# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood](https://agentprime.io/advisories/GHSA-52jp-gj8w-j6xh.md) `GHSA-52jp-gj8w-j6xh`, `CVE-2026-67430` · RubyGems `mcp`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 5.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)](https://agentprime.io/advisories/GHSA-7683-3w9x-ch42.md) `GHSA-7683-3w9x-ch42`, `CVE-2026-63119` · RubyGems `mcp`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 6.2 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)](https://agentprime.io/advisories/GHSA-xpxj-f2fm-rqch.md) `GHSA-xpxj-f2fm-rqch`, `CVE-2026-67437`, `GO-2026-6146` · Go `github.com/OliveTin/OliveTin`: affected `>=0.0.0-20251024001301-45f9c18bc3ee, <0.0.0-20260708075951-ec114e95d297`, fixed in `0.0.0-20260708075951-ec114e95d297` · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2](https://agentprime.io/advisories/CVE-2026-11897.md) `CVE-2026-11897` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [IBM Enterprise Build of Quarkus is affected by a DoS vulnerability](https://agentprime.io/advisories/CVE-2026-16308.md) `CVE-2026-16308` · CVE record: IBM Enterprise Build of Quarkus · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in \_parse_time](https://agentprime.io/advisories/CVE-2026-60075.md) `CVE-2026-60075` · CVE record · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [DFIR-IRIS Missing Brute Force Protection in User Authentication](https://agentprime.io/advisories/CVE-2026-18362.md) `CVE-2026-18362` · CVE record: dfir-iris iris-web · CVSS 5.9 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [DFIR-IRIS Missing Brute Force Protection in OTP Validation](https://agentprime.io/advisories/CVE-2026-16971.md) `CVE-2026-16971` · CVE record: dfir-iris iris-web · CVSS 5.9 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2026-15975.md) `CVE-2026-15975` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [OpenTelemetry Javaagent RMI context propagation allows resource exhaustion](https://agentprime.io/advisories/GHSA-fq3f-m5qm-99f5.md) `GHSA-fq3f-m5qm-99f5`, `CVE-2026-54712` · Maven `io.opentelemetry.javaagent:opentelemetry-javaagent`: affected `<2.27.0`, fixed in `2.27.0` · CVSS 5.3 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries](https://agentprime.io/advisories/CVE-2026-67194.md) `CVE-2026-67194` · CVE record: svarshavchik Courier IMAP and 1 more · CVSS 7.1 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation](https://agentprime.io/advisories/CVE-2026-15144.md) `CVE-2026-15144` · CVE record: @fastify/rate-limit @fastify/rate-limit · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2026 · Tags: Authentication bypass, Denial of service - [nanoid: custom generators can loop indefinitely when size is zero](https://agentprime.io/advisories/GHSA-2v37-7h3g-55p8.md) `GHSA-2v37-7h3g-55p8`, `CVE-2026-67213` · npm `nanoid`: affected `<3.3.18 || >=4.0.0, <5.1.6`, fixed in `3.3.18`, `5.1.6` · CVSS 8.2 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [nanoid: non-secure generators can loop indefinitely with negative size](https://agentprime.io/advisories/GHSA-28wg-ghj8-5hjv.md) `GHSA-28wg-ghj8-5hjv`, `CVE-2026-67214` · npm `nanoid`: affected `<3.3.16 || >=4.0.0, <5.1.16`, fixed in `3.3.16`, `5.1.16` · CVSS 8.2 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision](https://agentprime.io/advisories/CVE-2026-16543.md) `CVE-2026-16543` · CVE record · CVSS 7.1 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service, Broken access control - [Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision](https://agentprime.io/advisories/CVE-2026-15228.md) `CVE-2026-15228` · CVE record · CVSS 7.1 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service, Broken access control - [cJSON cJSON_Compare Exponential Complexity Denial of Service](https://agentprime.io/advisories/CVE-2026-67216.md) `CVE-2026-67216` · CVE record: DaveGamble cJSON · CVSS 8.2 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion](https://agentprime.io/advisories/CVE-2026-67215.md) `CVE-2026-67215` · CVE record: DaveGamble cJSON · CVSS 8.7 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors](https://agentprime.io/advisories/CVE-2026-58182.md) `CVE-2026-58182` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 8.2 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery](https://agentprime.io/advisories/CVE-2026-58178.md) `CVE-2026-58178` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 8.2 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [Apache Traffic Server: HostDB SRV handling leaks memory](https://agentprime.io/advisories/CVE-2026-58175.md) `CVE-2026-58175` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 8.2 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion](https://agentprime.io/advisories/CVE-2026-65324.md) `CVE-2026-65324` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 8.2 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server](https://agentprime.io/advisories/CVE-2026-58151.md) `CVE-2026-58151` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 8.7 High · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service - [td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode](https://agentprime.io/advisories/GHSA-whmm-qj9r-wvr2.md) `GHSA-whmm-qj9r-wvr2`, `CVE-2026-54638`, `GO-2026-6138` · Go `github.com/gotd/td`: affected `<0.145.1`, fixed in `0.145.1` · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-14981.md) `CVE-2026-14981` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [IBM WebSphere Application Server Liberty is affected by a denial of service](https://agentprime.io/advisories/CVE-2026-16192.md) `CVE-2026-16192` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 7.1 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding](https://agentprime.io/advisories/GHSA-85rg-p3fr-xc2f.md) `GHSA-85rg-p3fr-xc2f`, `CVE-2026-54609`, `PYSEC-2026-3615` · Maven `com.quietterminal:qti-neon` and 2 more: affected `=1.0.0`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service, CWE-406 - [TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling](https://agentprime.io/advisories/CVE-2026-67183.md) `CVE-2026-67183` · CVE record: GeneralSandman TinyWeb · CVSS 8.7 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS](https://agentprime.io/advisories/GHSA-g6v3-7xmc-w563.md) `GHSA-g6v3-7xmc-w563`, `CVE-2026-54332`, `GO-2026-6122` · Go `github.com/gopacket/gopacket`: affected `<1.6.1`, fixed in `1.6.1` · CVSS 6.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded \~4 GiB allocation (unauthenticated remote DoS)](https://agentprime.io/advisories/GHSA-6r28-9ppf-4hj5.md) `GHSA-6r28-9ppf-4hj5`, `CVE-2026-54345`, `GO-2026-6121` · Go `github.com/gopacket/gopacket`: affected `<1.6.1`, fixed in `1.6.1` · CVSS 6.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Memory corruption, Denial of service - [Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding](https://agentprime.io/advisories/CVE-2026-66754.md) `CVE-2026-66754` · CVE record: tomaka rouille · CVSS 8.2 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [Resource allocation without limits in NVIDIA DCGM and others](https://agentprime.io/advisories/CVE-2026-47483.md) `CVE-2026-47483` · CVE record: NVIDIA DCGM and 1 more · CVSS 8.2 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)](https://agentprime.io/advisories/GHSA-xvc3-826v-xf47.md) `GHSA-xvc3-826v-xf47`, `CVE-2026-61609`, `PKSA-dkjc-6qnp-q5rq` · Packagist `pterodactyl/panel`: affected `>=1.7.0, <1.13.0`, fixed in `1.13.0` · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [Apache Tomcat: DoS via WebSocket chat example](https://agentprime.io/advisories/CVE-2026-66299.md) `CVE-2026-66299` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [Quadratic Behavior in xml.etree.ElementPath Index Predicates](https://agentprime.io/advisories/CVE-2026-6879.md) `CVE-2026-6879` · CVE record: Python Software Foundation CPython · CVSS 2.0 Low · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data](https://agentprime.io/advisories/CVE-2026-66920.md) `CVE-2026-66920` · CVE record: Pivotick Pivotick · CVSS 8.2 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [Viridian STIMER division by zero](https://agentprime.io/advisories/CVE-2026-62431.md) `CVE-2026-62431` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [x86 shadow paging is deprecated](https://agentprime.io/advisories/CVE-2026-42493.md) `CVE-2026-42493` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [Zip Bomb in Lookyloo Capture Upload Allows Denial of Service](https://agentprime.io/advisories/CVE-2026-66913.md) `CVE-2026-66913` · CVE record: lookyloo lookyloo · CVSS 6.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion](https://agentprime.io/advisories/EEF-CVE-2026-65624.md) `EEF-CVE-2026-65624`, `CVE-2026-65624` · Hex `cowboy`: affected `>=2.0.0-pre.4, <2.18.0`, fixed in `2.18.0` · CVSS 6.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS](https://agentprime.io/advisories/EEF-CVE-2026-59248.md) `EEF-CVE-2026-59248`, `CVE-2026-59248` · Hex `cowlib`: affected `>=2.0.0-pre.1, <2.19.0`, fixed in `2.19.0` · CVSS 8.7 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-43804.md) `CVE-2026-43804` · CVE record: Apple Safari and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Apple macOS](https://agentprime.io/advisories/CVE-2026-28932.md) `CVE-2026-28932` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Apple macOS](https://agentprime.io/advisories/CVE-2026-43768.md) `CVE-2026-43768` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-64724.md) `CVE-2026-64724` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Apple macOS](https://agentprime.io/advisories/CVE-2026-43806.md) `CVE-2026-43806` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)](https://agentprime.io/advisories/CVE-2026-10683.md) `CVE-2026-10683` · CVE record: zephyrproject zephyr · CVSS 2.4 Low · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser](https://agentprime.io/advisories/CVE-2026-66730.md) `CVE-2026-66730` · CVE record: boazsegev facil.io · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding](https://agentprime.io/advisories/CVE-2026-54890.md) `CVE-2026-54890` · CVE record: Erlang OTP · CVSS 8.2 High · Not analysed yet · Published 27 Jul 2026 · Tags: Memory corruption, Denial of service, CWE-1284 - [Denial of service via exponential certificate policy tree growth in path validation](https://agentprime.io/advisories/CVE-2026-59251.md) `CVE-2026-59251` · CVE record: Erlang OTP · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag](https://agentprime.io/advisories/CVE-2026-17574.md) `CVE-2026-17574` · CVE record: The HDF Group HDF5 · CVSS 5.2 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Memory corruption, Denial of service - [epmd permanent DoS via EMFILE on accept(2) in erts](https://agentprime.io/advisories/CVE-2026-42792.md) `CVE-2026-42792` · CVE record: Erlang OTP · CVSS 6.3 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service, CWE-755 - [TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain](https://agentprime.io/advisories/CVE-2026-58227.md) `CVE-2026-58227` · CVE record: Erlang OTP · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [Denial of service via unbounded document content extraction in Mattermost Server](https://agentprime.io/advisories/CVE-2026-10600.md) `CVE-2026-10600` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion](https://agentprime.io/advisories/CVE-2026-17513.md) `CVE-2026-17513` · CVE record: ggml-org whisper.cpp · CVSS 4.8 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop](https://agentprime.io/advisories/GHSA-8wv5-x4w7-5gww.md) `GHSA-8wv5-x4w7-5gww`, `BIT-thrift-2026-43871`, `CVE-2026-43871`, `PKSA-t5dt-c9kk-znks`, `PYSEC-2026-3926` · Go `github.com/apache/thrift` and 3 more: affected `<0.24.0`, fixed in `0.24.0` · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [Apache Thrift: Rust binary protocol non-strict path missing string size limit](https://agentprime.io/advisories/CVE-2026-58389.md) `CVE-2026-58389` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [Apache Thrift: Node.js quadratic-time DoS in server receive transports](https://agentprime.io/advisories/CVE-2026-55968.md) `CVE-2026-55968` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [Apache Thrift: Unbounded Read Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-45112.md) `CVE-2026-45112` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.9 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion](https://agentprime.io/advisories/CVE-2026-17501.md) `CVE-2026-17501` · CVE record: ggml-org llama.cpp · CVSS 6.9 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .