# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Jwcrypto: jwcrypto: denial of service via malformed jwe tokens](https://agentprime.io/advisories/CVE-2026-80179.md)
  `CVE-2026-80179` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature](https://agentprime.io/advisories/CVE-2026-53580.md)
  `CVE-2026-53580` · CVE record: TriliumNext Trilium · CVSS 8.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal, Denial of service, Information disclosure
- [Duplicate Advisory: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input](https://agentprime.io/advisories/GHSA-pf76-q698-37v8.md)
  `GHSA-pf76-q698-37v8` · PyPI `nltk`: affected `<=3.10.2`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Duplicate Advisory: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks](https://agentprime.io/advisories/GHSA-3m7f-6hxv-6796.md)
  `GHSA-3m7f-6hxv-6796` · PyPI `nltk`: affected `<=3.10.2`, no fixed version yet · CVSS 3.7 Low · Withdrawn · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Duplicate Advisory: Quadratic CPU Exhaustion in \`XMLCorpusView.\_read_xml_fragment()\`](https://agentprime.io/advisories/GHSA-hqv3-xm29-p9hq.md)
  `GHSA-hqv3-xm29-p9hq` · PyPI `nltk`: affected `<=3.10.2`, no fixed version yet · CVSS 3.7 Low · Withdrawn · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Duplicate Advisory: Quadratic-time DoS in PorterStemmer via long runs of 'y'](https://agentprime.io/advisories/GHSA-8x48-8g7j-rqxp.md)
  `GHSA-8x48-8g7j-rqxp` · PyPI `nltk`: affected `<=3.10.2`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [In Spring AMQP the link credit never replenished on listener exception path](https://agentprime.io/advisories/CVE-2026-59320.md)
  `CVE-2026-59320` · CVE record: Spring Spring AMQP · CVSS 6.5 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Spring Cloud Config Monitor Denial of Service](https://agentprime.io/advisories/CVE-2026-59315.md)
  `CVE-2026-59315` · CVE record: Spring Spring Cloud Config · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Dynamic destination cache size is not properly bound in Spring Cloud Stream](https://agentprime.io/advisories/CVE-2026-59303.md)
  `CVE-2026-59303` · CVE record: Spring Spring Cloud Stream · CVSS 3.1 Low · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Spring for GraphQL Denial of Service via pagination support](https://agentprime.io/advisories/CVE-2026-59289.md)
  `CVE-2026-59289` · CVE record: Spring Spring for GraphQL · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Spring for GraphQL WebSocket Client Denial of Service](https://agentprime.io/advisories/CVE-2026-59287.md)
  `CVE-2026-59287` · CVE record: Spring Spring for GraphQL · CVSS 5.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Spring Framework Denial of Service via Unbounded List Growth in Data Binding](https://agentprime.io/advisories/CVE-2026-59282.md)
  `CVE-2026-59282` · CVE record: Spring Spring Framework · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft ma...](https://agentprime.io/advisories/GHSA-7894-5gw8-69hr.md)
  `GHSA-7894-5gw8-69hr`, `CVE-2026-81721`, `PYSEC-2026-3803` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attacker...](https://agentprime.io/advisories/GHSA-783h-8q2f-f762.md)
  `GHSA-783h-8q2f-f762`, `CVE-2026-81720`, `PYSEC-2026-3965` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authenti...](https://agentprime.io/advisories/GHSA-phmr-p567-q5g6.md)
  `GHSA-phmr-p567-q5g6`, `CVE-2026-81699`, `PYSEC-2026-3961` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger...](https://agentprime.io/advisories/GHSA-r23m-gf2m-8www.md)
  `GHSA-r23m-gf2m-8www`, `CVE-2026-81693`, `PYSEC-2026-3798` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Undertow-core: undertow: denial of service via websocket permessage-deflate processing](https://agentprime.io/advisories/CVE-2026-5680.md)
  `CVE-2026-5680` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO](https://agentprime.io/advisories/CVE-2026-81692.md)
  `CVE-2026-81692` · CVE record: jahlives openssl_encrypt · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [openssl_encrypt before 1.4.9 Denial of Service via KDF](https://agentprime.io/advisories/CVE-2026-81687.md)
  `CVE-2026-81687` · CVE record: jahlives openssl_encrypt · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Resource allocation without limits in Ruby resolv](https://agentprime.io/advisories/CVE-2026-80212.md)
  `CVE-2026-80212` · CVE record: Ruby resolv · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Apache APISIX: Unauthenticated CPU-exhaustion DoS](https://agentprime.io/advisories/CVE-2026-75005.md)
  `CVE-2026-75005` · CVE record: Apache Software Foundation Apache APISIX · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder](https://agentprime.io/advisories/CVE-2026-47891.md)
  `CVE-2026-47891` · CVE record: Spring Spring Framework · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler](https://agentprime.io/advisories/CVE-2026-47888.md)
  `CVE-2026-47888` · CVE record: Spring Spring Framework · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions](https://agentprime.io/advisories/CVE-2026-47886.md)
  `CVE-2026-47886` · CVE record: Spring Spring Framework · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Spring Framework maxPartSize Ignored in PartEventHttpMessageReader](https://agentprime.io/advisories/CVE-2026-47885.md)
  `CVE-2026-47885` · CVE record: Spring Spring Framework · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File](https://agentprime.io/advisories/CVE-2026-47881.md)
  `CVE-2026-47881` · CVE record: Spring Spring Batch · CVSS 5.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted inpu…](https://agentprime.io/advisories/CVE-2026-38345.md)
  `CVE-2026-38345` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.](https://agentprime.io/advisories/CVE-2026-30073.md)
  `CVE-2026-30073` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.](https://agentprime.io/advisories/CVE-2026-30071.md)
  `CVE-2026-30071` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.](https://agentprime.io/advisories/CVE-2026-30070.md)
  `CVE-2026-30070` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.](https://agentprime.io/advisories/CVE-2026-30067.md)
  `CVE-2026-30067` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query.](https://agentprime.io/advisories/CVE-2026-30063.md)
  `CVE-2026-30063` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.](https://agentprime.io/advisories/CVE-2026-30062.md)
  `CVE-2026-30062` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration.](https://agentprime.io/advisories/CVE-2026-30060.md)
  `CVE-2026-30060` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Request message.](https://agentprime.io/advisories/CVE-2026-30059.md)
  `CVE-2026-30059` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.](https://agentprime.io/advisories/CVE-2026-30057.md)
  `CVE-2026-30057` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PUT request.](https://agentprime.io/advisories/CVE-2026-30051.md)
  `CVE-2026-30051` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.](https://agentprime.io/advisories/CVE-2026-30050.md)
  `CVE-2026-30050` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.](https://agentprime.io/advisories/CVE-2026-30047.md)
  `CVE-2026-30047` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.](https://agentprime.io/advisories/CVE-2026-30046.md)
  `CVE-2026-30046` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Reactor Netty HTTP Server Denial of Service With Pipelined Requests](https://agentprime.io/advisories/CVE-2026-47874.md)
  `CVE-2026-47874` · CVE record: Spring Reactor Netty · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush](https://agentprime.io/advisories/CVE-2026-47863.md)
  `CVE-2026-47863` · CVE record: Spring Reactor Core · CVSS 5.9 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS](https://agentprime.io/advisories/CVE-2026-47859.md)
  `CVE-2026-47859` · CVE record: Spring Spring Integration · CVSS 5.4 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader](https://agentprime.io/advisories/CVE-2026-47851.md)
  `CVE-2026-47851` · CVE record: Spring Spring AI · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion](https://agentprime.io/advisories/CVE-2026-61617.md)
  `CVE-2026-61617` · CVE record: pterodactyl wings · CVSS 7.7 High · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [Weblate Has Uncontrolled Resource Consumption via](https://agentprime.io/advisories/CVE-2026-62326.md)
  `CVE-2026-62326` · CVE record: WeblateOrg weblate · CVSS 6.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [Resource allocation without limits in Oracle Corporation Oracle Java SE](https://agentprime.io/advisories/CVE-2026-71054.md)
  `CVE-2026-71054` · CVE record: Oracle Corporation Oracle Java SE · CVSS 6.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [Duplicate Advisory: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions](https://agentprime.io/advisories/GHSA-2rrw-hpqm-36pv.md)
  `GHSA-2rrw-hpqm-36pv` · PyPI `nltk`: affected `<=3.9.4`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab](https://agentprime.io/advisories/CVE-2025-10903.md)
  `CVE-2025-10903` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2026-77801.md)
  `CVE-2026-77801` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec](https://agentprime.io/advisories/CVE-2026-73108.md)
  `CVE-2026-73108` · CVE record: rustdesk rustdesk · CVSS 8.7 High · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [Remote UDP DoS by sending multiple DNS Cookie options](https://agentprime.io/advisories/CVE-2026-19401.md)
  `CVE-2026-19401` · CVE record: NLnet Labs NSD · CVSS 8.2 High · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader.](https://agentprime.io/advisories/CVE-2026-75466.md)
  `CVE-2026-75466` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component](https://agentprime.io/advisories/CVE-2026-51106.md)
  `CVE-2026-51106` · CVE record · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service, Insecure deserialization
- [stomper 5e2741e is vulnerable to Denial of Service.](https://agentprime.io/advisories/CVE-2026-26445.md)
  `CVE-2026-26445` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service
- [An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the…](https://agentprime.io/advisories/CVE-2025-61480.md)
  `CVE-2025-61480` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass, Race condition, Denial of service, CWE-354
- [An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via Spoofed SYN packets.](https://agentprime.io/advisories/CVE-2025-61478.md)
  `CVE-2025-61478` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service, CWE-830
- [Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset](https://agentprime.io/advisories/CVE-2026-68763.md)
  `CVE-2026-68763` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service
- [Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server](https://agentprime.io/advisories/CVE-2026-77357.md)
  `CVE-2026-77357` · CVE record: mesop-dev mesop · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service
- [Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix](https://agentprime.io/advisories/CVE-2026-77680.md)
  `CVE-2026-77680` · CVE record: Red Hat Red Hat Enterprise Linux 10 · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTA4LTI1VDIwOjM2OjQ1LjgwODAwMFoiLCJDVkUtMjAyNi03NzY4MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTA4LTI3VDIyOjE3OjA5LjQ2NzAwMFoiLCJDVkUtMjAyNi0xNzYxMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTA4LTI3VDIyOjE3OjA5LjQ2NzAwMFoiLCJDVkUtMjAyNi0xNzYxMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.