVE-2026-58559.md)
  `CVE-2026-58559` · CVE record: Huawei Harmony OS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service
- [Resource allocation without limits in ASUS System Control Interface v3 and others](https://agentprime.io/advisories/CVE-2026-13585.md)
  `CVE-2026-13585` · CVE record: ASUS System Control Interface v3 and 2 more · CVSS 8.2 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service, CWE-226
- [Uncontrolled recursion in BusyBox](https://agentprime.io/advisories/CVE-2026-38755.md)
  `CVE-2026-38755` · CVE record: BusyBox BusyBox · CVSS 2.9 Low · Not analysed yet · Published 15 Jul 2026 · Tags: Memory corruption, Denial of service
- [Uncontrolled recursion in BusyBox](https://agentprime.io/advisories/CVE-2026-38752.md)
  `CVE-2026-38752` · CVE record: BusyBox BusyBox · CVSS 2.9 Low · Not analysed yet · Published 15 Jul 2026 · Tags: Memory corruption, Denial of service
- [An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component](https://agentprime.io/advisories/CVE-2026-36590.md)
  `CVE-2026-36590` · CVE record · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service
- [CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)](https://agentprime.io/advisories/CVE-2026-48357.md)
  `CVE-2026-48357` · CVE record: Adobe Content Credentials Rust SDK and 2 more · CVSS 6.2 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting](https://agentprime.io/advisories/GHSA-m3cx-mwpg-32jg.md)
  `GHSA-m3cx-mwpg-32jg`, `CVE-2026-55512`, `GO-2026-5989` · Go `github.com/forgekeep/nebula-mesh`: affected `>=0.2.0, <0.5.0`, fixed in `0.5.0` · CVSS 5.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder](https://agentprime.io/advisories/GHSA-vhch-2wf3-m8rp.md)
  `GHSA-vhch-2wf3-m8rp`, `CVE-2026-44891` · Maven `io.netty:netty-codec-stomp`: affected `>=4.2.0.Alpha1, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Resource allocation without limits in NVIDIA TensorRT-LLM](https://agentprime.io/advisories/CVE-2026-24271.md)
  `CVE-2026-24271` · CVE record: NVIDIA TensorRT-LLM · CVSS 6.2 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Reachable assertion in NVIDIA TensorRT-LLM](https://agentprime.io/advisories/CVE-2026-47475.md)
  `CVE-2026-47475` · CVE record: NVIDIA TensorRT-LLM · CVSS 6.2 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Ech0: ParseAcceptLanguage \`\_\` separator bypass enables \~70x CPU amplification via Accept-Language header in i18n.Middleware](https://agentprime.io/advisories/GHSA-mqxv-9rm6-w8qc.md)
  `GHSA-mqxv-9rm6-w8qc`, `GO-2026-5981` · Go `github.com/lin-snow/ech0`: affected `*`, no fixed version yet · CVSS 4.0, no score published · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser](https://agentprime.io/advisories/GHSA-q3fv-x8vg-qqm4.md)
  `GHSA-q3fv-x8vg-qqm4`, `CVE-2026-54448`, `GO-2026-5983` · Go `github.com/aquasecurity/trivy`: affected `<0.71.0`, fixed in `0.71.0` · CVSS 6.9 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Memory leak in NVIDIA Triton Inference Server](https://agentprime.io/advisories/CVE-2026-47482.md)
  `CVE-2026-47482` · CVE record: NVIDIA Triton Inference Server · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in NVIDIA Triton Inference Server](https://agentprime.io/advisories/CVE-2026-47479.md)
  `CVE-2026-47479` · CVE record: NVIDIA Triton Inference Server · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak](https://agentprime.io/advisories/CVE-2026-15713.md)
  `CVE-2026-15713` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation](https://agentprime.io/advisories/CVE-2026-15711.md)
  `CVE-2026-15711` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in NVIDIA Triton Inference Server](https://agentprime.io/advisories/CVE-2026-47476.md)
  `CVE-2026-47476` · CVE record: NVIDIA Triton Inference Server · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [MKP: Unbounded Pod Log Read via Attacker-Controlled \`limitBytes\`/\`tailLines\` Causes Memory Exhaustion](https://agentprime.io/advisories/GHSA-qw5r-ppcg-f8rj.md)
  `GHSA-qw5r-ppcg-f8rj`, `CVE-2026-50125`, `GO-2026-5978` · Go `github.com/StacklokLabs/mkp`: affected `<0.4.1`, fixed in `0.4.1` · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions](https://agentprime.io/advisories/GHSA-42j2-w334-qxw7.md)
  `GHSA-42j2-w334-qxw7`, `CVE-2026-50018`, `GO-2026-5975` · Go `github.com/SpectoLabs/hoverfly`: affected `<1.12.8`, fixed in `1.12.8` · CVSS 6.5 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Wasmtime: Memory leak in C API with \`externref\` and \`anyref\` types](https://agentprime.io/advisories/GHSA-vvp9-h8p2-xwfc.md)
  `GHSA-vvp9-h8p2-xwfc`, `CVE-2025-61670`, `PYSEC-2025-268` · crates.io `wasmtime-c-api-impl` and 1 more: affected `>=37.0.0, <37.0.2`, fixed in `37.0.2` · CVSS 1.0 Low · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Infinite loop on invalid input in golang.org/x/text](https://agentprime.io/advisories/GO-2026-5970.md)
  `GO-2026-5970`, `CVE-2026-56852` · Go `golang.org/x/text`: affected `<0.39.0`, fixed in `0.39.0` · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Windows DHCP Server Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-58627.md)
  `CVE-2026-58627` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Active Directory Federation Server Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-50647.md)
  `CVE-2026-50647` · CVE record: Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Windows Active Directory Federation Services Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-50324.md)
  `CVE-2026-50324` · CVE record: Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-49799.md)
  `CVE-2026-49799` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [HTTP/2 Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-49788.md)
  `CVE-2026-49788` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [HTTP.sys Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-49787.md)
  `CVE-2026-49787` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-45646.md)
  `CVE-2026-45646` · CVE record: Microsoft AspNet.OData and 1 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-40378.md)
  `CVE-2026-40378` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Windows Secure Channel Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-44806.md)
  `CVE-2026-44806` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Azure Active Directory Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-50653.md)
  `CVE-2026-50653` · CVE record: Microsoft Azure Active Directory and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Windows Active Directory Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-54119.md)
  `CVE-2026-54119` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-50506.md)
  `CVE-2026-50506` · CVE record: Microsoft AspNet.OData and 1 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Resource exhaustion in quiche HTTP/3 and QPACK layers](https://agentprime.io/advisories/CVE-2026-12523.md)
  `CVE-2026-12523` · CVE record: Cloudflare quiche · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Infinite loop in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-62642.md)
  `CVE-2026-62642` · CVE record: Roundcube Webmail · CVSS 4.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Resource allocation without limits in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-62641.md)
  `CVE-2026-62641` · CVE record: Roundcube Webmail · CVSS 4.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [DBI::ProfileData versions before 1.651 for Perl do not limit the path index](https://agentprime.io/advisories/CVE-2026-60081.md)
  `CVE-2026-60081` · CVE record: HMBRAND DBI::ProfileData · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Unbounded path event queue growth in quiche via peer-driven source connection ID rotation](https://agentprime.io/advisories/CVE-2026-12707.md)
  `CVE-2026-12707` · CVE record: Cloudflare quiche · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [1734 POINT I/OTM - Denial of Service via Malformed Inputs on CIP Object](https://agentprime.io/advisories/CVE-2026-10573.md)
  `CVE-2026-10573` · CVE record: Rockwell Automation 1734 POINT I/O · CVSS 6.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [1718-AENTR/1719-AENTR - Denial of Service](https://agentprime.io/advisories/CVE-2026-9140.md)
  `CVE-2026-9140` · CVE record: Rockwell Automation 1718-AENTR/1719-AENTR · CVSS 8.7 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [open62541 Shared Client ua_client_connect.c responseReadNamespacesArray null pointer dereference](https://agentprime.io/advisories/CVE-2026-15690.md)
  `CVE-2026-15690` · CVE record: open62541 · CVSS 2.3 Low · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service, Memory corruption
- [Resource allocation without limits in Siemens SIMATIC S7-PLCSIM Advanced](https://agentprime.io/advisories/CVE-2026-54429.md)
  `CVE-2026-54429` · CVE record: Siemens SIMATIC S7-PLCSIM Advanced · CVSS 6.0 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory](https://agentprime.io/advisories/GHSA-8pf6-g464-h6h9.md)
  `GHSA-8pf6-g464-h6h9`, `CVE-2026-59246`, `EEF-CVE-2026-59246` · Hex `mint`: affected `>=0.1.0, <1.9.2`, fixed in `1.9.2` · CVSS 6.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS](https://agentprime.io/advisories/GHSA-qrfr-wh4c-3qhw.md)
  `GHSA-qrfr-wh4c-3qhw`, `CVE-2026-58229`, `EEF-CVE-2026-58229` · Hex `mint`: affected `>=0.1.0, <1.9.2`, fixed in `1.9.2` · CVSS 8.2 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic.](https://agentprime.io/advisories/CVE-2025-56365.md)
  `CVE-2025-56365` · CVE record · CVSS 5.7 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic.](https://agentprime.io/advisories/CVE-2025-56362.md)
  `CVE-2025-56362` · CVE record · CVSS 5.7 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (\`emberAfLevelControlClusterServerTickCa…](https://agentprime.io/advisories/CVE-2025-56361.md)
  `CVE-2025-56361` · CVE record · CVSS 5.7 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [json_repair: Circular JSON Schema \`$ref\` causes unbounded CPU DoS](https://agentprime.io/advisories/GHSA-xf7x-x43h-rpqh.md)
  `GHSA-xf7x-x43h-rpqh` · PyPI `json-repair`: affected `<0.60.1`, fixed in `0.60.1` · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: Denial of service
- [HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter](https://agentprime.io/advisories/CVE-2026-58486.md)
  `CVE-2026-58486` · CVE record: hedgedoc hedgedoc · CVSS 8.3 High · Not analysed yet · Published 13 Jul 2026 · Tags: Denial of service, CWE-409
- [HedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofing](https://agentprime.io/advisories/CVE-2026-58488.md)
  `CVE-2026-58488` · CVE record: hedgedoc hedgedoc · CVSS 6.9 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Authentication bypass, Denial of service
- [vsock/virtio: fix zerocopy completion for multi-skb sends](https://agentprime.io/advisories/CVE-2026-53365.md)
  `CVE-2026-53365` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 13 Jul 2026 · Tags: Denial of service
- [Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost](https://agentprime.io/advisories/CVE-2026-6850.md)
  `CVE-2026-6850` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Denial of service
- [A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows.](https://agentprime.io/advisories/CVE-2026-51539.md)
  `CVE-2026-51539` · CVE record · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: Denial of service
- [Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver](https://agentprime.io/advisories/CVE-2026-10668.md)
  `CVE-2026-10668` · CVE record: zephyrproject zephyr · CVSS 2.4 Low · Not analysed yet · Published 12 Jul 2026 · Tags: Denial of service
- [h2o: musl libc stack overflow (QPACK)](https://agentprime.io/advisories/CVE-2026-55213.md)
  `CVE-2026-55213` · CVE record: h2o h2o · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service
- [RabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS](https://agentprime.io/advisories/CVE-2026-57220.md)
  `CVE-2026-57220` · CVE record: rabbitmq rabbitmq-server · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service
- [RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size](https://agentprime.io/advisories/CVE-2026-57212.md)
  `CVE-2026-57212` · CVE record: rabbitmq rabbitmq-server · CVSS 7.1 High · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service
- [CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources](https://agentprime.io/advisories/GHSA-9mqm-qcwf-5qhg.md)
  `GHSA-9mqm-qcwf-5qhg` · PyPI `credsweeper`: affected `>=1.4.9, <1.16.0`, fixed in `1.16.0` · CVSS 5.5 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service, CWE-409
- [Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)](https://agentprime.io/advisories/GHSA-h69g-9hx6-f3v4.md)
  `GHSA-h69g-9hx6-f3v4`, `CVE-2026-54063`, `GO-2026-5960` · Go `github.com/xuri/excelize/v2`: affected `<2.11.0`, fixed in `2.11.0` · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTA3LTEwVDE5OjI1OjIwLjAwMDAwMFoiLCJHSFNBLWg2OWctOWh4Ni1mM3Y0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTA3LTE1VDE3OjQ0OjI4LjAwMDAwMFoiLCJHSFNBLXJ2NDgtcXFqNS1jcnhnIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTA3LTE1VDE3OjQ0OjI4LjAwMDAwMFoiLCJHSFNBLXJ2NDgtcXFqNS1jcnhnIl0>. Everything for agents: <https://agentprime.io/llms.txt>.