# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS](https://agentprime.io/advisories/CVE-2026-11811.md) `CVE-2026-11811` · CVE record: zephyrproject zephyr · CVSS 3.7 Low · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [Mastodon: Exhausting data by an unauthenticated request to the admin retention API](https://agentprime.io/advisories/CVE-2026-72914.md) `CVE-2026-72914` · CVE record: mastodon mastodon · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service, CWE-405 - [CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL](https://agentprime.io/advisories/CVE-2026-72912.md) `CVE-2026-72912` · CVE record: gchq CyberChef · CVSS 4.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener](https://agentprime.io/advisories/CVE-2026-18618.md) `CVE-2026-18618` · CVE record: Red Hat Red Hat OpenShift AI 2.25 and 3 more · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [Unauthenticated Resource Exhaustion](https://agentprime.io/advisories/CVE-2025-15682.md) `CVE-2025-15682` · CVE record: TBEA TBEA TLogger (TBEA Communication Box 3rd Generation) · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [IB/mad: Drop unmatched RMPP responses before reassembly](https://agentprime.io/advisories/CVE-2026-68425.md) `CVE-2026-68425` · CVE record: Linux Linux · CVSS 7.1 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()](https://agentprime.io/advisories/CVE-2026-68298.md) `CVE-2026-68298` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [drm/gpusvm: publish dpagemap early to avoid device mapping leak on error](https://agentprime.io/advisories/CVE-2026-68240.md) `CVE-2026-68240` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [media: pwc: Return queued buffers on start_streaming() failure](https://agentprime.io/advisories/CVE-2026-68216.md) `CVE-2026-68216` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [media: rtl2832_sdr: Return queued buffers on start_streaming() failure](https://agentprime.io/advisories/CVE-2026-68213.md) `CVE-2026-68213` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [sctp: close UDP tunnel sockets during netns teardown](https://agentprime.io/advisories/CVE-2026-68161.md) `CVE-2026-68161` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [gve: fix Rx queue stall on alloc failure](https://agentprime.io/advisories/CVE-2026-68129.md) `CVE-2026-68129` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [drm/amdgpu: fix division by zero with invalid uvd dimensions](https://agentprime.io/advisories/CVE-2026-68106.md) `CVE-2026-68106` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [audit: fix recursive locking deadlock in audit_dupe_exe()](https://agentprime.io/advisories/CVE-2026-68096.md) `CVE-2026-68096` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [HID: wacom: stop hardware after post-start probe failures](https://agentprime.io/advisories/CVE-2026-68091.md) `CVE-2026-68091` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [Uncontrolled Memory Allocation in GNU cpio](https://agentprime.io/advisories/CVE-2026-66485.md) `CVE-2026-66485` · CVE record: GNU cpio · CVSS 4.6 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [Keras model loading is vulnerable to denial of service through HDF5 shape bombs](https://agentprime.io/advisories/GHSA-74m6-m3xx-3vmj.md) `GHSA-74m6-m3xx-3vmj`, `CVE-2026-12570`, `PYSEC-2026-3856` · PyPI `keras`: affected `<3.15.0`, fixed in `3.15.0` · CVSS 5.5 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [Apache IoTDB: RPC service denial of service via unchecked Thrift string length](https://agentprime.io/advisories/CVE-2026-44630.md) `CVE-2026-44630` · CVE record: Apache Software Foundation Apache IoTDB · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [Almico Speedfan MSR Index speedfan.sys KiSystemCall64 memory leak](https://agentprime.io/advisories/CVE-2026-19382.md) `CVE-2026-19382` · CVE record: Almico Speedfan · CVSS 4.6 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [lmammino oidc-authorizer Authorization Header Parsing parse_token_from_header.rs parse_token_from_header denial of service](https://agentprime.io/advisories/CVE-2026-19362.md) `CVE-2026-19362` · CVE record: lmammino oidc-authorizer · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Denial of service - [WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service](https://agentprime.io/advisories/CVE-2026-18464.md) `CVE-2026-18464` · CVE record: Unknown WP MAPS PRO · CVSS 7.5 High · Not analysed yet · Published 9 Aug 2026 · Tags: Denial of service - [Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound](https://agentprime.io/advisories/GHSA-v6w3-qrh8-qccc.md) `GHSA-v6w3-qrh8-qccc`, `CVE-2026-8798` · Maven `org.bouncycastle:bc-fips`: affected `>=2.1.0, <2.1.3`, fixed in `2.1.3` · CVSS 8.7 High · Not analysed yet · Published 8 Aug 2026 · Tags: Denial of service - [Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.](https://agentprime.io/advisories/GHSA-98j2-6v39-78w8.md) `GHSA-98j2-6v39-78w8`, `CVE-2026-13505` · Maven `org.bouncycastle:bc-fips`: affected `<1.0.2.7 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.3`, fixed in `1.0.2.7`, `2.0.2`, `2.1.3` · CVSS 8.7 High · Not analysed yet · Published 8 Aug 2026 · Tags: Denial of service - [HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service](https://agentprime.io/advisories/CVE-2026-62296.md) `CVE-2026-62296` · CVE record: hapifhir org.hl7.fhir.core and 4 more · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service, CWE-20 - [HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service](https://agentprime.io/advisories/CVE-2026-62295.md) `CVE-2026-62295` · CVE record: hapifhir org.hl7.fhir.core and 4 more · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service, CWE-20 - [pypdf: Possible large memory usage for large /ToUnicode streams](https://agentprime.io/advisories/GHSA-fp3f-mc75-235c.md) `GHSA-fp3f-mc75-235c`, `CVE-2026-71870`, `PYSEC-2026-3655` · PyPI `pypdf`: affected `<6.15.0`, fixed in `6.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [Unauthenticated denial of service via unbounded request body processing](https://agentprime.io/advisories/CVE-2026-19113.md) `CVE-2026-19113` · CVE record: HashiCorp Consul and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [Unauthenticated denial of service via unbounded external gRPC connection acceptance](https://agentprime.io/advisories/CVE-2026-15972.md) `CVE-2026-15972` · CVE record: HashiCorp Consul and 1 more · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser](https://agentprime.io/advisories/CVE-2026-65819.md) `CVE-2026-65819` · CVE record: gopacket gopacket · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Memory corruption, Denial of service - [Uncontrolled resource consumption in the Consul Connect CA roots endpoint](https://agentprime.io/advisories/CVE-2026-19015.md) `CVE-2026-19015` · CVE record: HashiCorp Consul and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [Uncontrolled resource consumption in the Consul Connect authorization endpoint](https://agentprime.io/advisories/CVE-2026-19014.md) `CVE-2026-19014` · CVE record: HashiCorp Consul and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [Malicious Link Control Frames Can Cause Loss of CPDLC Functions](https://agentprime.io/advisories/CVE-2025-71410.md) `CVE-2025-71410` · CVE record: ATN-B1 CPDLC · CVSS 6.0 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [In CPDLC, Broadcast Control Frames Can Disconnect Multiple Aircraft Simultaneously](https://agentprime.io/advisories/CVE-2025-71411.md) `CVE-2025-71411` · CVE record: ATN-B1 CPDLC · CVSS 6.0 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [pypdf: Possible long runtimes/large memory usage for large CID font width ranges](https://agentprime.io/advisories/GHSA-fwg2-594c-jp42.md) `GHSA-fwg2-594c-jp42`, `CVE-2026-71852`, `PYSEC-2026-3656` · PyPI `pypdf`: affected `<6.15.0`, fixed in `6.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [Hono: Algorithmic Complexity DoS in Language Middleware](https://agentprime.io/advisories/GHSA-54fx-42gc-7vw4.md) `GHSA-54fx-42gc-7vw4`, `CVE-2026-71848` · npm `hono`: affected `>=4.12.0, <4.12.34`, fixed in `4.12.34` · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors](https://agentprime.io/advisories/GHSA-gm37-52c6-37mw.md) `GHSA-gm37-52c6-37mw`, `CVE-2026-67422`, `PYSEC-2026-3654` · PyPI `pymdown-extensions`: affected `<11.0.1`, fixed in `11.0.1` · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state](https://agentprime.io/advisories/GHSA-p9jm-q85p-7mcp.md) `GHSA-p9jm-q85p-7mcp`, `CVE-2026-56818` · Maven `io.netty:netty-codec-redis`: affected `<4.1.136.Final || >=4.2.0-Final, <4.2.16.Final`, fixed in `4.1.136.Final`, `4.2.16.Final` · CVSS 6.5 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service, CWE-703 - [SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header](https://agentprime.io/advisories/GHSA-29g2-3rmr-qm68.md) `GHSA-29g2-3rmr-qm68`, `CVE-2026-66062` · npm `@sveltejs/kit`: affected `<2.70.2`, fixed in `2.70.2` · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [Atom Exhaustion via \_entities Representation Keys in DivvyPayHQ absinthe_federation](https://agentprime.io/advisories/GHSA-55hv-mwvr-phf3.md) `GHSA-55hv-mwvr-phf3`, `CVE-2026-67585`, `EEF-CVE-2026-67585` · Hex `absinthe_federation`: affected `>=0.1.0, <0.9.3`, fixed in `0.9.3` · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [WP Maps < 4.9.7 - Subscriber+ Denial of Service](https://agentprime.io/advisories/CVE-2026-16265.md) `CVE-2026-16265` · CVE record: Unknown WP Maps · CVSS 6.5 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets.](https://agentprime.io/advisories/CVE-2025-63235.md) `CVE-2025-63235` · CVE record · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service - [node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length](https://agentprime.io/advisories/GHSA-8hcv-x26h-mcgp.md) `GHSA-8hcv-x26h-mcgp`, `CVE-2026-71430` · npm `re2`: affected `<1.25.1`, fixed in `1.25.1` · CVSS 6.2 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification](https://agentprime.io/advisories/CVE-2026-48082.md) `CVE-2026-48082` · CVE record: open-reception appointment-booking-software · CVSS 3.7 Low · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [league/commonmark: Denial of service via colliding heading slugs](https://agentprime.io/advisories/GHSA-mh25-x5hq-wrqp.md) `GHSA-mh25-x5hq-wrqp`, `CVE-2026-86434`, `PKSA-cqd6-fg4n-nxpf` · Packagist `league/commonmark`: affected `>=2.0.0, <2.9.0`, fixed in `2.9.0` · CVSS 8.7 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [league/commonmark: Denial of service via duplicate footnote definitions](https://agentprime.io/advisories/GHSA-jfm3-95jq-q3rf.md) `GHSA-jfm3-95jq-q3rf`, `PKSA-1q6p-sqkj-8mmj` · Packagist `league/commonmark`: affected `>=1.5.0, <2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [league/commonmark: Denial of service via adjacent inline attribute blocks](https://agentprime.io/advisories/GHSA-g2gp-3wwq-f4ph.md) `GHSA-g2gp-3wwq-f4ph`, `PKSA-mc58-w91n-f5gv` · Packagist `league/commonmark`: affected `>=1.5.0, <2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [league/commonmark: Quadratic-time denial of service when parsing crafted Markdown](https://agentprime.io/advisories/GHSA-2q4p-g7hv-5rgv.md) `GHSA-2q4p-g7hv-5rgv`, `CVE-2026-71488`, `PKSA-t21r-vtr5-3mdz` · Packagist `league/commonmark`: affected `>=0.6.0, <2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service, CWE-1050 - [JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported](https://agentprime.io/advisories/GHSA-5p4m-2wfm-xmqj.md) `GHSA-5p4m-2wfm-xmqj` · npm `js-yaml`: affected `>=3.0.0, <3.15.1 || >=4.0.0, <4.3.1`, fixed in `3.15.1`, `4.3.1` · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [Mermaid XY Charts are vulnerable to an infinite loop DoS](https://agentprime.io/advisories/GHSA-2v8p-3f2j-5mp7.md) `GHSA-2v8p-3f2j-5mp7`, `CVE-2026-71436` · npm `mermaid`: affected `>=10.6.0, <10.9.8 || >=11.0.0-alpha.1, <11.16.1`, fixed in `10.9.8`, `11.16.1` · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service, CWE-1325 - [XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service](https://agentprime.io/advisories/CVE-2026-3415.md) `CVE-2026-3415` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 8.7 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service](https://agentprime.io/advisories/GHSA-463q-p2fr-mh9p.md) `GHSA-463q-p2fr-mh9p`, `CVE-2026-68750`, `EEF-CVE-2026-68750` · Hex `html_sanitize_ex`: affected `>=0.3.1, <1.4.5 || >=1.5.0-rc.0, <1.5.3`, fixed in `1.4.5`, `1.5.3` · CVSS 8.2 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service](https://agentprime.io/advisories/GHSA-4cx2-987x-rr2x.md) `GHSA-4cx2-987x-rr2x`, `CVE-2026-68749`, `EEF-CVE-2026-68749` · Hex `html_sanitize_ex`: affected `>=0.3.1, <1.4.5 || >=1.5.0-rc.0, <1.5.3`, fixed in `1.4.5`, `1.5.3` · CVSS 8.2 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [Apache Portable Runtime Utility: apr-util XML stack recursion crash](https://agentprime.io/advisories/CVE-2026-32327.md) `CVE-2026-32327` · CVE record: Apache Software Foundation Apache Portable Runtime Utility · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache](https://agentprime.io/advisories/CVE-2026-66733.md) `CVE-2026-66733` · CVE record: Eukaryot sonic3air · CVSS 8.7 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [Apache CXF: Denial of service via message header attachments](https://agentprime.io/advisories/CVE-2026-64958.md) `CVE-2026-64958` · CVE record: Apache Software Foundation Apache CXF · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [Apache CXF: No default restriction on the amount of form parameters per message](https://agentprime.io/advisories/CVE-2026-57819.md) `CVE-2026-57819` · CVE record: Apache Software Foundation Apache CXF · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [Apache CXF: Denial of Service attack via large attachments](https://agentprime.io/advisories/CVE-2026-54225.md) `CVE-2026-54225` · CVE record: Apache Software Foundation Apache CXF · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders](https://agentprime.io/advisories/CVE-2026-18649.md) `CVE-2026-18649` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open](https://agentprime.io/advisories/CVE-2026-19025.md) `CVE-2026-19025` · CVE record: The HDF Group HDF5 · CVSS 6.8 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Denial of service - [Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation](https://agentprime.io/advisories/GHSA-9pgf-384g-p7mv.md) `GHSA-9pgf-384g-p7mv`, `CVE-2026-71321` · npm `nuxt`: affected `>=3.1.0, <3.21.10 || >=4.0.0, <4.5.1`, fixed in `3.21.10`, `4.5.1` · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .