# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Expat Denial of Service via storeAtts() Quadratic Complexity](https://agentprime.io/advisories/CVE-2026-66046.md) `CVE-2026-66046` · CVE record: libexpat project libexpat · CVSS 8.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability](https://agentprime.io/advisories/CVE-2026-73997.md) `CVE-2026-73997` · CVE record: Nexcess Starter Templates by Kadence WP · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [Denial-of-service in the Widget component](https://agentprime.io/advisories/CVE-2026-74982.md) `CVE-2026-74982` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [ArcadeDB before 26.8.1 Denial of Service via range()](https://agentprime.io/advisories/CVE-2026-75841.md) `CVE-2026-75841` · CVE record: ArcadeData arcadedb · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM](https://agentprime.io/advisories/CVE-2026-74903.md) `CVE-2026-74903` · CVE record: siyuan-note siyuan · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c](https://agentprime.io/advisories/CVE-2026-71675.md) `CVE-2026-71675` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [docx4j: Stack Overflow via Cyclic \`w:basedOn\` Style Chain leads to Denial of Service](https://agentprime.io/advisories/GHSA-gc95-3vw8-vg43.md) `GHSA-gc95-3vw8-vg43`, `CVE-2026-53752` · Maven `org.docx4j:docx4j-core`: affected `<11.5.14`, fixed in `11.5.14` · CVSS 7.5 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard](https://agentprime.io/advisories/GHSA-j659-8xh6-5pq5.md) `GHSA-j659-8xh6-5pq5`, `CVE-2026-91987` · PyPI `atomic-agents-stack`: affected `<1.1.0`, fixed in `1.1.0` · CVSS 7.1 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-65347.md) `CVE-2026-65347` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [Reachable assertion in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-43667.md) `CVE-2026-43667` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit](https://agentprime.io/advisories/CVE-2026-65976.md) `CVE-2026-65976` · CVE record: deskflow deskflow · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference](https://agentprime.io/advisories/CVE-2026-75013.md) `CVE-2026-75013` · CVE record: TOTOLINK EX1200L · CVSS 7.1 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service, Memory corruption - [TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference](https://agentprime.io/advisories/CVE-2026-75012.md) `CVE-2026-75012` · CVE record: TOTOLINK EX1200L · CVSS 7.1 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service, Memory corruption - [Certain HP Smart Tank All in One – Potential Denial of Service](https://agentprime.io/advisories/CVE-2026-17639.md) `CVE-2026-17639` · CVE record: HP Inc HP Smart Tank 5101 All-in-One Printer and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [Netty: Memory Exhaustion in SctpMessageCompletionHandler](https://agentprime.io/advisories/GHSA-2qj4-mmr9-4v2f.md) `GHSA-2qj4-mmr9-4v2f`, `CVE-2026-59902` · Maven `io.netty:netty-transport-sctp`: affected `>=4.2.0.Final, <4.2.17.Final || <4.1.137.Final`, fixed in `4.2.17.Final`, `4.1.137.Final` · CVSS 7.5 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)](https://agentprime.io/advisories/GHSA-prg7-hcfm-mfcr.md) `GHSA-prg7-hcfm-mfcr`, `CVE-2026-59893`, `PYSEC-2026-3698` · PyPI `sqlparse`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 7.5 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [sqlparse: TokenList.\_\_init\_\_ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger](https://agentprime.io/advisories/GHSA-pwgv-4x5q-6m9f.md) `GHSA-pwgv-4x5q-6m9f`, `CVE-2026-54284`, `PYSEC-2026-3699` · PyPI `sqlparse`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 8.7 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass](https://agentprime.io/advisories/GHSA-v836-6xw4-9cx3.md) `GHSA-v836-6xw4-9cx3`, `CVE-2026-92961` · npm `vm2`: affected `<3.11.6`, fixed in `3.11.6` · CVSS 8.7 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike](https://agentprime.io/advisories/GHSA-gmc2-2x9w-cgh9.md) `GHSA-gmc2-2x9w-cgh9`, `CVE-2026-47683` · npm `vm2`: affected `<3.11.6`, fixed in `3.11.6` · CVSS 8.7 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [sqlparse: Quadratic O(n²) DoS in group_comments](https://agentprime.io/advisories/GHSA-f2ff-p2ww-7p4p.md) `GHSA-f2ff-p2ww-7p4p`, `CVE-2026-71491`, `PYSEC-2026-3697` · PyPI `sqlparse`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 8.7 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging](https://agentprime.io/advisories/GHSA-v828-m3pf-vq9q.md) `GHSA-v828-m3pf-vq9q`, `CVE-2026-64868`, `GO-2026-6245` · Go `github.com/QuantumNous/new-api`: affected `<1.0.0-rc.11`, fixed in `1.0.0-rc.11` · CVSS 7.5 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service](https://agentprime.io/advisories/CVE-2026-12629.md) `CVE-2026-12629` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [Resource allocation without limits in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-75050.md) `CVE-2026-75050` · CVE record: JetBrains YouTrack · CVSS 7.1 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [Infinite loop in JetBrains Ktor](https://agentprime.io/advisories/CVE-2026-68762.md) `CVE-2026-68762` · CVE record: JetBrains Ktor · CVSS 5.9 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [DeepmergeTS has stack exhaustion when merging recursive object graphs](https://agentprime.io/advisories/GHSA-ggr8-5vv4-36mx.md) `GHSA-ggr8-5vv4-36mx`, `CVE-2026-40345` · npm `deepmerge-ts`: affected `<8.0.0`, fixed in `8.0.0` · CVSS 8.2 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function](https://agentprime.io/advisories/CVE-2026-68005.md) `CVE-2026-68005` · CVE record · CVSS 7.5 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require](https://agentprime.io/advisories/CVE-2026-72888.md) `CVE-2026-72888` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Denial of service - [Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply](https://agentprime.io/advisories/CVE-2026-73060.md) `CVE-2026-73060` · CVE record: scriban scriban · CVSS 8.7 High · Not analysed yet · Published 16 Aug 2026 · Tags: Denial of service - [stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service](https://agentprime.io/advisories/CVE-2026-73057.md) `CVE-2026-73057` · CVE record: stoatchat stoatchat · CVSS 8.7 High · Not analysed yet · Published 16 Aug 2026 · Tags: Denial of service - [@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload](https://agentprime.io/advisories/CVE-2026-19474.md) `CVE-2026-19474` · CVE record: @fastify/multipart @fastify/multipart · CVSS 7.5 High · Not analysed yet · Published 15 Aug 2026 · Tags: Denial of service, CWE-459 - [@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit](https://agentprime.io/advisories/CVE-2026-18549.md) `CVE-2026-18549` · CVE record: @fastify/multipart @fastify/multipart · CVSS 7.5 High · Not analysed yet · Published 15 Aug 2026 · Tags: Denial of service, CWE-664 - [Apache Struts: Unbounded growth of localized-text caches driven by the request locale](https://agentprime.io/advisories/CVE-2026-73635.md) `CVE-2026-73635` · CVE record: Apache Software Foundation Apache Struts · CVSS 7.5 High · Not analysed yet · Published 15 Aug 2026 · Tags: Denial of service - [Apache Struts: Unbounded read of a Content Security Policy violation report](https://agentprime.io/advisories/CVE-2026-73634.md) `CVE-2026-73634` · CVE record: Apache Software Foundation Apache Struts · CVSS 7.5 High · Not analysed yet · Published 15 Aug 2026 · Tags: Denial of service - [wifi: rt2x00: avoid full teardown before work setup in probe](https://agentprime.io/advisories/CVE-2026-72005.md) `CVE-2026-72005` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 15 Aug 2026 · Tags: Denial of service - [s2n-quic has excessive memory allocation](https://agentprime.io/advisories/GHSA-9q54-f358-3fqf.md) `GHSA-9q54-f358-3fqf`, `CVE-2026-10740` · crates.io `s2n-quic`: affected `<1.82.0`, fixed in `1.82.0` · CVSS 6.9 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Denial of service - [Grav: Unauthenticated denial of service via unbounded image derivative dimensions](https://agentprime.io/advisories/GHSA-4x9g-vw65-vvf9.md) `GHSA-4x9g-vw65-vvf9`, `CVE-2026-53653`, `PKSA-pv12-m6cp-m9cd` · Packagist `getgrav/grav`: affected `<1.7.53 || >=2.0.0-beta.1, <2.0.0-rc.8`, fixed in `1.7.53`, `2.0.0-rc.8` · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Denial of service - [IBM Db2 Mirror for i is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-17177.md) `CVE-2026-17177` · CVE record: IBM Db2 Mirror for i · CVSS 7.5 High · Not analysed yet · Published 14 Aug 2026 · Tags: Denial of service - [Excessive memory allocation during VP8L decoding in golang.org/x/image](https://agentprime.io/advisories/GO-2026-6222.md) `GO-2026-6222`, `CVE-2026-46603` · Go `golang.org/x/image`: affected `<0.45.0`, fixed in `0.45.0` · CVSS 7.5 High · Not analysed yet · Published 14 Aug 2026 · Tags: Denial of service - [TRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources](https://agentprime.io/advisories/CVE-2026-19830.md) `CVE-2026-19830` · CVE record: TRENDnet TEW-816DRM · CVSS 6.9 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Denial of service - [Apache Struts: Unbounded read of a JSON request body](https://agentprime.io/advisories/CVE-2026-73633.md) `CVE-2026-73633` · CVE record: Apache Software Foundation Apache Struts · CVSS 7.5 High · Not analysed yet · Published 14 Aug 2026 · Tags: Denial of service - [FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload](https://agentprime.io/advisories/CVE-2026-72838.md) `CVE-2026-72838` · CVE record: filebrowser filebrowser · CVSS 7.1 High · Not analysed yet · Published 14 Aug 2026 · Tags: Denial of service - [Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser](https://agentprime.io/advisories/CVE-2026-19617.md) `CVE-2026-19617` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Denial of service - [Avoid quadratic complexity in resolvePath in net/url](https://agentprime.io/advisories/GO-2026-6218.md) `GO-2026-6218`, `BIT-golang-2026-56860`, `CVE-2026-56860` · Go `stdlib`: affected `<1.25.13 || >=1.26.0-0, <1.26.6 || >=1.27.0-0, <1.27.0-rc.3`, fixed in `1.25.13`, `1.26.6`, `1.27.0-rc.3` · CVSS 5.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Limit handshake messages we are willing to accept post-handshake in crypto/tls](https://agentprime.io/advisories/GO-2026-6090.md) `GO-2026-6090`, `BIT-golang-2026-56862`, `CVE-2026-56862` · Go `stdlib`: affected `<1.25.13 || >=1.26.0-0, <1.26.6 || >=1.27.0-0, <1.27.0-rc.3`, fixed in `1.25.13`, `1.26.6`, `1.27.0-rc.3` · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http](https://agentprime.io/advisories/GO-2026-6089.md) `GO-2026-6089`, `BIT-golang-2026-56853`, `CVE-2026-56853` · Go `stdlib`: affected `<1.25.13 || >=1.26.0-0, <1.26.6 || >=1.27.0-0, <1.27.0-rc.3`, fixed in `1.25.13`, `1.26.6`, `1.27.0-rc.3` · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Add recursion depth guard during decode in encoding/xml](https://agentprime.io/advisories/GO-2026-6088.md) `GO-2026-6088`, `BIT-golang-2026-56859`, `CVE-2026-56859` · Go `stdlib`: affected `<1.25.13 || >=1.26.0-0, <1.26.6 || >=1.27.0-0, <1.27.0-rc.3`, fixed in `1.25.13`, `1.26.6`, `1.27.0-rc.3` · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Enforce maximum recursion depth in encoding/asn1](https://agentprime.io/advisories/GO-2026-5972.md) `GO-2026-5972`, `BIT-golang-2026-33818`, `CVE-2026-33818` · Go `stdlib`: affected `<1.25.13 || >=1.26.0-0, <1.26.6 || >=1.27.0-0, <1.27.0-rc.3`, fixed in `1.25.13`, `1.26.6`, `1.27.0-rc.3` · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [IBM i is Affected By A Denial of Service Vulnerability in DRDA / DDM \[\]](https://agentprime.io/advisories/CVE-2026-17078.md) `CVE-2026-17078` · CVE record: IBM i · CVSS 5.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM](https://agentprime.io/advisories/CVE-2026-17076.md) `CVE-2026-17076` · CVE record: IBM i · CVSS 5.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Calix GigaSpire traceroute.cmd denial of service](https://agentprime.io/advisories/CVE-2026-19746.md) `CVE-2026-19746` · CVE record: Calix GigaSpire · CVSS 5.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72636.md) `CVE-2026-72636` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72639.md) `CVE-2026-72639` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Uncontrolled Recursion in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72638.md) `CVE-2026-72638` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Uncontrolled Recursion in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72647.md) `CVE-2026-72647` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72645.md) `CVE-2026-72645` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72656.md) `CVE-2026-72656` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72653.md) `CVE-2026-72653` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72651.md) `CVE-2026-72651` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72663.md) `CVE-2026-72663` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72659.md) `CVE-2026-72659` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .