# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login](https://agentprime.io/advisories/GHSA-p43p-whwx-q52h.md) `GHSA-p43p-whwx-q52h`, `BIT-jupyterhub-2026-54338`, `CVE-2026-54338`, `PYSEC-2026-3853` · PyPI `jupyterhub`: affected `<5.5.0`, fixed in `5.5.0` · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [icalendar has Algorithmic Complexity in Equality](https://agentprime.io/advisories/GHSA-cv84-9p8j-fj68.md) `GHSA-cv84-9p8j-fj68`, `CVE-2026-55099`, `PYSEC-2026-3851` · PyPI `icalendar`: affected `>=7.1.0, <7.1.3`, fixed in `7.1.3` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [Duplicate Advisory: Nokogiri XSLT transform has a memory leak](https://agentprime.io/advisories/GHSA-rh9x-7xjc-vwx2.md) `GHSA-rh9x-7xjc-vwx2` · RubyGems `nokogiri`: affected `*`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking](https://agentprime.io/advisories/GHSA-5jhf-fpp7-v2pv.md) `GHSA-5jhf-fpp7-v2pv` · RubyGems `nokogiri`: affected `*`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [eml_parser vulnerable to DoS via deeply nested parens in Received headers](https://agentprime.io/advisories/GHSA-g7gc-gmgp-wgqg.md) `GHSA-g7gc-gmgp-wgqg`, `CVE-2026-55620`, `PYSEC-2026-3832` · PyPI `eml-parser`: affected `<3.0.2`, fixed in `3.0.2` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service, CWE-1124 - [eml_parser has parser DoS via deeply nested parentheses in e-mail headers](https://agentprime.io/advisories/GHSA-m66c-fw79-6359.md) `GHSA-m66c-fw79-6359`, `CVE-2026-55619`, `PYSEC-2026-3833` · PyPI `eml-parser`: affected `<3.0.2`, fixed in `3.0.2` · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service, CWE-1124 - [CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)](https://agentprime.io/advisories/CVE-2026-71360.md) `CVE-2026-71360` · CVE record: Adobe C2PA Tool and 1 more · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits](https://agentprime.io/advisories/CVE-2026-15310.md) `CVE-2026-15310` · CVE record: Python Software Foundation CPython · CVSS 2.1 Low · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)](https://agentprime.io/advisories/GHSA-wv94-5qcp-6m36.md) `GHSA-wv94-5qcp-6m36`, `CVE-2026-55531`, `PYSEC-2026-3897` · PyPI `praisonai`: affected `<4.6.58`, fixed in `4.6.58` · CVSS 6.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [QUIC ACK-only Packet Retention Can Cause Memory Exhaustion](https://agentprime.io/advisories/CVE-2026-63075.md) `CVE-2026-63075` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [CMP Indefinite Cache Growth of ExtraCerts](https://agentprime.io/advisories/CVE-2026-63074.md) `CVE-2026-63074` · CVE record: OpenSSL OpenSSL · CVSS 5.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to ...](https://agentprime.io/advisories/GHSA-cqm8-jxg6-fqfq.md) `GHSA-cqm8-jxg6-fqfq`, `CVE-2026-78684`, `PYSEC-2026-4003` · PyPI `vllm`: affected `<0.27.0`, fixed in `0.27.0` · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [Ech0 before 5.0.1 Denial of Service via Accept-Language](https://agentprime.io/advisories/CVE-2026-79658.md) `CVE-2026-79658` · CVE record: lin-snow Ech0 · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [Uncontrolled memory usage in Innodata Labs’ Poppler JPX decoder](https://agentprime.io/advisories/CVE-2026-12600.md) `CVE-2026-12600` · CVE record: Poppler Innodata Labs · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)](https://agentprime.io/advisories/PKSA-dtqn-wjcr-pw7c.md) `PKSA-dtqn-wjcr-pw7c`, `CVE-2026-107843` · Packagist `contao/contao`: affected `>=4.1.0, <5.3.50 || >=5.4.0, <5.7.12`, fixed in `5.3.50`, `5.7.12` · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service, CWE-204 - [Duplicate Advisory: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses (CWE-776)](https://agentprime.io/advisories/GHSA-jx89-3qg8-p2mr.md) `GHSA-jx89-3qg8-p2mr` · PyPI `nltk`: affected `<=3.10.2`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)](https://agentprime.io/advisories/CVE-2026-66766.md) `CVE-2026-66766` · CVE record: SAP_SE SAP S/4HANA (Manage Supply Protection) · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts](https://agentprime.io/advisories/CVE-2026-55373.md) `CVE-2026-55373` · CVE record: AcademySoftwareFoundation openexr · CVSS 6.2 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption, Denial of service - [OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)](https://agentprime.io/advisories/CVE-2026-53532.md) `CVE-2026-53532` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths](https://agentprime.io/advisories/GHSA-fx4f-mhw4-qm7j.md) `GHSA-fx4f-mhw4-qm7j`, `RUSTSEC-2026-0181` · crates.io `vibeio-http`: affected `<0.3.2`, fixed in `0.3.2` · CVSS 4.0, no score published · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [CakePHP: Potential Authentication bypass with CookieAuthenticator](https://agentprime.io/advisories/CVE-2026-77337.md) `CVE-2026-77337` · CVE record: cakephp authentication · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass, Denial of service - [libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion](https://agentprime.io/advisories/CVE-2026-77384.md) `CVE-2026-77384` · CVE record: libp2p js-libp2p · CVSS 7.5 High · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [SVG File Parsing Stack Exhaustion Vulnerability in Autodesk 3ds Max](https://agentprime.io/advisories/CVE-2026-16781.md) `CVE-2026-16781` · CVE record: Autodesk 3ds Max · CVSS 5.5 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [django CMS: Plugin move endpoint allows cyclic reparenting (DoS)](https://agentprime.io/advisories/GHSA-8jj7-4v57-frf5.md) `GHSA-8jj7-4v57-frf5`, `CVE-2026-54623`, `PYSEC-2026-3822` · PyPI `django-cms`: affected `<5.0.8`, fixed in `5.0.8` · CVSS 7.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service](https://agentprime.io/advisories/GHSA-5x78-73v4-xg6w.md) `GHSA-5x78-73v4-xg6w`, `RUSTSEC-2026-0179` · crates.io `postgres-protocol`: affected `>=0.3.0, <0.6.12`, fixed in `0.6.12` · CVSS 4.0, no score published · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts](https://agentprime.io/advisories/CVE-2026-78551.md) `CVE-2026-78551` · CVE record: ransomlook ransomlook · CVSS 8.8 High · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass, Denial of service - [bytebot-ai bytebot Agent Execution Workflow infinite loop](https://agentprime.io/advisories/CVE-2026-78250.md) `CVE-2026-78250` · CVE record: bytebot-ai bytebot · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion](https://agentprime.io/advisories/CVE-2026-78321.md) `CVE-2026-78321` · CVE record: DJI Neo and 4 more · CVSS 6.0 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [Open5GS HSS hss-cx-path.c assertion](https://agentprime.io/advisories/CVE-2026-78186.md) `CVE-2026-78186` · CVE record: Open5GS · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers with UART access to cause a Denial of Service (DoS) via a c…](https://agentprime.io/advisories/CVE-2026-75371.md) `CVE-2026-75371` · CVE record · CVSS 7.5 High · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to cause a Denial of Service](https://agentprime.io/advisories/CVE-2026-71832.md) `CVE-2026-71832` · CVE record · CVSS 6.2 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference](https://agentprime.io/advisories/CVE-2026-78148.md) `CVE-2026-78148` · CVE record: ggml-org llama.cpp · CVSS 6.9 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Denial of service, Memory corruption - [Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML](https://agentprime.io/advisories/GHSA-892m-gcq8-2468.md) `GHSA-892m-gcq8-2468` · PyPI `justhtml`: affected `<=1.9.1`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 23 Aug 2026 · Tags: Denial of service - [Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion](https://agentprime.io/advisories/CVE-2026-12999.md) `CVE-2026-12999` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Denial of service - [Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS](https://agentprime.io/advisories/GHSA-cv2g-m8rr-888c.md) `GHSA-cv2g-m8rr-888c` · PyPI `nltk`: affected `<=3.9.3`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 22 Aug 2026 · Tags: Denial of service - [picotls has infinite recursion in the minicrypto ASN.1 decoder](https://agentprime.io/advisories/CVE-2026-45271.md) `CVE-2026-45271` · CVE record: h2o picotls · CVSS 5.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service - [kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding](https://agentprime.io/advisories/GHSA-xhj3-7xw9-vr34.md) `GHSA-xhj3-7xw9-vr34`, `CVE-2026-77354`, `GO-2026-6275` · Go `github.com/getkin/kin-openapi`: affected `>=0.124.0, <0.142.0`, fixed in `0.142.0` · CVSS 8.7 High · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service - [Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter](https://agentprime.io/advisories/GHSA-r5pq-6chh-j3xp.md) `GHSA-r5pq-6chh-j3xp`, `CVE-2026-63462` · npm `unleash-server`: affected `<7.5.2 || >=7.6.0, <7.6.5 || >=8.0.0, <8.0.2`, fixed in `7.5.2`, `7.6.5`, `8.0.2` · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service - [Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching](https://agentprime.io/advisories/CVE-2026-70656.md) `CVE-2026-70656` · CVE record: bluewave-labs Checkmate · CVSS 4.9 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service - [Checkmate: Pre-auth Denial of Service via File Upload on Registration](https://agentprime.io/advisories/CVE-2026-55241.md) `CVE-2026-55241` · CVE record: bluewave-labs Checkmate · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service - [Apache CloudStack: DoS caused by database connections leak](https://agentprime.io/advisories/CVE-2026-59654.md) `CVE-2026-59654` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 6.8 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service - [Unbounded persistent session allocation via repeated initialize requests](https://agentprime.io/advisories/CVE-2026-59279.md) `CVE-2026-59279` · CVE record: Spring Spring AI · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service - [Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability](https://agentprime.io/advisories/CVE-2026-59323.md) `CVE-2026-59323` · CVE record: Spring Micrometer Tracing · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service - [Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library](https://agentprime.io/advisories/CVE-2026-77755.md) `CVE-2026-77755` · CVE record: misp misp-stix · CVSS 8.7 High · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service - [NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking](https://agentprime.io/advisories/GHSA-qx2g-xrx7-vfh8.md) `GHSA-qx2g-xrx7-vfh8`, `CVE-2026-72818`, `PYSEC-2026-3870` · PyPI `nltk`: affected `<3.10.1`, fixed in `3.10.1` · CVSS 8.7 High · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-19446.md) `CVE-2026-19446` · CVE record: IBM AIX and 1 more · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb](https://agentprime.io/advisories/CVE-2026-54389.md) `CVE-2026-54389` · CVE record: NationalSecurityAgency ghidra · CVSS 6.7 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-18822.md) `CVE-2026-18822` · CVE record: IBM AIX and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-17170.md) `CVE-2026-17170` · CVE record: IBM AIX and 1 more · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-17163.md) `CVE-2026-17163` · CVE record: IBM AIX and 1 more · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-17121.md) `CVE-2026-17121` · CVE record: IBM AIX and 1 more · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16952.md) `CVE-2026-16952` · CVE record: IBM AIX and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement](https://agentprime.io/advisories/GHSA-r553-m4fv-5v97.md) `GHSA-r553-m4fv-5v97`, `CVE-2026-67447`, `GO-2026-6272` · Go `github.com/axllent/mailpit`: affected `>=1.30.0, <1.30.5`, fixed in `1.30.5` · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Resource allocation without limits in Apple container](https://agentprime.io/advisories/CVE-2026-64773.md) `CVE-2026-64773` · CVE record: Apple container · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit](https://agentprime.io/advisories/GHSA-xj8g-532w-jv94.md) `GHSA-xj8g-532w-jv94`, `CVE-2026-74836`, `EEF-CVE-2026-74836` · Hex `bandit`: affected `>=0.3.4, <1.12.5`, fixed in `1.12.5` · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Improper input validation in Apple swift-nio](https://agentprime.io/advisories/CVE-2026-43678.md) `CVE-2026-43678` · CVE record: Apple swift-nio · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service, CWE-20 - [netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding](https://agentprime.io/advisories/GHSA-4899-mpch-38p3.md) `GHSA-4899-mpch-38p3`, `CVE-2026-63202` · Maven `io.netty.incubator:netty-incubator-codec-bhttp`: affected `<0.0.23.Final`, fixed in `0.0.23.Final` · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields](https://agentprime.io/advisories/GHSA-hmq9-67w8-j5pw.md) `GHSA-hmq9-67w8-j5pw`, `CVE-2026-61827` · Maven `io.netty.incubator:netty-incubator-codec-bhttp`: affected `<0.0.23.Final`, fixed in `0.0.23.Final` · CVSS 4.0, no score published · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary](https://agentprime.io/advisories/GHSA-8cfx-wx3q-mh5q.md) `GHSA-8cfx-wx3q-mh5q`, `CVE-2026-63124` · Maven `io.netty.incubator:netty-incubator-codec-bhttp`: affected `<0.0.23.Final`, fixed in `0.0.23.Final` · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Wagtail: Denial of service via unbounded filter specs in the image preview](https://agentprime.io/advisories/GHSA-f2p5-j6fg-5cxf.md) `GHSA-f2p5-j6fg-5cxf`, `CVE-2026-54260`, `PYSEC-2026-613` · PyPI `wagtail`: affected `<7.0.8 || >=7.1, <7.3.3 || >=7.4, <7.4.2`, fixed in `7.0.8`, `7.3.3`, `7.4.2` · CVSS 4.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .