# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [ggml-org llama.cpp json-schema-to-grammar.cpp \_visit_pattern null pointer dereference](https://agentprime.io/advisories/CVE-2026-17500.md)
  `CVE-2026-17500` · CVE record: ggml-org llama.cpp · CVSS 6.9 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service, Memory corruption
- [An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU ex…](https://agentprime.io/advisories/CVE-2025-63913.md)
  `CVE-2025-63913` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service
- [ALSA: compress: Fix task creation error unwind](https://agentprime.io/advisories/CVE-2026-64485.md)
  `CVE-2026-64485` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 25 Jul 2026 · Tags: Denial of service
- [usb: typec: tcpci_rt1711h: unregister TCPCI port with devres](https://agentprime.io/advisories/CVE-2026-64463.md)
  `CVE-2026-64463` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 25 Jul 2026 · Tags: Denial of service
- [sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT](https://agentprime.io/advisories/CVE-2026-64374.md)
  `CVE-2026-64374` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 25 Jul 2026 · Tags: Denial of service
- [etcd: \`tlsListener.acceptLoop\` spawns unbounded handshake goroutines with no deadline](https://agentprime.io/advisories/GHSA-6vch-q96h-7gc3.md)
  `GHSA-6vch-q96h-7gc3`, `BIT-etcd-2026-73500`, `CVE-2026-73500`, `GO-2026-6107` · Go `go.etcd.io/etcd/v3`: affected `<3.5.33 || >=3.6.0, <3.6.14 || >=3.7.0-alpha.0, <3.7.1`, fixed in `3.5.33`, `3.6.14`, `3.7.1` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service](https://agentprime.io/advisories/GHSA-jvxp-qmx7-gjpx.md)
  `GHSA-jvxp-qmx7-gjpx`, `CVE-2026-16756` · crates.io `aws-smithy-http-server`: affected `<0.66.5`, fixed in `0.66.5` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [libp2p: yamux connection DoS via oversized data frame](https://agentprime.io/advisories/GHSA-hmj8-5xmh-5573.md)
  `GHSA-hmj8-5xmh-5573`, `CVE-2026-73568`, `PYSEC-2026-3681` · PyPI `libp2p`: affected `<=0.7.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [OmniFaces: Forged combined-resource IDs and related output/push boundaries](https://agentprime.io/advisories/GHSA-fp43-vj7g-pg92.md)
  `GHSA-fp43-vj7g-pg92`, `CVE-2026-102695` · Maven `org.omnifaces:omnifaces`: affected `<1.14.3 || >=2.0.0, <2.7.33 || >=3.0.0, <3.14.23 || >=4.0.0, <4.7.12 || >=5.0.0, <5.4.2`, fixed in `1.14.3`, `2.7.33`, `3.14.23`, `4.7.12`, `5.4.2` · CVSS 8.2 High · Not analysed yet · Published 24 Jul 2026 · Tags: Cross-site scripting (XSS), Information disclosure, Denial of service, Broken access control
- [Shescape: Quadratic-time denial of service in the flag-protection](https://agentprime.io/advisories/GHSA-gm3r-q2wp-hw87.md)
  `GHSA-gm3r-q2wp-hw87`, `CVE-2026-73413` · npm `shescape`: affected `>=2.1.11, <2.1.14 || >=3.0.0, <3.0.1`, fixed in `2.1.14`, `3.0.1` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [blaze: Unbounded WebSocket message aggregation in http4s-blaze-server](https://agentprime.io/advisories/GHSA-7ppr-r889-mcf2.md)
  `GHSA-7ppr-r889-mcf2`, `CVE-2026-73493` · Maven `org.http4s:http4s-blaze-server_2.13` and 2 more: affected `<0.23.18 || >=1.0.0-M1, <1.0.0-M42`, fixed in `0.23.18`, `1.0.0-M42` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash](https://agentprime.io/advisories/GHSA-mh99-v99m-4gvg.md)
  `GHSA-mh99-v99m-4gvg`, `CVE-2026-14257` · npm `brace-expansion`: affected `<1.1.17 || >=2.0.0, <2.1.3 || >=3.0.0, <3.0.3 || >=4.0.0, <5.0.8`, fixed in `1.1.17`, `2.1.3`, `3.0.3`, `5.0.8` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion](https://agentprime.io/advisories/GHSA-g5vv-q72c-7j78.md)
  `GHSA-g5vv-q72c-7j78`, `CVE-2026-73561` · npm `@anephenix/hub`: affected `<0.2.16`, fixed in `0.2.16` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway](https://agentprime.io/advisories/GHSA-68r5-9hpg-7qw9.md)
  `GHSA-68r5-9hpg-7qw9` · Maven `org.openidentityplatform.opendj:opendj-dsml-servlet`: affected `<5.1.2`, fixed in `5.1.2` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Denial of service, Server-side request forgery (SSRF)
- [react-server-dom: Denial of Service in Server Functions](https://agentprime.io/advisories/GHSA-wx67-qw84-cm4g.md)
  `GHSA-wx67-qw84-cm4g`, `CVE-2026-44907` · npm `react-server-dom-webpack` and 2 more: affected `>=19.0.0, <19.0.8 || >=19.1.0, <19.1.9 || >=19.2.0, <19.2.8`, fixed in `19.0.8`, `19.1.9`, `19.2.8` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules](https://agentprime.io/advisories/GHSA-g35j-m5xg-vh3q.md)
  `GHSA-g35j-m5xg-vh3q`, `CVE-2026-57497`, `GO-2026-6099` · Go `github.com/quic-go/webtransport-go`: affected `<0.11.1`, fixed in `0.11.1` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server](https://agentprime.io/advisories/GHSA-g9j2-8w95-3vwv.md)
  `GHSA-g9j2-8w95-3vwv`, `CVE-2026-55497`, `GO-2026-6100` · Go `github.com/cloudreve/Cloudreve/v4` and 1 more: affected `<4.0.0-20260613024411-3607f79bb44c`, fixed in `4.0.0-20260613024411-3607f79bb44c` · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service, CWE-409
- [FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()](https://agentprime.io/advisories/CVE-2026-66037.md)
  `CVE-2026-66037` · CVE record: FFmpeg FFmpeg · CVSS 7.1 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config](https://agentprime.io/advisories/GHSA-ffpj-xv5c-p3gw.md)
  `GHSA-ffpj-xv5c-p3gw`, `CVE-2026-59220`, `PYSEC-2026-3596` · PyPI `open-webui`: affected `>=0.9.2, <0.10.0`, fixed in `0.10.0` · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion](https://agentprime.io/advisories/GHSA-v74w-7mr3-4qg3.md)
  `GHSA-v74w-7mr3-4qg3`, `CVE-2026-73507` · Maven `io.netty:netty-codec-xml`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names](https://agentprime.io/advisories/GHSA-mfg7-5gfp-c4w3.md)
  `GHSA-mfg7-5gfp-c4w3`, `CVE-2026-73508` · Maven `io.netty:netty-codec-dns`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [js-yaml: Exponential parsing time in flow collections leads to denial of service](https://agentprime.io/advisories/GHSA-pm4m-ph32-ghv5.md)
  `GHSA-pm4m-ph32-ghv5`, `CVE-2026-73643` · npm `js-yaml`: affected `>=5.0.0, <5.2.2`, fixed in `5.2.2` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit](https://agentprime.io/advisories/GHSA-vg8x-66vg-5pxh.md)
  `GHSA-vg8x-66vg-5pxh`, `CVE-2026-65623`, `EEF-CVE-2026-65623` · Hex `bandit`: affected `>=1.11.0, <1.12.1`, fixed in `1.12.1` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection](https://agentprime.io/advisories/GHSA-r292-9mhp-454m.md)
  `GHSA-r292-9mhp-454m`, `CVE-2026-73566` · npm `tar`: affected `<7.5.21`, fixed in `7.5.21` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [SvelteKit: Big remote form function payloads can cause Node process to crash](https://agentprime.io/advisories/GHSA-wqjv-9729-c5q2.md)
  `GHSA-wqjv-9729-c5q2`, `CVE-2026-82256` · npm `@sveltejs/kit`: affected `<2.69.1`, fixed in `2.69.1` · CVSS 6.9 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service, CWE-248
- [httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling](https://agentprime.io/advisories/GHSA-j5g9-f88f-gfj3.md)
  `GHSA-j5g9-f88f-gfj3`, `CVE-2026-59939`, `PYSEC-2026-3444` · PyPI `httplib2`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service, CWE-409
- [ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified](https://agentprime.io/advisories/GHSA-h5r4-w88w-7ccr.md)
  `GHSA-h5r4-w88w-7ccr`, `CVE-2026-61872` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.0 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Memory Leak in ICON decoder when allocation fails](https://agentprime.io/advisories/GHSA-h58x-r7f7-rh84.md)
  `GHSA-h58x-r7f7-rh84`, `CVE-2026-61871` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 6.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Memory leak in VIFF encoder when allocation fails](https://agentprime.io/advisories/GHSA-m596-67p7-69wh.md)
  `GHSA-m596-67p7-69wh`, `CVE-2026-61870` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Memory Leak in MIFF encoder when allocaton fails](https://agentprime.io/advisories/GHSA-r628-69v2-2f9c.md)
  `GHSA-r628-69v2-2f9c`, `CVE-2026-61869` · NuGet `Magick.NET-Q16-arm64` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Memory Leak in YUV decoder when opening of blob fails](https://agentprime.io/advisories/GHSA-h7f2-f9cc-h2gv.md)
  `GHSA-h7f2-f9cc-h2gv`, `CVE-2026-61868` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 6.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Memory Leak in TIFF encoder when an allocation fails](https://agentprime.io/advisories/GHSA-jfq9-q63x-rc63.md)
  `GHSA-jfq9-q63x-rc63`, `CVE-2026-61867` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Memory Leak in JNG encoder when a blob could not be opened](https://agentprime.io/advisories/GHSA-99w9-hv66-rfv7.md)
  `GHSA-99w9-hv66-rfv7`, `CVE-2026-61866` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Memory Leak in hough lines operation when an operation fails](https://agentprime.io/advisories/GHSA-j8rh-v2r8-v94x.md)
  `GHSA-j8rh-v2r8-v94x`, `CVE-2026-61865` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Memory Leak in color transformation to log colorspace when operation fails](https://agentprime.io/advisories/GHSA-7c7m-fpjw-gwcq.md)
  `GHSA-7c7m-fpjw-gwcq`, `CVE-2026-61864` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Memory Leak in TIFF encoder when a temporary file could not be created.](https://agentprime.io/advisories/GHSA-6vxp-gfwf-hcr9.md)
  `GHSA-6vxp-gfwf-hcr9`, `CVE-2026-61863` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Heap-use-after-free via XMP profile could result in a crash](https://agentprime.io/advisories/GHSA-qh5g-q395-cx4j.md)
  `GHSA-qh5g-q395-cx4j`, `CVE-2026-61857` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 6.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service, Memory corruption, CWE-252, CWE-703
- [ImageMagick: Policy Bypass possible with matrix-backed operations](https://agentprime.io/advisories/GHSA-rvhp-75f6-9jqh.md)
  `GHSA-rvhp-75f6-9jqh`, `CVE-2026-61465` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Broken access control, Denial of service
- [React Router: Unauthenticated Denial of Service via Inefficient Route Matching](https://agentprime.io/advisories/GHSA-chx6-hx7r-mcp5.md)
  `GHSA-chx6-hx7r-mcp5`, `CVE-2026-55685` · npm `react-router`: affected `>=7.0.0, <7.18.0`, fixed in `7.18.0` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Infinite Loop in connected-components when providing invalid arguments](https://agentprime.io/advisories/GHSA-qhmf-7fc4-8q3h.md)
  `GHSA-qhmf-7fc4-8q3h`, `CVE-2026-55595` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.7 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [ImageMagick: Stack Overflow in MVG decoder due to missing depth check.](https://agentprime.io/advisories/GHSA-mx48-2qq3-23hf.md)
  `GHSA-mx48-2qq3-23hf`, `CVE-2026-55594` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [LiquidJS: \`pop\` filter bypasses \`memoryLimit\` accounting that its array-filter siblings enforce](https://agentprime.io/advisories/GHSA-g357-x5c3-c72p.md)
  `GHSA-g357-x5c3-c72p`, `CVE-2026-55575` · npm `liquidjs`: affected `<10.27.1`, fixed in `10.27.1` · CVSS 8.2 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image](https://agentprime.io/advisories/CVE-2026-7007.md)
  `CVE-2026-7007` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler](https://agentprime.io/advisories/CVE-2026-45815.md)
  `CVE-2026-45815` · CVE record: Apache Software Foundation Apache NimBLE · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Apache Neethi: Remote PolicyReference fetch lacks resource bounds](https://agentprime.io/advisories/CVE-2026-66144.md)
  `CVE-2026-66144` · CVE record: Apache Software Foundation Apache Neethi · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Apache Neethi: Missing global alternative-output budget across policy computation paths](https://agentprime.io/advisories/CVE-2026-66143.md)
  `CVE-2026-66143` · CVE record: Apache Software Foundation Apache Neethi · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Apache Neethi: Uncontrolled recursion in policy processing](https://agentprime.io/advisories/CVE-2026-66142.md)
  `CVE-2026-66142` · CVE record: Apache Software Foundation Apache Neethi · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Rhcs: memory leak during https connection leads to denial of service](https://agentprime.io/advisories/CVE-2026-12353.md)
  `CVE-2026-12353` · CVE record: Red Hat Red Hat Certificate System 9 and 3 more · CVSS 5.3 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service
- [pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)](https://agentprime.io/advisories/GHSA-g867-7843-wf8q.md)
  `GHSA-g867-7843-wf8q`, `CVE-2026-59935`, `PYSEC-2026-3613` · PyPI `pypdf`: affected `<6.14.2`, fixed in `6.14.2` · CVSS 8.7 High · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service
- [pypdf: Possible infinite loop for not terminated inline images](https://agentprime.io/advisories/GHSA-5xf7-4p34-54qr.md)
  `GHSA-5xf7-4p34-54qr`, `CVE-2026-59936`, `PYSEC-2026-3612` · PyPI `pypdf`: affected `<6.14.1`, fixed in `6.14.1` · CVSS 8.7 High · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service
- [pypdf: Possible long runtimes for repeated malformed cross-reference entries](https://agentprime.io/advisories/GHSA-55h5-xmcq-c37v.md)
  `GHSA-55h5-xmcq-c37v`, `CVE-2026-59937`, `PYSEC-2026-3610` · PyPI `pypdf`: affected `<6.14.0`, fixed in `6.14.0` · CVSS 6.9 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service
- [pypdf: Possible large memory usage for wrong image dimensions](https://agentprime.io/advisories/GHSA-5qjq-93h5-hrgp.md)
  `GHSA-5qjq-93h5-hrgp`, `CVE-2026-59938`, `PYSEC-2026-3611` · PyPI `pypdf`: affected `<6.14.0`, fixed in `6.14.0` · CVSS 6.9 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service
- [PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion](https://agentprime.io/advisories/GHSA-xh5m-36r6-47m3.md)
  `GHSA-xh5m-36r6-47m3`, `CVE-2026-59933`, `PKSA-r22k-87hv-mfk4` · Packagist `phpoffice/phpspreadsheet`: affected `<1.30.6 || >=2.0.0, <2.1.18 || >=2.2.0, <2.4.7 || >=3.3.0, <3.10.7 || >=4.0.0, <5.8.1`, fixed in `1.30.6`, `2.1.18`, `2.4.7`, `3.10.7`, `5.8.1` · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service
- [PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion](https://agentprime.io/advisories/GHSA-2mrg-gjxq-2gvr.md)
  `GHSA-2mrg-gjxq-2gvr`, `CVE-2026-59932`, `PKSA-m9cr-9614-rsf7` · Packagist `phpoffice/phpspreadsheet`: affected `<1.30.6 || >=2.0.0, <2.1.18 || >=2.2.0, <2.4.7 || >=3.3.0, <3.10.7 || >=4.0.0, <5.8.1`, fixed in `1.30.6`, `2.1.18`, `2.4.7`, `3.10.7`, `5.8.1` · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service, CWE-409
- [Unrestricted File Upload in BizimHesap Information Systems' Online Pre-Accounting Software](https://agentprime.io/advisories/CVE-2026-8287.md)
  `CVE-2026-8287` · CVE record: BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software · CVSS 4.3 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service
- [Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()](https://agentprime.io/advisories/CVE-2026-64611.md)
  `CVE-2026-64611` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service
- [CVE-2026-21723 Record](https://agentprime.io/advisories/CVE-2026-21723.md)
  `CVE-2026-21723` · CVE record: Grafana Grafana OSS · CVSS 5.3 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service
- [Next.js: Unbounded Server Action payload in Edge runtime](https://agentprime.io/advisories/GHSA-4c39-4ccg-62r3.md)
  `GHSA-4c39-4ccg-62r3`, `CVE-2026-64646` · npm `next`: affected `>=13.0.0, <15.5.21 || >=16.0.0, <16.2.11`, fixed in `15.5.21`, `16.2.11` · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Next.js: Denial of Service in the Image Optimization API using SVGs](https://agentprime.io/advisories/GHSA-q8wf-6r8g-63ch.md)
  `GHSA-q8wf-6r8g-63ch`, `CVE-2026-64644` · npm `next`: affected `>=15.5.0, <15.5.21 || >=16.0.0, <16.2.11`, fixed in `15.5.21`, `16.2.11` · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Next.js: Denial of Service in App Router using Server Actions](https://agentprime.io/advisories/GHSA-m99w-x7hq-7vfj.md)
  `GHSA-m99w-x7hq-7vfj`, `CVE-2026-64641` · npm `next`: affected `>=13.0.0, <15.5.21 || >=16.0.0, <16.2.11`, fixed in `15.5.21`, `16.2.11` · CVSS 8.2 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTA3LTIyVDIyOjU5OjAxLjAwMDAwMFoiLCJHSFNBLW05OXcteDdocS03dmZqIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTA3LTI3VDAwOjMwOjExLjA4MjAwMFoiLCJDVkUtMjAyNi0xNzUwMSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTA3LTI3VDAwOjMwOjExLjA4MjAwMFoiLCJDVkUtMjAyNi0xNzUwMSJd>. Everything for agents: <https://agentprime.io/llms.txt>.