# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [adm-zip: Crafted ZIP file triggers 4GB memory allocation](https://agentprime.io/advisories/GHSA-xcpc-8h2w-3j85.md) `GHSA-xcpc-8h2w-3j85`, `CVE-2026-39244` · npm `adm-zip`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service - [NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields](https://agentprime.io/advisories/CVE-2026-55781.md) `CVE-2026-55781` · CVE record: M2Team NanaZip · CVSS 2.4 Low · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service - [NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size](https://agentprime.io/advisories/CVE-2026-55780.md) `CVE-2026-55780` · CVE record: M2Team NanaZip · CVSS 2.4 Low · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service, CWE-248 - [NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields](https://agentprime.io/advisories/CVE-2026-55782.md) `CVE-2026-55782` · CVE record: M2Team NanaZip · CVSS 2.4 Low · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service - [libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays](https://agentprime.io/advisories/GHSA-cwc9-cp4j-mcvv.md) `GHSA-cwc9-cp4j-mcvv`, `CVE-2026-49866` · npm `@libp2p/gossipsub`: affected `<16.0.0`, fixed in `16.0.0` · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service, CWE-20 - [Duplicate Advisory: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads](https://agentprime.io/advisories/GHSA-2vww-6p9h-5g8j.md) `GHSA-2vww-6p9h-5g8j` · npm `n8n`: affected `*`, no fixed version yet · CVSS 4.3 Medium · Withdrawn · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service - [Pre-authentication denial of service via the OAuth login route](https://agentprime.io/advisories/CVE-2026-8609.md) `CVE-2026-8609` · CVE record: Grafana Grafana OSS · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service - [Denial of service via unbounded request body size](https://agentprime.io/advisories/CVE-2026-33382.md) `CVE-2026-33382` · CVE record: Grafana Grafana OSS · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service - [Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint](https://agentprime.io/advisories/CVE-2026-56309.md) `CVE-2026-56309` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service - [Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)](https://agentprime.io/advisories/GHSA-95qv-c9g9-rm63.md) `GHSA-95qv-c9g9-rm63`, `CVE-2026-56814`, `EEF-CVE-2026-56814` · Hex `plug`: affected `>=1.4.0-rc.0, <1.16.6 || >=1.17.0, <1.17.4 || >=1.18.0, <1.18.5 || >=1.19.1, <1.19.5 || >=1.20.0, <1.20.3`, fixed in `1.16.6`, `1.17.4`, `1.18.5`, `1.19.5`, `1.20.3` · CVSS 6.9 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service - [Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError](https://agentprime.io/advisories/CVE-2026-40007.md) `CVE-2026-40007` · CVE record: Apache Software Foundation Apache IoTDB · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service - [Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver](https://agentprime.io/advisories/CVE-2026-40006.md) `CVE-2026-40006` · CVE record: Apache Software Foundation Apache IoTDB · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Authentication bypass, Denial of service - [Mistune: Potential DoS via quadratic-time parsing in parse_link_text](https://agentprime.io/advisories/GHSA-qcq2-496w-v96p.md) `GHSA-qcq2-496w-v96p`, `CVE-2026-49851`, `PYSEC-2026-2652` · PyPI `mistune`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 8.7 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [pdeljanov Symphonia Metadata denial of service](https://agentprime.io/advisories/CVE-2026-15276.md) `CVE-2026-15276` · CVE record: pdeljanov Symphonia · CVSS 4.8 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [lo48576 fbxcel Node Header parser.rs denial of service](https://agentprime.io/advisories/CVE-2026-15274.md) `CVE-2026-15274` · CVE record: lo48576 fbxcel · CVSS 4.8 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [pypdf: Possible infinite loop when processing threads/articles in writer](https://agentprime.io/advisories/GHSA-g9xf-7f8q-9mcj.md) `GHSA-g9xf-7f8q-9mcj`, `CVE-2026-54651`, `PYSEC-2026-3018` · PyPI `pypdf`: affected `<6.13.1`, fixed in `6.13.1` · CVSS 6.9 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [Junos OS: EX4100 Series, EX4400: With sFlow configured in a VC scenario multicast traffic leads to an FPC crash](https://agentprime.io/advisories/CVE-2026-57027.md) `CVE-2026-57027` · CVE record: Juniper Networks Junos OS · CVSS 7.1 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service](https://agentprime.io/advisories/GHSA-px5m-h76g-p7p8.md) `GHSA-px5m-h76g-p7p8`, `CVE-2026-52778`, `PKSA-hr3h-z8mz-dxgy` · Packagist `yeswiki/yeswiki`: affected `<4.6.6`, fixed in `4.6.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Code injection, Denial of service - [Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations](https://agentprime.io/advisories/CVE-2026-15308.md) `CVE-2026-15308` · CVE record: Python Software Foundation CPython · CVSS 8.7 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer](https://agentprime.io/advisories/CVE-2026-60108.md) `CVE-2026-60108` · CVE record: zeek zeek · CVSS 8.7 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint](https://agentprime.io/advisories/GHSA-7cmj-v6x8-frvv.md) `GHSA-7cmj-v6x8-frvv`, `CVE-2026-49485` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2` and 7 more: affected `>=6.9.5, <6.9.9 || <6.9.4.2`, fixed in `6.9.9`, `6.9.4.2` · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser](https://agentprime.io/advisories/GHSA-836r-79rf-4m37.md) `GHSA-836r-79rf-4m37`, `CVE-2026-49477`, `PYSEC-2026-3072` · PyPI `soupsieve`: affected `<2.8.4`, fixed in `2.8.4` · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists](https://agentprime.io/advisories/GHSA-2wc2-fm75-p42x.md) `GHSA-2wc2-fm75-p42x`, `CVE-2026-49476`, `PYSEC-2026-3071` · PyPI `soupsieve`: affected `<2.8.4`, fixed in `2.8.4` · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths](https://agentprime.io/advisories/GHSA-52vm-mxx8-f227.md) `GHSA-52vm-mxx8-f227` · PyPI `phantom-audio`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 7.7 High · Not analysed yet · Published 9 Jul 2026 · Tags: Path traversal, Denial of service - [pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager](https://agentprime.io/advisories/GHSA-c2f9-4mc8-j656.md) `GHSA-c2f9-4mc8-j656`, `CVE-2026-48987`, `PYSEC-2026-2992` · PyPI `pyload-ng`: affected `<=0.5.0b3.dev100`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference](https://agentprime.io/advisories/CVE-2026-15184.md) `CVE-2026-15184` · CVE record: GNU LibreDWG · CVSS 4.8 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service, Memory corruption - [Out-of-bounds read in Samsung Open Source Escargot](https://agentprime.io/advisories/CVE-2026-58307.md) `CVE-2026-58307` · CVE record: Samsung Open Source Escargot · CVSS 6.1 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Memory corruption, Denial of service - [Loop with Unreachable Exit Condition in GNU patch](https://agentprime.io/advisories/CVE-2026-56289.md) `CVE-2026-56289` · CVE record: GNU patch · CVSS 4.6 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [DoS through oversized audit log entries in Guardian/CMC before 26.2.0](https://agentprime.io/advisories/CVE-2026-31984.md) `CVE-2026-31984` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.7 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY methods).](https://agentprime.io/advisories/CVE-2026-51600.md) `CVE-2026-51600` · CVE record · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service, CWE-703 - [Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark](https://agentprime.io/advisories/CVE-2026-15163.md) `CVE-2026-15163` · CVE record: Wireshark Foundation Wireshark · CVSS 5.5 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler](https://agentprime.io/advisories/GHSA-mxwc-wh95-pw4g.md) `GHSA-mxwc-wh95-pw4g` · PyPI `trapster`: affected `<1.2.2`, fixed in `1.2.2` · CVSS 5.3 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory](https://agentprime.io/advisories/CVE-2026-58210.md) `CVE-2026-58210` · CVE record: nats-io nats-server · CVSS 7.5 High · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex](https://agentprime.io/advisories/CVE-2026-15154.md) `CVE-2026-15154` · CVE record: Red Hat Red Hat OpenShift AI 2.25 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [Denial of service via crafted push/pull gossip message in memberlist](https://agentprime.io/advisories/CVE-2026-14362.md) `CVE-2026-14362` · CVE record: HashiCorp Shared library · CVSS 4.9 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc](https://agentprime.io/advisories/CVE-2026-49146.md) `CVE-2026-49146` · CVE record: PETDANCE App::Ack · CVSS 7.5 High · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [Memory leak in SFTP service can result in a denial of service in MOVEit Transfer](https://agentprime.io/advisories/CVE-2026-10699.md) `CVE-2026-10699` · CVE record: Progress MOVEit Transfer · CVSS 7.5 High · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [Tanium addressed a denial of service vulnerability in Tanium Server.](https://agentprime.io/advisories/CVE-2026-15053.md) `CVE-2026-15053` · CVE record: Tanium Tanium Server · CVSS 7.5 High · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed](https://agentprime.io/advisories/CVE-2026-14454.md) `CVE-2026-14454` · CVE record: TONYC Imager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service, CWE-196 - [Resource allocation without limits in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-60001.md) `CVE-2026-60001` · CVE record: OpenBSD OpenSSH · CVSS 6.5 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [Resource allocation without limits in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-60000.md) `CVE-2026-60000` · CVE record: OpenBSD OpenSSH · CVSS 3.7 Low · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop.](https://agentprime.io/advisories/CVE-2026-51535.md) `CVE-2026-51535` · CVE record · CVSS 7.5 High · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service - [ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)](https://agentprime.io/advisories/GHSA-4w5h-hx6r-28q7.md) `GHSA-4w5h-hx6r-28q7`, `CVE-2026-53531` · crates.io `ratex-parser`: affected `<0.1.11`, fixed in `0.1.11` · CVSS 6.9 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Denial of service - [ratex-parser panics on \`\verb\` with a multibyte delimiter (UTF-8 byte-boundary slice)](https://agentprime.io/advisories/GHSA-4hgp-59h5-gvrj.md) `GHSA-4hgp-59h5-gvrj`, `CVE-2026-53530` · crates.io `ratex-parser`: affected `<0.1.11`, fixed in `0.1.11` · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Denial of service, CWE-248, CWE-1285 - [String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service](https://agentprime.io/advisories/CVE-2026-14895.md) `CVE-2026-14895` · CVE record: BAKERSCOT String::Util · CVSS 7.5 High · Not analysed yet · Published 7 Jul 2026 · Tags: Denial of service - [netfoil has a resource leak in LRU cache](https://agentprime.io/advisories/GHSA-3g4q-2f67-2gvh.md) `GHSA-3g4q-2f67-2gvh`, `GO-2026-5933` · Go `github.com/tinfoil-factory/netfoil`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 4.0, no score published · Not analysed yet · Published 7 Jul 2026 · Tags: Denial of service - [Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service](https://agentprime.io/advisories/GHSA-6983-jfq8-485w.md) `GHSA-6983-jfq8-485w`, `CVE-2026-56811`, `EEF-CVE-2026-56811` · Hex `phoenix`: affected `>=0.11.0, <1.5.15 || >=1.6.0-rc.0, <1.6.17 || >=1.7.0-rc.0, <1.7.24 || >=1.8.0-rc.0, <1.8.9`, fixed in `1.5.15`, `1.6.17`, `1.7.24`, `1.8.9` · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Denial of service - [Open WebUI denial of service through endpoint for converting markdown](https://agentprime.io/advisories/GHSA-5v9m-57mq-qc75.md) `GHSA-5v9m-57mq-qc75`, `CVE-2024-7983`, `PYSEC-2026-1723` · PyPI `open-webui`: affected `<0.5.13`, fixed in `0.5.13` · CVSS 7.5 High · Not analysed yet · Published 7 Jul 2026 · Tags: Denial of service - [pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)](https://agentprime.io/advisories/GHSA-5jqp-885w-xj32.md) `GHSA-5jqp-885w-xj32`, `CVE-2022-42964`, `PYSEC-2026-909` · PyPI `pymatgen`: affected `<2025.10.7`, fixed in `2025.10.7` · CVSS 5.9 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Denial of service - [Coolify: File Upload Without Type or Size Validation in Database Backup Restore](https://agentprime.io/advisories/CVE-2026-42145.md) `CVE-2026-42145` · CVE record: coollabsio coolify · CVSS 3.1 Low · Not analysed yet · Published 7 Jul 2026 · Tags: Unrestricted file upload, Denial of service - [Coolify unauthenticated feedback endpoint allows Discord webhook abuse](https://agentprime.io/advisories/CVE-2026-41899.md) `CVE-2026-41899` · CVE record: coollabsio coolify · CVSS 6.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass, Denial of service - [Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints](https://agentprime.io/advisories/GHSA-f5vp-w269-392g.md) `GHSA-f5vp-w269-392g`, `CVE-2026-55434`, `GO-2026-5921` · Go `github.com/coder/coder/v2`: affected `>=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.33.8`, `2.34.2` · CVSS 6.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service](https://agentprime.io/advisories/GHSA-2mg2-p7r7-g27f.md) `GHSA-2mg2-p7r7-g27f`, `CVE-2026-55078`, `GO-2026-5916` · Go `github.com/coder/coder/v2`: affected `>=2.17.0, <2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.29.17`, `2.32.7`, `2.33.8`, `2.34.2` · CVSS 6.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service, CWE-409 - [Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service](https://agentprime.io/advisories/GHSA-f962-qm93-mj4c.md) `GHSA-f962-qm93-mj4c`, `CVE-2026-55079`, `GO-2026-5911` · Go `github.com/coder/coder/v2`: affected `>=2.24.0, <2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.29.17`, `2.32.7`, `2.33.8`, `2.34.2` · CVSS 4.9 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)](https://agentprime.io/advisories/GHSA-h444-6j9x-p8vh.md) `GHSA-h444-6j9x-p8vh`, `CVE-2026-35365` · crates.io `uu_mv`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 6.6 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Path traversal, Denial of service - [cp: -R reads device nodes as streams, destroying device semantics](https://agentprime.io/advisories/GHSA-8vrf-r662-2w2v.md) `GHSA-8vrf-r662-2w2v`, `CVE-2026-35358` · crates.io `uu_cp`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 4.4 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service, CWE-706 - [OP-TEE has missing OPTEE_MSG_ATTR_TYPE_MASK in cleanup_shm_refs() leaks mobj references](https://agentprime.io/advisories/CVE-2026-42546.md) `CVE-2026-42546` · CVE record: OP-TEE optee_os · CVSS 3.8 Low · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [High-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access](https://agentprime.io/advisories/CVE-2026-40140.md) `CVE-2026-40140` · CVE record: BeyondTrust Remote Support and 1 more · CVSS 8.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [Reachable assertion in OpenVPN](https://agentprime.io/advisories/CVE-2026-13122.md) `CVE-2026-13122` · CVE record: Openvpn OpenVPN · CVSS 5.9 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service - [Memory leak in OpenVPN](https://agentprime.io/advisories/CVE-2026-13698.md) `CVE-2026-13698` · CVE record: OpenVPN OpenVPN · CVSS 6.0 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .