# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled](https://agentprime.io/advisories/CVE-2026-10674.md)
  `CVE-2026-10674` · CVE record: zephyrproject zephyr · CVSS 5.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser](https://agentprime.io/advisories/CVE-2026-65315.md)
  `CVE-2026-65315` · CVE record: Ollama Ollama · CVSS 8.7 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests](https://agentprime.io/advisories/GHSA-fw57-jgch-pgf3.md)
  `GHSA-fw57-jgch-pgf3`, `CVE-2026-58436`, `GO-2026-6055` · Go `code.gitea.io/gitea`: affected `<1.27.0`, fixed in `1.27.0` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Gitea SSH Key Parser Denial of Service](https://agentprime.io/advisories/GHSA-4xjf-493q-98p3.md)
  `GHSA-4xjf-493q-98p3`, `CVE-2026-56657`, `GO-2026-6042` · Go `code.gitea.io/gitea` and 1 more: affected `<1.27.0`, fixed in `1.27.0` · CVSS 6.2 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, Denial of service
- [Reachable Assertion in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-63140.md)
  `CVE-2026-63140` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint](https://agentprime.io/advisories/GHSA-wwqq-x6w4-frm2.md)
  `GHSA-wwqq-x6w4-frm2`, `CVE-2026-42931`, `GO-2026-6082` · Go `code.gitea.io/gitea`: affected `<1.27.0`, fixed in `1.27.0` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-63139.md)
  `CVE-2026-63139` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads](https://agentprime.io/advisories/GHSA-9mq6-mqjj-c2c5.md)
  `GHSA-9mq6-mqjj-c2c5`, `CVE-2026-59763`, `GO-2026-6049` · Go `code.gitea.io/gitea`: affected `<1.27.0`, fixed in `1.27.0` · CVSS 4.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, Denial of service
- [Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-63136.md)
  `CVE-2026-63136` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls](https://agentprime.io/advisories/CVE-2026-16318.md)
  `CVE-2026-16318` · CVE record: Amazon s2n-tls · CVSS 6.9 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-56145.md)
  `CVE-2026-56145` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [CImg Library: Uncontrolled Memory Allocation and Memory Leak in \`\_load_analyze()\` via Crafted NIfTI/Analyze Header](https://agentprime.io/advisories/CVE-2026-47667.md)
  `CVE-2026-47667` · CVE record: GreycLab CImg · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service, CWE-1284
- [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-42397.md)
  `CVE-2026-42397` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes](https://agentprime.io/advisories/CVE-2026-15957.md)
  `CVE-2026-15957` · CVE record: AWS aws-sdk-rust · CVSS 8.7 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [pyasn1: Uncontrolled resource consumption when converting decoded REAL values](https://agentprime.io/advisories/GHSA-hm4w-wwcw-mr6r.md)
  `GHSA-hm4w-wwcw-mr6r`, `CVE-2026-59886`, `PYSEC-2026-3457` · PyPI `pyasn1`: affected `<0.6.4`, fixed in `0.6.4` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service](https://agentprime.io/advisories/GHSA-8ppf-4f7h-5ppj.md)
  `GHSA-8ppf-4f7h-5ppj`, `CVE-2026-59885`, `PYSEC-2026-3456` · PyPI `pyasn1`: affected `<0.6.4`, fixed in `0.6.4` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs](https://agentprime.io/advisories/GHSA-m4p7-r5rc-7g4j.md)
  `GHSA-m4p7-r5rc-7g4j`, `CVE-2026-59884`, `PYSEC-2026-3455` · PyPI `pyasn1`: affected `<0.6.4`, fixed in `0.6.4` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [linkify-it: Quadratic-complexity DoS via the \`mailto:\` validator scan-loop on attacker text](https://agentprime.io/advisories/GHSA-v245-v573-v5vm.md)
  `GHSA-v245-v573-v5vm`, `CVE-2026-59887` · npm `linkify-it`: affected `<5.0.2`, fixed in `5.0.2` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set](https://agentprime.io/advisories/GHSA-xvcm-6775-5m9r.md)
  `GHSA-xvcm-6775-5m9r`, `CVE-2026-59880` · npm `immutable`: affected `<3.8.4 || >=4.0.0-beta.1, <4.3.9 || >=5.0.0-beta.1, <5.1.8`, fixed in `3.8.4`, `4.3.9`, `5.1.8` · CVSS 8.7 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Immutable.js \`List\` 32-bit trie overflow → unrecoverable DoS](https://agentprime.io/advisories/GHSA-v56q-mh7h-f735.md)
  `GHSA-v56q-mh7h-f735`, `CVE-2026-59879` · npm `immutable`: affected `<3.8.4 || >=4.0.0-rc.1, <4.3.9 || >=5.0.0-beta.1, <5.1.8`, fixed in `3.8.4`, `4.3.9`, `5.1.8` · CVSS 8.7 High · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption, Denial of service, CWE-1284
- [Uncontrolled resource consumption in Atlassian Confluence Data Center](https://agentprime.io/advisories/CVE-2026-21577.md)
  `CVE-2026-21577` · CVE record: Atlassian Confluence Data Center · CVSS 7.1 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-j8gr-8fp3-5q5h.md)
  `GHSA-j8gr-8fp3-5q5h`, `BIT-dotnet-2026-56170`, `BIT-dotnet-sdk-2026-56170`, `CVE-2026-56170` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.26 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6`, fixed in `8.0.26`, `9.0.15`, `10.0.6` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Libssh: libssh: denial of service via automatic certificate authentication loop](https://agentprime.io/advisories/CVE-2026-59849.md)
  `CVE-2026-59849` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 3.1 Low · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Libssh: libssh: denial of service via sftp responses with unknown request ids](https://agentprime.io/advisories/CVE-2026-59848.md)
  `CVE-2026-59848` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Denial-of-service in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-16376.md)
  `CVE-2026-16376` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Libssh: libssh: denial of service via oversized sftp read length](https://agentprime.io/advisories/CVE-2026-59844.md)
  `CVE-2026-59844` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Libssh: libssh: denial of service via zero advertised channel packet size](https://agentprime.io/advisories/CVE-2026-59843.md)
  `CVE-2026-59843` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Guzzle: Unbounded response cookies risk denial of service](https://agentprime.io/advisories/GHSA-f283-ghqc-fg79.md)
  `GHSA-f283-ghqc-fg79`, `CVE-2026-67353`, `PKSA-bbs6-q5q9-f3t4` · Packagist `guzzlehttp/guzzle`: affected `<7.15.1`, fixed in `7.15.1` · CVSS 6.9 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service, CWE-1325
- [body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement](https://agentprime.io/advisories/GHSA-v422-hmwv-36x6.md)
  `GHSA-v422-hmwv-36x6`, `CVE-2026-12590` · npm `body-parser`: affected `<1.20.6 || >=2.0.0, <2.3.0`, fixed in `1.20.6`, `2.3.0` · CVSS 3.7 Low · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service](https://agentprime.io/advisories/GHSA-vjc4-5qp5-m44j.md)
  `GHSA-vjc4-5qp5-m44j`, `BIT-pillow-2026-59204`, `CVE-2026-59204`, `PYSEC-2026-3496` · PyPI `pillow`: affected `>=8.2.0, <12.3.0`, fixed in `12.3.0` · CVSS 8.7 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service](https://agentprime.io/advisories/GHSA-pg7v-jwj7-p798.md)
  `GHSA-pg7v-jwj7-p798`, `BIT-pillow-2026-59203`, `CVE-2026-59203`, `PYSEC-2026-3452` · PyPI `pillow`: affected `>=12.0.0, <12.3.0`, fixed in `12.3.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()](https://agentprime.io/advisories/GHSA-jjj6-mw9f-p565.md)
  `GHSA-jjj6-mw9f-p565`, `BIT-pillow-2026-59200`, `CVE-2026-59200`, `PYSEC-2026-3495` · PyPI `pillow`: affected `>=5.1.0, <12.3.0`, fixed in `12.3.0` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-wp74-jgxh-gv4q.md)
  `GHSA-wp74-jgxh-gv4q`, `BIT-dotnet-2026-50651`, `BIT-dotnet-sdk-2026-50651`, `CVE-2026-50651` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-8q5v-6pqq-x66h.md)
  `GHSA-8q5v-6pqq-x66h`, `BIT-dotnet-2026-50525`, `BIT-dotnet-sdk-2026-50525`, `CVE-2026-50525` · NuGet `System.Security.Cryptography.Xml`: affected `>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.4`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-23rf-6693-g89p.md)
  `GHSA-23rf-6693-g89p`, `BIT-dotnet-2026-50648`, `BIT-dotnet-sdk-2026-50648`, `CVE-2026-50648` · NuGet `System.Security.Cryptography.Xml`: affected `>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.4`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-cvvh-rhrc-wg4q.md)
  `GHSA-cvvh-rhrc-wg4q`, `BIT-dotnet-2026-47302`, `BIT-dotnet-sdk-2026-47302`, `CVE-2026-47302` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 12 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Axios form serializer maxDepth bypass via {} metatoken](https://agentprime.io/advisories/GHSA-hcpx-6fm6-wx23.md)
  `GHSA-hcpx-6fm6-wx23`, `CVE-2026-67321`, `CVE-2026-69125` · npm `axios`: affected `>=0.31.1, <0.33.0 || >=1.15.1, <1.18.0`, fixed in `0.33.0`, `1.18.0` · CVSS 6.9 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Axios: HTTP/2 streamed uploads bypass \`maxBodyLength\`](https://agentprime.io/advisories/GHSA-mwf2-3pr3-8698.md)
  `GHSA-mwf2-3pr3-8698`, `CVE-2026-67318`, `CVE-2026-68948` · npm `axios`: affected `>=1.13.0, <1.18.0`, fixed in `1.18.0` · CVSS 6.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Axios: Fetch adapter \`ReadableStream\` uploads bypass \`maxBodyLength\`](https://agentprime.io/advisories/GHSA-jqh4-m9w3-8hp9.md)
  `GHSA-jqh4-m9w3-8hp9`, `CVE-2026-67317`, `CVE-2026-68947` · npm `axios`: affected `>=1.7.0, <1.18.0`, fixed in `1.18.0` · CVSS 6.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [protobufjs: Denial of Service via infinite loop in .proto option parsing](https://agentprime.io/advisories/GHSA-j3f2-48v5-ccww.md)
  `GHSA-j3f2-48v5-ccww`, `CVE-2026-59877` · npm `protobufjs`: affected `>=7.5.0, <7.6.5 || >=8.0.0, <8.6.6`, fixed in `7.6.5`, `8.6.6` · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [node-tar: Decompression/parse DoS via unlimited input](https://agentprime.io/advisories/GHSA-23hp-3jrh-7fpw.md)
  `GHSA-23hp-3jrh-7fpw`, `CVE-2026-59873` · npm `tar`: affected `<7.5.19`, fixed in `7.5.19` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [node-tar: Negative tar entry size causes infinite loop in archive replace](https://agentprime.io/advisories/GHSA-8x88-c5mf-7j5w.md)
  `GHSA-8x88-c5mf-7j5w`, `CVE-2026-59874` · npm `tar`: affected `<7.5.18`, fixed in `7.5.18` · CVSS 8.7 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Socket.IO: Engine.IO Polling Transport Connection Exhaustion](https://agentprime.io/advisories/GHSA-r635-g3xr-vw7x.md)
  `GHSA-r635-g3xr-vw7x`, `CVE-2026-59725` · npm `engine.io`: affected `>=4.1.0, <6.6.7`, fixed in `6.6.7` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [shell-quote: Quadratic-complexity Denial of Service in \`parse()\` (CWE-407)](https://agentprime.io/advisories/GHSA-395f-4hp3-45gv.md)
  `GHSA-395f-4hp3-45gv`, `CVE-2026-13311` · npm `shell-quote`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 8.7 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Mistune plugins/formatting: quadratic-time parsing on long runs of \`\~\~x\~\~\`, \`==x==\`, and \`^^x^^\` markers (strikethrough / mark / insert)](https://agentprime.io/advisories/GHSA-c8j7-8cv4-2xmq.md)
  `GHSA-c8j7-8cv4-2xmq`, `CVE-2026-59922`, `PYSEC-2026-2210` · PyPI `mistune`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Mistune inline_parser: quadratic-time parsing on long runs of \`\*\*x\*\*\` and \`\*\*\*x\*\*\*\` emphasis pairs](https://agentprime.io/advisories/GHSA-4j32-57v6-6g45.md)
  `GHSA-4j32-57v6-6g45`, `CVE-2026-59925`, `PYSEC-2026-2213` · PyPI `mistune`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Mistune directives/include: mutual \`.. include::\` recursion crashes the renderer with \`RecursionError\`, denial of service via two attacker-controlled markdown files](https://agentprime.io/advisories/GHSA-8mpj-m6qm-5qr8.md)
  `GHSA-8mpj-m6qm-5qr8`, `CVE-2026-59927`, `PYSEC-2026-2215` · PyPI `mistune`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service, CWE-755
- [Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions](https://agentprime.io/advisories/GHSA-ffq3-xpv3-j92q.md)
  `GHSA-ffq3-xpv3-j92q`, `CVE-2026-59928`, `PYSEC-2026-2216` · PyPI `mistune`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml](https://agentprime.io/advisories/GHSA-g796-fgmg-93mv.md)
  `GHSA-g796-fgmg-93mv`, `CVE-2026-59868` · npm `js-yaml`: affected `>=5.0.0, <5.2.0`, fixed in `5.2.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [js-yaml: YAML merge-key chains can force quadratic CPU consumption](https://agentprime.io/advisories/GHSA-52cp-r559-cp3m.md)
  `GHSA-52cp-r559-cp3m`, `CVE-2026-59869` · npm `js-yaml`: affected `>=3.0.0, <3.15.0 || >=4.0.0, <4.3.0`, fixed in `3.15.0`, `4.3.0` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA](https://agentprime.io/advisories/GHSA-724g-mxrg-4qvm.md)
  `GHSA-724g-mxrg-4qvm`, `CVE-2026-59870` · npm `js-yaml`: affected `>=5.0.0, <5.2.1`, fixed in `5.2.1` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Pillow \`GdImageFile.\_open()\`: image dimensions accepted without \`\_decompression_bomb_check()\`](https://agentprime.io/advisories/GHSA-phj9-mv4w-65pm.md)
  `GHSA-phj9-mv4w-65pm`, `BIT-pillow-2026-55380`, `CVE-2026-55380`, `PYSEC-2026-2256` · PyPI `pillow`: affected `<12.3.0`, fixed in `12.3.0` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Pillow \`BdfFontFile\`: \`Image.new()\` called without \`\_decompression_bomb_check()\` — bomb protection bypass via font loading](https://agentprime.io/advisories/GHSA-45hq-cxwh-f6vc.md)
  `GHSA-45hq-cxwh-f6vc`, `BIT-pillow-2026-55379`, `CVE-2026-55379`, `PYSEC-2026-2255` · PyPI `pillow`: affected `<12.3.0`, fixed in `12.3.0` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Pillow: \`FontFile.compile()\`: \`Image.new()\` called without \`\_decompression_bomb_check()\`](https://agentprime.io/advisories/GHSA-5x94-69rx-g8h2.md)
  `GHSA-5x94-69rx-g8h2`, `BIT-pillow-2026-54060`, `CVE-2026-54060`, `PYSEC-2026-2254` · PyPI `pillow`: affected `<12.3.0`, fixed in `12.3.0` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Pillow \`PcfFontFile.\_load_bitmaps()\`: \`Image.frombytes()\` called without \`\_decompression_bomb_check()\` — bomb protection bypass via PCF font loading](https://agentprime.io/advisories/GHSA-8v84-f9pq-wr9x.md)
  `GHSA-8v84-f9pq-wr9x`, `BIT-pillow-2026-54059`, `CVE-2026-54059`, `PYSEC-2026-2253` · PyPI `pillow`: affected `<12.3.0`, fixed in `12.3.0` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups](https://agentprime.io/advisories/GHSA-3jxr-9vmj-r5cp.md)
  `GHSA-3jxr-9vmj-r5cp`, `CVE-2026-13149` · npm `brace-expansion`: affected `<1.1.16 || >=2.0.0, <2.1.2 || >=3.0.0, <5.0.7`, fixed in `1.1.16`, `2.1.2`, `5.0.7` · CVSS 7.7 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)](https://agentprime.io/advisories/CVE-2026-53596.md)
  `CVE-2026-53596` · CVE record: freescout-help-desk freescout · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [vLLM denial of service via prompt embeds on M-RoPE models](https://agentprime.io/advisories/GHSA-33cg-gxv8-3p8g.md)
  `GHSA-33cg-gxv8-3p8g`, `CVE-2026-55514`, `PYSEC-2026-2303` · PyPI `vllm`: affected `>=0.12.0, <0.24.0`, fixed in `0.24.0` · CVSS 7.1 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Tornado: Quadratic DoS via Crafted Multipart Parameters](https://agentprime.io/advisories/GHSA-jhmp-mqwm-3gq8.md)
  `GHSA-jhmp-mqwm-3gq8`, `CVE-2025-67726`, `PYSEC-2025-267` · PyPI `tornado`: affected `<6.5.3`, fixed in `6.5.3` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service
- [Tornado: Quadratic DoS via Repeated Header Coalescing](https://agentprime.io/advisories/GHSA-c98p-7wgm-6p64.md)
  `GHSA-c98p-7wgm-6p64`, `CVE-2025-67725`, `PYSEC-2025-266` · PyPI `tornado`: affected `<6.5.3`, fixed in `6.5.3` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTA3LTIwVDE4OjU3OjM0LjAwMDAwMFoiLCJHSFNBLWM5OHAtN3dnbS02cDY0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTA3LTIxVDIxOjMwOjU0LjE2NTAwMFoiLCJDVkUtMjAyNi0xMDY3NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTA3LTIxVDIxOjMwOjU0LjE2NTAwMFoiLCJDVkUtMjAyNi0xMDY3NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.