# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Axios: Excessive recursion in formDataToJSON can cause denial of service](https://agentprime.io/advisories/GHSA-42h9-826w-cgv3.md) `GHSA-42h9-826w-cgv3`, `CVE-2026-67313`, `CVE-2026-68942` · npm `axios`: affected `>=0.28.0, <0.33.0 || >=1.0.0, <1.18.0`, fixed in `0.33.0`, `1.18.0` · CVSS 6.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains](https://agentprime.io/advisories/CVE-2026-64194.md) `CVE-2026-64194` · CVE record: NLNETLABS Net::DNS · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [Axios: Deep formToJSON Key Recursion Can Cause Denial of Service](https://agentprime.io/advisories/GHSA-pmv8-rq9r-6j72.md) `GHSA-pmv8-rq9r-6j72`, `CVE-2026-67312`, `CVE-2026-68941` · npm `axios`: affected `>=0.28.0, <0.33.0 || >=1.0.0, <1.18.0`, fixed in `0.33.0`, `1.18.0` · CVSS 6.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER](https://agentprime.io/advisories/CVE-2026-54538.md) `CVE-2026-54538` · CVE record: neutrinolabs xrdp · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects](https://agentprime.io/advisories/GHSA-m464-hj36-96vx.md) `GHSA-m464-hj36-96vx` · crates.io `surrealdb`: affected `*`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering](https://agentprime.io/advisories/CVE-2026-15588.md) `CVE-2026-15588` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName](https://agentprime.io/advisories/CVE-2024-51316.md) `CVE-2024-51316` · CVE record · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [wifi: iwlwifi: mld: stop TX during firmware restart](https://agentprime.io/advisories/CVE-2026-64175.md) `CVE-2026-64175` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 19 Jul 2026 · Tags: Denial of service - [scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues](https://agentprime.io/advisories/CVE-2026-64003.md) `CVE-2026-64003` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 19 Jul 2026 · Tags: Denial of service - [Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close](https://agentprime.io/advisories/CVE-2026-63974.md) `CVE-2026-63974` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 19 Jul 2026 · Tags: Denial of service - [vsock/virtio: bind uarg before filling zerocopy skb](https://agentprime.io/advisories/CVE-2026-63970.md) `CVE-2026-63970` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 19 Jul 2026 · Tags: Denial of service - [ipv6: fix possible infinite loop in fib6_select_path()](https://agentprime.io/advisories/CVE-2026-63968.md) `CVE-2026-63968` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 19 Jul 2026 · Tags: Denial of service - [KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()](https://agentprime.io/advisories/CVE-2026-63806.md) `CVE-2026-63806` · CVE record: Linux Linux · CVSS 7.1 High · Not analysed yet · Published 19 Jul 2026 · Tags: Denial of service - [nfsd: fix posix_acl leak on SETACL decode failure](https://agentprime.io/advisories/CVE-2026-53397.md) `CVE-2026-53397` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 19 Jul 2026 · Tags: Denial of service - [nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race](https://agentprime.io/advisories/CVE-2026-53394.md) `CVE-2026-53394` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 19 Jul 2026 · Tags: Denial of service - [Duplicate Advisory: SurrealDB no JavaScript script function default timeout could facilitate DoS](https://agentprime.io/advisories/GHSA-6g9r-xqrf-34xh.md) `GHSA-6g9r-xqrf-34xh` · crates.io `surrealdb`: affected `*`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 18 Jul 2026 · Tags: Denial of service - [Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions](https://agentprime.io/advisories/CVE-2026-59173.md) `CVE-2026-59173` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 18 Jul 2026 · Tags: Denial of service - [IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack](https://agentprime.io/advisories/CVE-2026-14979.md) `CVE-2026-14979` · CVE record: IBM Engineering Lifecycle Management · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service - [IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service](https://agentprime.io/advisories/CVE-2026-7771.md) `CVE-2026-7771` · CVE record: IBM Db2 · CVSS 5.5 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service - [Vulnerabilities in IBM WebSphere Application affects IBM PowerVM Novalink.](https://agentprime.io/advisories/CVE-2026-9171.md) `CVE-2026-9171` · CVE record: IBM PowerVM Novalink · CVSS 7.5 High · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service - [Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS](https://agentprime.io/advisories/GHSA-cwxq-rc9x-2jvv.md) `GHSA-cwxq-rc9x-2jvv`, `CVE-2026-54247`, `GO-2026-6015` · Go `github.com/zalando/skipper`: affected `<0.26.22`, fixed in `0.26.22` · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service - [vLLM: Speech-to-text upload size limit is enforced after full UploadFile read](https://agentprime.io/advisories/GHSA-v82g-2437-67m2.md) `GHSA-v82g-2437-67m2`, `CVE-2026-55646`, `PYSEC-2026-2305` · PyPI `vllm`: affected `>=0.22.0, <0.24.0`, fixed in `0.24.0` · CVSS 6.5 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service - [vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends](https://agentprime.io/advisories/GHSA-rwxx-mrjm-wc2m.md) `GHSA-rwxx-mrjm-wc2m`, `CVE-2026-55574`, `PYSEC-2026-2304` · PyPI `vllm`: affected `<0.24.0`, fixed in `0.24.0` · CVSS 8.7 High · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service - [HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date](https://agentprime.io/advisories/CVE-2026-14741.md) `CVE-2026-14741` · CVE record: OALDERS HTTP::Date · CVSS 7.5 High · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service - [Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration](https://agentprime.io/advisories/CVE-2026-15007.md) `CVE-2026-15007` · CVE record: GitHub Enterprise Server · CVSS 5.7 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service - [Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods](https://agentprime.io/advisories/CVE-2026-9602.md) `CVE-2026-9602` · CVE record: Mattermost Mattermost · CVSS 5.7 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service - [OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs](https://agentprime.io/advisories/CVE-2026-62210.md) `CVE-2026-62210` · CVE record: OpenClaw OpenClaw · CVSS 6.0 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service - [Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS)](https://agentprime.io/advisories/CVE-2026-33754.md) `CVE-2026-33754` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [h2o has HTTP/2 state amplification](https://agentprime.io/advisories/CVE-2026-54340.md) `CVE-2026-54340` · CVE record: h2o h2o · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [h2o is vulnerable to musl libc stack overflow](https://agentprime.io/advisories/CVE-2026-44453.md) `CVE-2026-44453` · CVE record: h2o h2o · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB](https://agentprime.io/advisories/CVE-2026-44435.md) `CVE-2026-44435` · CVE record: h2o quicly · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [Quicly is vulnerable to memory exhaustion](https://agentprime.io/advisories/CVE-2026-44433.md) `CVE-2026-44433` · CVE record: h2o quicly · CVSS 5.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [AutomationDirect Productivity Suite Divide By Zero](https://agentprime.io/advisories/CVE-2026-61378.md) `CVE-2026-61378` · CVE record: AutomationDirect Productivity Suite · CVSS 6.8 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users](https://agentprime.io/advisories/GHSA-8w86-m9h8-hvqg.md) `GHSA-8w86-m9h8-hvqg`, `CVE-2026-54077` · Maven `com.arcadedb:arcadedb-engine`: affected `<26.6.1`, fixed in `26.6.1` · CVSS 7.1 High · Not analysed yet · Published 16 Jul 2026 · Tags: Path traversal, Denial of service, Server-side request forgery (SSRF) - [Envoy Gateway: OCI layer extraction allocates make(\[\]byte, h.Size) from untrusted tar header](https://agentprime.io/advisories/GHSA-h7pq-86h8-rp5x.md) `GHSA-h7pq-86h8-rp5x`, `BIT-envoy-gateway-2026-53717`, `CVE-2026-53717`, `GO-2026-6008` · Go `github.com/envoyproxy/gateway`: affected `<1.7.4 || >=1.8.0-rc.0, <1.8.1`, fixed in `1.7.4`, `1.8.1` · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit](https://agentprime.io/advisories/GHSA-cxpq-8v7q-cg56.md) `GHSA-cxpq-8v7q-cg56`, `BIT-envoy-gateway-2026-53716`, `CVE-2026-53716`, `GO-2026-6006` · Go `github.com/envoyproxy/gateway`: affected `<1.7.4 || >=1.8.0-rc.0, <1.8.1`, fixed in `1.7.4`, `1.8.1` · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes](https://agentprime.io/advisories/CVE-2026-13401.md) `CVE-2026-13401` · CVE record: CODECHILD XML::Bare · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes](https://agentprime.io/advisories/CVE-2026-13397.md) `CVE-2026-13397` · CVE record: CODECHILD HTML::Bare · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service](https://agentprime.io/advisories/CVE-2026-55440.md) `CVE-2026-55440` · CVE record: microsoft UFO · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service, Broken access control - [Loki detected_fields query limits results in unbounded memory allocation](https://agentprime.io/advisories/CVE-2026-21729.md) `CVE-2026-21729` · CVE record: Grafana Loki · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [Feast: resource exhaustion via websocket endpoint](https://agentprime.io/advisories/CVE-2026-23538.md) `CVE-2026-23538` · CVE record: Feast Feast Feature Server and 1 more · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service - [adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files](https://agentprime.io/advisories/GHSA-xg43-5579-qw6v.md) `GHSA-xg43-5579-qw6v`, `PKSA-zwm1-4dcx-xx1p` · Packagist `adawolfa/isdoc`: affected `* || >=1.4.0, <1.4.3 || >=1.5.0, <1.5.1 || >=1.6.0, <1.6.1`, fixed in `1.4.3`, `1.5.1`, `1.6.1` · CVSS 6.5 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service, CWE-409 - [Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback](https://agentprime.io/advisories/GHSA-ggw3-5987-rx77.md) `GHSA-ggw3-5987-rx77`, `CVE-2026-50285` · Go `github.com/pomerium/pomerium`: affected `>=0.32.6, <0.32.8`, fixed in `0.32.8` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service, CWE-1284 - [dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS](https://agentprime.io/advisories/GHSA-p5f6-rccc-jv98.md) `GHSA-p5f6-rccc-jv98`, `CVE-2026-50276` · RubyGems `datadog`: affected `<2.32.0`, fixed in `2.32.0` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS](https://agentprime.io/advisories/GHSA-74j5-xf3v-crq8.md) `GHSA-74j5-xf3v-crq8`, `CVE-2026-50274`, `GO-2026-6000` · Go `github.com/DataDog/dd-trace-go` and 1 more: affected `<=1.24.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS](https://agentprime.io/advisories/GHSA-38wr-vpc7-2mp4.md) `GHSA-38wr-vpc7-2mp4`, `CVE-2026-50273` · NuGet `Datadog.Trace` and 1 more: affected `<3.43.0`, fixed in `3.43.0` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS](https://agentprime.io/advisories/GHSA-wxqq-gcq8-c443.md) `GHSA-wxqq-gcq8-c443`, `CVE-2026-50272` · npm `dd-trace`: affected `<5.100.0`, fixed in `5.100.0` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS](https://agentprime.io/advisories/GHSA-mw54-j2v2-42hr.md) `GHSA-mw54-j2v2-42hr`, `CVE-2026-50271`, `PYSEC-2026-3461` · PyPI `ddtrace`: affected `<4.8.2`, fixed in `4.8.2` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS](https://agentprime.io/advisories/GHSA-74xj-wh4w-vqxc.md) `GHSA-74xj-wh4w-vqxc`, `CVE-2026-50270` · Maven `com.datadoghq:dd-java-agent`: affected `<1.62.0`, fixed in `1.62.0` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [websocket-driver: Resource limit bypass via message compression](https://agentprime.io/advisories/GHSA-mp7j-qc5w-4988.md) `GHSA-mp7j-qc5w-4988`, `CVE-2026-54490` · npm `websocket-driver`: affected `<0.7.5`, fixed in `0.7.5` · CVSS 6.3 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [websocket-driver: Memory exhaustion in HTTP header parser](https://agentprime.io/advisories/GHSA-8j3g-f24p-4mpw.md) `GHSA-8j3g-f24p-4mpw`, `CVE-2026-54465` · RubyGems `websocket-driver`: affected `<0.8.1`, fixed in `0.8.1` · CVSS 6.3 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [websocket-driver: Resource limit bypass via message compression](https://agentprime.io/advisories/GHSA-33ph-fccm-39pj.md) `GHSA-33ph-fccm-39pj`, `CVE-2026-54464` · RubyGems `websocket-driver`: affected `<0.8.1`, fixed in `0.8.1` · CVSS 6.3 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [websocket-driver: Memory exhaustion via abuse of protocol length headers](https://agentprime.io/advisories/GHSA-ghhp-3qvg-889p.md) `GHSA-ghhp-3qvg-889p`, `CVE-2026-54463` · RubyGems `websocket-driver`: affected `<0.8.1`, fixed in `0.8.1` · CVSS 6.9 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [Wekan: Arbitrary file read and server DoS via attachment versions.original.path](https://agentprime.io/advisories/CVE-2026-52890.md) `CVE-2026-52890` · CVE record: wekan wekan · CVSS 7.1 High · Not analysed yet · Published 15 Jul 2026 · Tags: Path traversal, Denial of service - [Resource exhaustion vulnerability in the Secure Access publisher](https://agentprime.io/advisories/CVE-2026-55399.md) `CVE-2026-55399` · CVE record: Absolute Security Secure Access · CVSS 5.1 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [Memory management vulnerability in Secure Access clients](https://agentprime.io/advisories/CVE-2026-55398.md) `CVE-2026-55398` · CVE record: Absolute Security Secure Access · CVSS 6.9 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Memory corruption, Denial of service - [Memory management vulnerability in Secure Access servers](https://agentprime.io/advisories/CVE-2026-33445.md) `CVE-2026-33445` · CVE record: Absolute Security Secure Access · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [Memory management vulnerability in Secure Access servers](https://agentprime.io/advisories/CVE-2026-33444.md) `CVE-2026-33444` · CVE record: Absolute Secutity Secure Access · CVSS 6.9 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Memory corruption, Denial of service - [Memory management error in Secure Access servers prior to 14.55](https://agentprime.io/advisories/CVE-2026-33443.md) `CVE-2026-33443` · CVE record: Absolute Security Secure Access · CVSS 7.1 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [Protobuf: Unbounded recursion depth in embedded-message decoding](https://agentprime.io/advisories/GHSA-rv48-qqj5-crxg.md) `GHSA-rv48-qqj5-crxg`, `CVE-2026-54451` · Hex `protobuf`: affected `>=0.8.0, <0.16.1`, fixed in `0.16.1` · CVSS 8.2 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .