# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests](https://agentprime.io/advisories/GHSA-9299-c6m4-mjhc.md) `GHSA-9299-c6m4-mjhc`, `CVE-2024-7708` · Maven `org.eclipse.jetty:jetty-server`: affected `>=10.0.7, <10.0.23 || >=11.0.7, <11.0.23`, fixed in `10.0.23`, `11.0.23` · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps](https://agentprime.io/advisories/GHSA-f5gf-2cj8-52g2.md) `GHSA-f5gf-2cj8-52g2`, `CVE-2026-59942`, `PKSA-6r8f-nxsb-67bq` · Packagist `dompdf/dompdf`: affected `<3.1.6`, fixed in `3.1.6` · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Dompdf: Uncontrolled resource consumption based on declared BMP dimensions](https://agentprime.io/advisories/GHSA-8hg6-c449-896m.md) `GHSA-8hg6-c449-896m`, `CVE-2026-59941`, `PKSA-gh7h-hhy4-byg7` · Packagist `dompdf/dompdf`: affected `<3.1.6`, fixed in `3.1.6` · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads](https://agentprime.io/advisories/GHSA-w867-jm58-p9pv.md) `GHSA-w867-jm58-p9pv`, `CVE-2026-58661` · npm `n8n`: affected `<1.123.58 || >=2.0.0, <2.28.0`, fixed in `1.123.58`, `2.28.0` · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Netty: \[Bzip2Decoder\] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang](https://agentprime.io/advisories/GHSA-558v-64gr-wgg4.md) `GHSA-558v-64gr-wgg4`, `CVE-2026-59901` · Maven `io.netty:netty-codec` and 1 more: affected `<4.1.136.Final`, fixed in `4.1.136.Final` · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Netty: \[HttpContentEncoder\] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service](https://agentprime.io/advisories/GHSA-q4f6-jm68-57ww.md) `GHSA-q4f6-jm68-57ww`, `CVE-2026-59899` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 6.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types](https://agentprime.io/advisories/GHSA-hpcc-26xq-25fv.md) `GHSA-hpcc-26xq-25fv`, `CVE-2026-56816` · Maven `io.netty:netty-codec-http3`: affected `<4.2.16.Final`, fixed in `4.2.16.Final` · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Netty: \[SpdyHttpDecoder\] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion](https://agentprime.io/advisories/GHSA-jppx-w49h-x2qq.md) `GHSA-jppx-w49h-x2qq`, `CVE-2026-56745` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Netty: \[codec-haproxy\] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion](https://agentprime.io/advisories/GHSA-q6cq-mhr2-jmr5.md) `GHSA-q6cq-mhr2-jmr5`, `CVE-2026-55851` · Maven `io.netty:netty-codec-haproxy`: affected `>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation](https://agentprime.io/advisories/GHSA-mvh2-crg5-v77c.md) `GHSA-mvh2-crg5-v77c`, `CVE-2026-55833` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Netty SPDY SETTINGS frame count materializes unbounded settings map](https://agentprime.io/advisories/GHSA-6jqx-86gh-f27w.md) `GHSA-6jqx-86gh-f27w`, `CVE-2026-55831` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Server crash via aggregation pipeline expression with compound wildcard index specification](https://agentprime.io/advisories/CVE-2026-13055.md) `CVE-2026-13055` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Transaction Command Insufficient Input Validation Leading to Process Termination](https://agentprime.io/advisories/CVE-2026-13058.md) `CVE-2026-13058` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Find command with $meta sort can lead to crash](https://agentprime.io/advisories/CVE-2026-9737.md) `CVE-2026-9737` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-13064.md) `CVE-2026-13064` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion](https://agentprime.io/advisories/CVE-2026-13069.md) `CVE-2026-13069` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination](https://agentprime.io/advisories/CVE-2026-13073.md) `CVE-2026-13073` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-13074.md) `CVE-2026-13074` · CVE record: MongoDB MongoDB Server · CVSS 6.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation](https://agentprime.io/advisories/CVE-2026-13075.md) `CVE-2026-13075` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Aggregation Framework Memory Exhaustion Leading to Process Termination](https://agentprime.io/advisories/CVE-2026-13076.md) `CVE-2026-13076` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Resource allocation without limits in Elgg](https://agentprime.io/advisories/CVE-2026-65650.md) `CVE-2026-65650` · CVE record: Elgg Elgg · CVSS 4.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer](https://agentprime.io/advisories/CVE-2026-64834.md) `CVE-2026-64834` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Unexpected exit in certain situations with NSEC and NSEC3 both present](https://agentprime.io/advisories/CVE-2026-13204.md) `CVE-2026-13204` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Record ordering based unexpected exit with CNAME or DNAME](https://agentprime.io/advisories/CVE-2026-12617.md) `CVE-2026-12617` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Potential memory usage beyond configured limits](https://agentprime.io/advisories/CVE-2026-11622.md) `CVE-2026-11622` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Key Record using PRIVATEDNS algorithm may lead to unexpected exit](https://agentprime.io/advisories/CVE-2026-10822.md) `CVE-2026-10822` · CVE record: ISC BIND 9 · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service, CWE-1284 - [XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX](https://agentprime.io/advisories/CVE-2026-14865.md) `CVE-2026-14865` · CVE record: Progress Software Telerik UI for ASP.NET AJAX · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration](https://agentprime.io/advisories/CVE-2026-56444.md) `CVE-2026-56444` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries](https://agentprime.io/advisories/CVE-2026-41637.md) `CVE-2026-41637` · CVE record: NLnet Labs Unbound · CVSS 3.7 Low · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments](https://agentprime.io/advisories/CVE-2026-14586.md) `CVE-2026-14586` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [ReDoS in Open Mercato](https://agentprime.io/advisories/CVE-2026-16270.md) `CVE-2026-16270` · CVE record: Open Mercato Open Mercato · CVSS 6.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Denial-of-Service in OpenCanary's MongoDB module](https://agentprime.io/advisories/CVE-2026-16551.md) `CVE-2026-16551` · CVE record: Thinkst Applied Research OpenCanary · CVSS 6.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service, CWE-20 - [fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives](https://agentprime.io/advisories/GHSA-px8p-9vwx-vf98.md) `GHSA-px8p-9vwx-vf98`, `CVE-2026-45820` · npm `fflate`: affected `>=0.4.5, <0.4.9 || >=0.5.0, <0.5.4 || >=0.6.0, <0.6.11 || >=0.7.0, <0.7.5 || >=0.8.0, <0.8.3`, fixed in `0.4.9`, `0.5.4`, `0.6.11`, `0.7.5`, `0.8.3` · CVSS 6.6 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [An issue in Unistal Systems Pvt.](https://agentprime.io/advisories/CVE-2026-38763.md) `CVE-2026-38763` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service, CWE-703 - [Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-63263.md) `CVE-2026-63263` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-63261.md) `CVE-2026-63261` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-63260.md) `CVE-2026-63260` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Uncontrolled Recursion in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-63144.md) `CVE-2026-63144` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits](https://agentprime.io/advisories/GHSA-8r6m-32jq-jx6q.md) `GHSA-8r6m-32jq-jx6q`, `CVE-2026-73569` · npm `fast-xml-parser`: affected `>=5.9.3, <5.10.1`, fixed in `5.10.1` · CVSS 8.7 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake](https://agentprime.io/advisories/GHSA-9mqv-5hh9-4cgg.md) `GHSA-9mqv-5hh9-4cgg`, `CVE-2026-73565` · npm `@hono/node-server`: affected `>=2.0.0, <2.0.10`, fixed in `2.0.10` · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities](https://agentprime.io/advisories/GHSA-hrxh-6v49-42gf.md) `GHSA-hrxh-6v49-42gf`, `GO-2026-6061` · Go `google.golang.org/grpc`: affected `<1.82.1`, fixed in `1.82.1` · CVSS 4.0, no score published · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service, Broken access control, CWE-248 - [jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)](https://agentprime.io/advisories/GHSA-r7wm-3cxj-wff9.md) `GHSA-r7wm-3cxj-wff9`, `CVE-2026-68494` · Maven `com.fasterxml.jackson.core:jackson-core` and 1 more: affected `<2.18.8 || >=2.19.0, <2.21.4`, fixed in `2.18.8`, `2.21.4` · CVSS 8.7 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Improper access control in Oracle Corporation Oracle Production Scheduling](https://agentprime.io/advisories/CVE-2026-62518.md) `CVE-2026-62518` · CVE record: Oracle Corporation Oracle Production Scheduling · CVSS 7.6 High · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure, Broken access control, Denial of service - [Uncontrolled resource consumption in Oracle Corporation Oracle Time and Labor](https://agentprime.io/advisories/CVE-2026-62508.md) `CVE-2026-62508` · CVE record: Oracle Corporation Oracle Time and Labor · CVSS 3.1 Low · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Improper access control in Oracle Corporation Oracle HRMS (US)](https://agentprime.io/advisories/CVE-2026-62465.md) `CVE-2026-62465` · CVE record: Oracle Corporation Oracle HRMS (US) · CVSS 6.6 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, Denial of service - [Missing authentication in Oracle Corporation Oracle Workflow](https://agentprime.io/advisories/CVE-2026-61247.md) `CVE-2026-61247` · CVE record: Oracle Corporation Oracle Workflow · CVSS 4.8 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Authentication bypass, Denial of service - [Uncontrolled resource consumption in Oracle Corporation Oracle Agile Engineering Data Management](https://agentprime.io/advisories/CVE-2026-61195.md) `CVE-2026-61195` · CVE record: Oracle Corporation Oracle Agile Engineering Data Management · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Oracle Corporation Oracle Agile Engineering Data Management](https://agentprime.io/advisories/CVE-2026-61194.md) `CVE-2026-61194` · CVE record: Oracle Corporation Oracle Agile Engineering Data Management · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Oracle Corporation Oracle Agile Engineering Data Management](https://agentprime.io/advisories/CVE-2026-61192.md) `CVE-2026-61192` · CVE record: Oracle Corporation Oracle Agile Engineering Data Management · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Improper resource shutdown in Oracle Corporation Oracle Agile Engineering Data Management](https://agentprime.io/advisories/CVE-2026-61187.md) `CVE-2026-61187` · CVE record: Oracle Corporation Oracle Agile Engineering Data Management · CVSS 2.8 Low · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Missing authentication in Oracle Corporation Oracle Agile Engineering Data Management](https://agentprime.io/advisories/CVE-2026-61186.md) `CVE-2026-61186` · CVE record: Oracle Corporation Oracle Agile Engineering Data Management · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, Authentication bypass, Denial of service - [Information disclosure in Oracle Corporation Oracle Commerce Guided Search Platform Services](https://agentprime.io/advisories/CVE-2026-61165.md) `CVE-2026-61165` · CVE record: Oracle Corporation Oracle Commerce Guided Search Platform Services · CVSS 7.1 High · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure, Denial of service - [Improper access control in Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience…](https://agentprime.io/advisories/CVE-2026-61160.md) `CVE-2026-61160` · CVE record: Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager · CVSS 8.1 High · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, Denial of service, CWE-20 - [Missing authentication in Oracle Corporation Oracle Commerce Guided Search Platform Services](https://agentprime.io/advisories/CVE-2026-61155.md) `CVE-2026-61155` · CVE record: Oracle Corporation Oracle Commerce Guided Search Platform Services · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, Authentication bypass, Denial of service - [Uncontrolled resource consumption in Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience…](https://agentprime.io/advisories/CVE-2026-61147.md) `CVE-2026-61147` · CVE record: Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager · CVSS 6.2 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-61144.md) `CVE-2026-61144` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-61128.md) `CVE-2026-61128` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Information disclosure in Oracle Corporation Oracle HRMS (US)](https://agentprime.io/advisories/CVE-2026-61123.md) `CVE-2026-61123` · CVE record: Oracle Corporation Oracle HRMS (US) · CVSS 4.2 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure, Denial of service - [Uncontrolled resource consumption in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-61109.md) `CVE-2026-61109` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-61108.md) `CVE-2026-61108` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .