# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation](https://agentprime.io/advisories/GHSA-rgw5-rvv9-x895.md) `GHSA-rgw5-rvv9-x895`, `CVE-2026-69152` · npm `brace-expansion`: affected `<1.1.18 || >=2.0.0, <2.1.4 || >=3.0.0, <3.0.6 || >=4.0.0, <5.0.9`, fixed in `1.1.18`, `2.1.4`, `3.0.6`, `5.0.9` · CVSS 7.5 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute](https://agentprime.io/advisories/CVE-2026-69079.md) `CVE-2026-69079` · CVE record: misp cti-transmute · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard](https://agentprime.io/advisories/GHSA-qp49-qgx5-5m26.md) `GHSA-qp49-qgx5-5m26`, `CVE-2026-13506` · Maven `org.bouncycastle:bc-fips` and 3 more: affected `<1.0.2.7 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.3`, fixed in `1.0.2.7`, `2.0.2`, `2.1.3` · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)](https://agentprime.io/advisories/CVE-2026-13586.md) `CVE-2026-13586` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [MLS wire decoder allocates attacker-declared opaque length before bounds check](https://agentprime.io/advisories/CVE-2026-12852.md) `CVE-2026-12852` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [Possible OOM from unbounded up-front allocation on a definite-length read](https://agentprime.io/advisories/CVE-2026-14682.md) `CVE-2026-14682` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [Quadratic-time escaping when stringifying X.500 distinguished names](https://agentprime.io/advisories/CVE-2026-58059.md) `CVE-2026-58059` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [HSS public-key level count unbounded, enabling huge allocation on verify](https://agentprime.io/advisories/CVE-2026-58060.md) `CVE-2026-58060` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [BCFKS keystore load honours unbounded KDF cost from untrusted file](https://agentprime.io/advisories/CVE-2026-58063.md) `CVE-2026-58063` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [Resource allocation without limits in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20482.md) `CVE-2026-20482` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 6.5 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [MLS hash-ratchet honours arbitrary 32-bit generation counter from sender](https://agentprime.io/advisories/CVE-2026-59644.md) `CVE-2026-59644` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [OER parser recurses without depth limit on self-referential IEEE 1609.2 schema](https://agentprime.io/advisories/CVE-2026-59645.md) `CVE-2026-59645` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [DTLS handshake reassembler allocates buffer from unchecked 24-bit length](https://agentprime.io/advisories/CVE-2026-59646.md) `CVE-2026-59646` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [CRMF/CMP password-MAC honours unbounded iteration count](https://agentprime.io/advisories/CVE-2026-59647.md) `CVE-2026-59647` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 6.9 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [OpenPGP Argon2 S2K honours attacker-chosen memory and passes](https://agentprime.io/advisories/CVE-2026-59648.md) `CVE-2026-59648` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 6.9 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [OpenPGP user-attribute subpacket length bounded only by JVM max memory](https://agentprime.io/advisories/CVE-2026-59649.md) `CVE-2026-59649` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [BKS/UBER keystore allocates from untrusted lengths before integrity check](https://agentprime.io/advisories/CVE-2026-12185.md) `CVE-2026-12185` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 1 more · CVSS 7.1 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input](https://agentprime.io/advisories/CVE-2026-15055.md) `CVE-2026-15055` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [ggml-org llama.cpp Jinja Minja Template parser.cpp assertion](https://agentprime.io/advisories/CVE-2026-18581.md) `CVE-2026-18581` · CVE record: ggml-org llama.cpp · CVSS 4.8 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame.](https://agentprime.io/advisories/CVE-2026-67978.md) `CVE-2026-67978` · CVE record · CVSS 7.5 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service, CWE-20 - [An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.](https://agentprime.io/advisories/CVE-2026-67977.md) `CVE-2026-67977` · CVE record · CVSS 7.5 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service (DoS) via inputting unsafe paramete…](https://agentprime.io/advisories/CVE-2026-67976.md) `CVE-2026-67976` · CVE record · CVSS 7.5 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.](https://agentprime.io/advisories/CVE-2026-67973.md) `CVE-2026-67973` · CVE record · CVSS 7.5 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service - [Duplicate Advisory: better-auth has an external request basePath modification DoS](https://agentprime.io/advisories/GHSA-3q45-2fh7-66cj.md) `GHSA-3q45-2fh7-66cj` · npm `better-auth`: affected `<1.4.2`, fixed in `1.4.2` · CVSS 5.9 Medium · Withdrawn · Not analysed yet · Published 2 Aug 2026 · Tags: Denial of service - [PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS](https://agentprime.io/advisories/CVE-2026-10774.md) `CVE-2026-10774` · CVE record: zephyrproject zephyr · CVSS 2.4 Low · Not analysed yet · Published 2 Aug 2026 · Tags: Denial of service - [guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1](https://agentprime.io/advisories/GHSA-9qx2-v587-q3gg.md) `GHSA-9qx2-v587-q3gg`, `CVE-2026-55734`, `EEF-CVE-2026-55734` · Hex `guardian`: affected `>=2.0.0, <2.4.1`, fixed in `2.4.1` · CVSS 6.9 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation](https://agentprime.io/advisories/GHSA-fjr5-7xrc-hmpj.md) `GHSA-fjr5-7xrc-hmpj`, `CVE-2026-55733`, `EEF-CVE-2026-55733` · Hex `guardian`: affected `>=2.0.0, <2.4.1`, fixed in `2.4.1` · CVSS 6.9 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys](https://agentprime.io/advisories/GHSA-xqch-c77q-rgh5.md) `GHSA-xqch-c77q-rgh5`, `CVE-2026-54894`, `EEF-CVE-2026-54894` · Hex `guardian`: affected `>=0.1.0, <2.4.1`, fixed in `2.4.1` · CVSS 6.9 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [Duplicate Advisory: Guzzle: Unbounded response cookies risk denial of service](https://agentprime.io/advisories/GHSA-3fvr-2jw6-crq4.md) `GHSA-3fvr-2jw6-crq4` · Packagist `guzzlehttp/guzzle`: affected `*`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken](https://agentprime.io/advisories/GHSA-3mcp-22mf-vrw3.md) `GHSA-3mcp-22mf-vrw3` · npm `axios`: affected `>=1.15.1`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [Duplicate Advisory: Axios: HTTP/2 streamed uploads bypass \`maxBodyLength\`](https://agentprime.io/advisories/GHSA-fqj3-h9pc-443h.md) `GHSA-fqj3-h9pc-443h` · npm `axios`: affected `>=1.13.0`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [Duplicate Advisory: Axios: Excessive recursion in formDataToJSON can cause denial of service](https://agentprime.io/advisories/GHSA-fq2j-3j99-rx65.md) `GHSA-fq2j-3j99-rx65` · npm `axios`: affected `>=1.0.0`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [Duplicate Advisory: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service](https://agentprime.io/advisories/GHSA-4ww2-rjh2-xpv9.md) `GHSA-4ww2-rjh2-xpv9` · npm `axios`: affected `>=1.0.0`, no fixed version yet · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [Duplicate Advisory: Axios: Fetch adapter \`ReadableStream\` uploads bypass \`maxBodyLength\`](https://agentprime.io/advisories/GHSA-39j5-w47m-2gmv.md) `GHSA-39j5-w47m-2gmv` · npm `axios`: affected `>=1.7.0`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [FreeRDP before 3.29.0 Denial of Service via serial DeviceControl](https://agentprime.io/advisories/CVE-2026-67303.md) `CVE-2026-67303` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service](https://agentprime.io/advisories/CVE-2026-67302.md) `CVE-2026-67302` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response](https://agentprime.io/advisories/CVE-2026-67297.md) `CVE-2026-67297` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service - [zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit](https://agentprime.io/advisories/GHSA-3whf-vgf2-9w6g.md) `GHSA-3whf-vgf2-9w6g` · crates.io `zaino-state`: affected `<0.4.1`, fixed in `0.4.1` · CVSS 4.0, no score published · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS](https://agentprime.io/advisories/GHSA-phj3-59pf-cp83.md) `GHSA-phj3-59pf-cp83`, `CVE-2026-53505`, `PYSEC-2026-3621` · PyPI `thumbor`: affected `<7.8.0`, fixed in `7.8.0` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Thumbor has Regex Denial of Service (ReDoS) in \`convolution\` filter](https://agentprime.io/advisories/GHSA-5vjc-7cxw-4w6j.md) `GHSA-5vjc-7cxw-4w6j`, `CVE-2026-53504`, `PYSEC-2026-3616` · PyPI `thumbor`: affected `<7.8.0`, fixed in `7.8.0` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS](https://agentprime.io/advisories/GHSA-cqjp-jf4r-h5q9.md) `GHSA-cqjp-jf4r-h5q9`, `CVE-2026-53503`, `PYSEC-2026-3619` · PyPI `thumbor`: affected `<7.8.0`, fixed in `7.8.0` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service, CWE-20 - [Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot](https://agentprime.io/advisories/GHSA-6x26-6r6f-m537.md) `GHSA-6x26-6r6f-m537`, `CVE-2026-53500`, `PYSEC-2026-3617` · PyPI `thumbor`: affected `<7.8.0`, fixed in `7.8.0` · CVSS 8.2 High · Not analysed yet · Published 31 Jul 2026 · Tags: Server-side request forgery (SSRF), Denial of service - [re2: Global \`String.prototype.match\` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)](https://agentprime.io/advisories/GHSA-6hxr-mr5r-9836.md) `GHSA-6hxr-mr5r-9836`, `CVE-2026-68499` · npm `re2`: affected `<1.25.2`, fixed in `1.25.2` · CVSS 6.2 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)](https://agentprime.io/advisories/GHSA-93wv-jw9v-4972.md) `GHSA-93wv-jw9v-4972`, `CVE-2026-56819` · Maven `io.netty:netty-codec-http2`: affected `>=4.2.0, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex](https://agentprime.io/advisories/GHSA-fg7f-2386-8897.md) `GHSA-fg7f-2386-8897`, `CVE-2026-12061`, `PYSEC-2026-3582` · PyPI `nltk`: affected `<3.10.0`, fixed in `3.10.0` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Spring Data: Unbounded property-path cache keyed by externally-supplied path string](https://agentprime.io/advisories/GHSA-88fw-v6x4-3f58.md) `GHSA-88fw-v6x4-3f58`, `CVE-2026-41695` · Maven `org.springframework.data:spring-data-commons`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.13`, fixed in `4.0.6`, `3.5.12` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service](https://agentprime.io/advisories/GHSA-ghrq-5wpp-hxx5.md) `GHSA-ghrq-5wpp-hxx5`, `CVE-2026-52856`, `GO-2026-6156` · Go `github.com/pterodactyl/wings`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service, CWE-20, CWE-129, CWE-248 - [Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM](https://agentprime.io/advisories/GHSA-q6hh-gp44-4hcm.md) `GHSA-q6hh-gp44-4hcm`, `CVE-2026-52857`, `GO-2026-6159` · Go `github.com/pterodactyl/wings`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 5.5 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers](https://agentprime.io/advisories/CVE-2026-10686.md) `CVE-2026-10686` · CVE record: zephyrproject zephyr · CVSS 5.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS](https://agentprime.io/advisories/GHSA-hjcp-jmpx-g3qm.md) `GHSA-hjcp-jmpx-g3qm`, `CVE-2026-64607` · Maven `org.apache.httpcomponents.client5:httpclient5`: affected `>=5.0-alpha1, <5.6.3`, fixed in `5.6.3` · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service](https://agentprime.io/advisories/CVE-2026-18358.md) `CVE-2026-18358` · CVE record: GNOME gnome-remote-desktop and 4 more · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Denial of Service via Unrestricted Payload Buffering in MCP Toolbox](https://agentprime.io/advisories/CVE-2026-14539.md) `CVE-2026-14539` · CVE record: Google mcp-toolbox · CVSS 6.6 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service](https://agentprime.io/advisories/CVE-2026-55768.md) `CVE-2026-55768` · CVE record: allinurl goaccess · CVSS 8.7 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service, CWE-681 - [IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2024-25039.md) `CVE-2024-25039` · CVE record: IBM Engineering Requirements Management DOORS and DOORS Web Access · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [IBM DataPower Gateway affected by denial of service](https://agentprime.io/advisories/CVE-2026-12733.md) `CVE-2026-12733` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries](https://agentprime.io/advisories/CVE-2026-10695.md) `CVE-2026-10695` · CVE record: IBM Db2 · CVSS 6.2 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [Memory leak in OpenVPN](https://agentprime.io/advisories/CVE-2026-12932.md) `CVE-2026-12932` · CVE record: OpenVPN OpenVPN · CVSS 7.1 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-9322.md) `CVE-2026-9322` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser](https://agentprime.io/advisories/CVE-2026-23985.md) `CVE-2026-23985` · CVE record: Apache Software Foundation Apache Superset · CVSS 5.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service - [MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport](https://agentprime.io/advisories/GHSA-h669-8m4g-r2hc.md) `GHSA-h669-8m4g-r2hc`, `CVE-2026-67432` · RubyGems `mcp`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .