# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header](https://agentprime.io/advisories/CVE-2026-53585.md) `CVE-2026-53585` · CVE record: libgit2 libgit2 · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers](https://agentprime.io/advisories/GHSA-22w5-2fxg-vrwx.md) `GHSA-22w5-2fxg-vrwx`, `GO-2026-6262` · Go `github.com/opentofu/opentofu`: affected `<1.11.9 || >=1.12.0-beta1, <1.12.2`, fixed in `1.11.9`, `1.12.2` · CVSS 2.6 Low · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS](https://agentprime.io/advisories/GHSA-6wvw-vrw4-363w.md) `GHSA-6wvw-vrw4-363w`, `CVE-2026-54156` · npm `node-opcua`: affected `<2.166.0`, fixed in `2.166.0` · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service](https://agentprime.io/advisories/GHSA-jgvr-6x5w-hx5w.md) `GHSA-jgvr-6x5w-hx5w` · crates.io `kcl-lib` and 1 more: affected `<0.3.129`, fixed in `0.3.129` · CVSS 4.0, no score published · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations](https://agentprime.io/advisories/GHSA-65r4-943x-97jj.md) `GHSA-65r4-943x-97jj`, `CVE-2026-75140` · Maven `org.jsoup:jsoup`: affected `<1.23.2`, fixed in `1.23.2` · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames](https://agentprime.io/advisories/CVE-2026-63495.md) `CVE-2026-63495` · CVE record: libevent libevent · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address\_ reachable via AF_UNIX accept](https://agentprime.io/advisories/CVE-2026-63388.md) `CVE-2026-63388` · CVE record: libevent libevent · CVSS 8.4 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service, Memory corruption - [vouch-proxy has an Unbounded Multipart Cookie Allocation DoS](https://agentprime.io/advisories/GHSA-qqff-5854-px68.md) `GHSA-qqff-5854-px68`, `CVE-2026-55149`, `GO-2026-6260` · Go `github.com/vouch/vouch-proxy`: affected `<0.48.0`, fixed in `0.48.0` · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Apache InLong: Ordinary users can create new packages](https://agentprime.io/advisories/CVE-2026-63016.md) `CVE-2026-63016` · CVE record: Apache Software Foundation Apache InLong · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Apache InLong: Non-template responsible persons can view template information](https://agentprime.io/advisories/CVE-2026-63015.md) `CVE-2026-63015` · CVE record: Apache Software Foundation Apache InLong · CVSS 4.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Guest controlled-size host heap allocation through WASIp3 streams](https://agentprime.io/advisories/GHSA-x84v-gj2h-g759.md) `GHSA-x84v-gj2h-g759`, `CVE-2026-115391`, `RUSTSEC-2026-0268` · crates.io `wasmtime`: affected `>=46.0.0, <46.0.3 || >=47.0.0, <47.0.4`, fixed in `46.0.3`, `47.0.4` · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [n8n before 1.123.69 ReDoS via Filter and Switch Node](https://agentprime.io/advisories/CVE-2026-77082.md) `CVE-2026-77082` · CVE record: n8n-io n8n · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Ipa: freeipa: unauthenticated dos in \`/ipa/i18n_messages\` via unbounded request body read](https://agentprime.io/advisories/CVE-2026-73198.md) `CVE-2026-73198` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Ipa: freeipa: authenticated dos in \`otptoken-add\` via unbounded otp key decoding/re-encoding](https://agentprime.io/advisories/CVE-2026-73196.md) `CVE-2026-73196` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Ipa: freeipa: unauthenticated dos in \`/ipa/migration/migration.py\` via unbounded request body read](https://agentprime.io/advisories/CVE-2026-73197.md) `CVE-2026-73197` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Reachable Assertion in Wireshark](https://agentprime.io/advisories/CVE-2026-76926.md) `CVE-2026-76926` · CVE record: Wireshark Foundation Wireshark · CVSS 3.1 Low · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Regular Expression Denial of Service (DoS) through the REST API in Splunk Connect for Kafka](https://agentprime.io/advisories/CVE-2026-76401.md) `CVE-2026-76401` · CVE record: Splunk Splunk Connect for Kafka · CVSS 5.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Denial of Service (DoS) through the REST API in Splunk Connect for Kafka](https://agentprime.io/advisories/CVE-2026-76400.md) `CVE-2026-76400` · CVE record: Splunk Splunk Connect for Kafka · CVSS 5.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Reliable Scalable Cluster Technology Denial-of-Service](https://agentprime.io/advisories/CVE-2026-14514.md) `CVE-2026-14514` · CVE record: IBM Reliable Scalable Cluster Technology (RSCT) · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [coturn: Chained mobility resumes allow authenticated remote memory exhaustion](https://agentprime.io/advisories/CVE-2026-68555.md) `CVE-2026-68555` · CVE record: coturn coturn · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [BuildKit has a possible runtime DoS via unbounded group parsing](https://agentprime.io/advisories/GHSA-72x6-4j93-7w86.md) `GHSA-72x6-4j93-7w86`, `CVE-2026-61712`, `GO-2026-6256` · Go `github.com/moby/buildkit`: affected `<0.31.1`, fixed in `0.31.1` · CVSS 2.3 Low · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16897.md) `CVE-2026-16897` · CVE record: IBM AIX and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)](https://agentprime.io/advisories/CVE-2026-62317.md) `CVE-2026-62317` · CVE record: logto-io logto · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16837.md) `CVE-2026-16837` · CVE record: IBM AIX and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16836.md) `CVE-2026-16836` · CVE record: IBM AIX and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16831.md) `CVE-2026-16831` · CVE record: IBM AIX and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [RDK WebUI uncontrolled resource consumption](https://agentprime.io/advisories/CVE-2026-19507.md) `CVE-2026-19507` · CVE record: RDK RDK-B WebUI · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16824.md) `CVE-2026-16824` · CVE record: IBM AIX and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)](https://agentprime.io/advisories/GHSA-p77j-g7h5-r2vw.md) `GHSA-p77j-g7h5-r2vw` · PyPI `geolens`: affected `<1.2.4`, fixed in `1.2.4` · No CVSS score · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Information disclosure, Broken access control, Denial of service - [MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter](https://agentprime.io/advisories/GHSA-7m52-jw36-44r3.md) `GHSA-7m52-jw36-44r3`, `CVE-2026-53965`, `PKSA-p9gd-j6gr-6f9t` · Packagist `mcp/sdk`: affected `>=0.5.0, <0.7.1`, fixed in `0.7.1` · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS](https://agentprime.io/advisories/GHSA-vjhx-2cqw-3q6q.md) `GHSA-vjhx-2cqw-3q6q`, `CVE-2026-53941`, `GO-2026-6254` · Go `github.com/inspektor-gadget/inspektor-gadget`: affected `>=0.27.0, <0.53.1`, fixed in `0.53.1` · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [FreeRDP: Denial of service through ADPCM frame size calculation](https://agentprime.io/advisories/CVE-2026-63117.md) `CVE-2026-63117` · CVE record: FreeRDP FreeRDP · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-19653.md) `CVE-2026-19653` · CVE record: IBM AIX and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain](https://agentprime.io/advisories/GHSA-j4j7-7xpr-c7cr.md) `GHSA-j4j7-7xpr-c7cr`, `CVE-2026-73541`, `EEF-CVE-2026-73541` · Hex `mpp`: affected `>=0.2.0, <0.12.0`, fixed in `0.12.0` · CVSS 8.3 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20177.md) `CVE-2026-20177` · CVE record: Cisco Cisco Industrial Ethernet Switches · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation](https://agentprime.io/advisories/CVE-2026-44253.md) `CVE-2026-44253` · CVE record: wazuh wazuh · CVSS 4.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16818.md) `CVE-2026-16818` · CVE record: IBM AIX and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16690.md) `CVE-2026-16690` · CVE record: IBM AIX and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3](https://agentprime.io/advisories/CVE-2026-75956.md) `CVE-2026-75956` · CVE record: cmsjunkie.com J-BusinessDirectory extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html](https://agentprime.io/advisories/CVE-2026-76235.md) `CVE-2026-76235` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [Uncontrolled recursion in Eclipse Foundation Eclipse OpenJ9](https://agentprime.io/advisories/CVE-2026-16440.md) `CVE-2026-16440` · CVE record: Eclipse Foundation Eclipse OpenJ9 · CVSS 5.7 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service - [BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference](https://agentprime.io/advisories/CVE-2026-76014.md) `CVE-2026-76014` · CVE record: BusyBox · CVSS 4.8 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service, Memory corruption - [libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)](https://agentprime.io/advisories/CVE-2026-62377.md) `CVE-2026-62377` · CVE record: strukturag libheif · CVSS 4.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service, Memory corruption - [libheif: Integer underflow in Fraction constructor via double clap transform application](https://agentprime.io/advisories/CVE-2026-62289.md) `CVE-2026-62289` · CVE record: strukturag libheif · CVSS 4.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption, Denial of service - [libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)](https://agentprime.io/advisories/CVE-2026-50142.md) `CVE-2026-50142` · CVE record: strukturag libheif · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption, Denial of service - [Uncontrolled resource consumption in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-73882.md) `CVE-2026-73882` · CVE record: Oracle Corporation Helidon · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [Resource allocation without limits in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-71139.md) `CVE-2026-71139` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 4.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-71128.md) `CVE-2026-71128` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 6.0 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [Improper resource shutdown in Oracle Corporation MySQL Connectors](https://agentprime.io/advisories/CVE-2026-71073.md) `CVE-2026-71073` · CVE record: Oracle Corporation MySQL Connectors · CVSS 5.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Oracle Corporation Oracle Workflow](https://agentprime.io/advisories/CVE-2026-70927.md) `CVE-2026-70927` · CVE record: Oracle Corporation Oracle Workflow · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-70908.md) `CVE-2026-70908` · CVE record: Oracle Corporation Helidon · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Oracle Corporation Oracle Java SE](https://agentprime.io/advisories/CVE-2026-70906.md) `CVE-2026-70906` · CVE record: Oracle Corporation Oracle Java SE · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion](https://agentprime.io/advisories/GHSA-43hj-fxwj-49qw.md) `GHSA-43hj-fxwj-49qw`, `CVE-2026-53423`, `EEF-CVE-2026-53423` · Hex `membrane_mp4_plugin`: affected `<0.36.7`, fixed in `0.36.7` · CVSS 5.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [Memory-amplification denial of service via declared-length preallocation in Amazon ion-java](https://agentprime.io/advisories/CVE-2026-75935.md) `CVE-2026-75935` · CVE record: Amazon Ion Amazon Ion Java · CVSS 8.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [Resource allocation without limits in NVIDIA Triton Inference Server](https://agentprime.io/advisories/CVE-2026-47628.md) `CVE-2026-47628` · CVE record: NVIDIA Triton Inference Server · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction](https://agentprime.io/advisories/GHSA-x768-8642-mmq9.md) `GHSA-x768-8642-mmq9`, `CVE-2026-68924`, `PYSEC-2026-3691` · PyPI `mobsf`: affected `<4.5.1`, fixed in `4.5.1` · CVSS 4.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context](https://agentprime.io/advisories/CVE-2026-74039.md) `CVE-2026-74039` · CVE record: Wazuh wazuh-manager · CVSS 7.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation](https://agentprime.io/advisories/GHSA-68mj-5wr7-6fgg.md) `GHSA-68mj-5wr7-6fgg`, `CVE-2026-69219` · Maven `com.rabbitmq:amqp-client`: affected `<5.33.1`, fixed in `5.33.1` · CVSS 8.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS](https://agentprime.io/advisories/GHSA-93j5-89vc-pph4.md) `GHSA-93j5-89vc-pph4`, `CVE-2026-69220` · Maven `com.rabbitmq:amqp-client`: affected `<5.33.1`, fixed in `5.33.1` · CVSS 8.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service - [SureForms contains an uncontrolled resource consumption vulnerability](https://agentprime.io/advisories/CVE-2026-19500.md) `CVE-2026-19500` · CVE record: SureForms SureForms · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .