# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [division by zero in libpcap before 1.10.7](https://agentprime.io/advisories/CVE-2026-6244.md) `CVE-2026-6244` · CVE record: The Tcpdump Group libpcap · CVSS 5.5 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Denial of service - [abort() in libpcap before 1.10.7 on an invalid BPF opcode](https://agentprime.io/advisories/CVE-2026-31911.md) `CVE-2026-31911` · CVE record: The Tcpdump Group libpcap · CVSS 5.5 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Denial of service - [Unbounded memory growth from GRAFT messages for unsubscribed topics](https://agentprime.io/advisories/GHSA-g3g5-x568-qvqx.md) `GHSA-g3g5-x568-qvqx`, `CVE-2026-95859`, `RUSTSEC-2026-0536` · crates.io `libp2p-gossipsub`: affected `>=0.0.0-0, <0.49.5`, fixed in `0.49.5` · CVSS 8.7 High · Not analysed yet · Published 5 Sept 2026 · Tags: Denial of service - [vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m](https://agentprime.io/advisories/GHSA-48jh-3gj7-fg8v.md) `GHSA-48jh-3gj7-fg8v`, `CVE-2026-73556`, `PYSEC-2026-3933` · PyPI `vllm`: affected `<0.26.0`, fixed in `0.26.0` · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds](https://agentprime.io/advisories/GHSA-8737-qx52-hjff.md) `GHSA-8737-qx52-hjff`, `CVE-2026-71486`, `PYSEC-2026-3936` · PyPI `vllm`: affected `<0.26.0`, fixed in `0.26.0` · CVSS 4.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resources](https://agentprime.io/advisories/CVE-2026-85703.md) `CVE-2026-85703` · CVE record: ramon-victor freegpt-webui · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs](https://agentprime.io/advisories/CVE-2026-16180.md) `CVE-2026-16180` · CVE record: IBM App Connect Enterprise and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs](https://agentprime.io/advisories/CVE-2026-17440.md) `CVE-2026-17440` · CVE record: IBM App Connect Enterprise and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [IBM i is Affected By Multiple Vulnerabilities in Debug Server](https://agentprime.io/advisories/CVE-2026-18076.md) `CVE-2026-18076` · CVE record: IBM i · CVSS 4.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [Multiple vulnerabilities in IBM MQ Agent images](https://agentprime.io/advisories/CVE-2026-19645.md) `CVE-2026-19645` · CVE record: IBM MQ Agent · CVSS 6.5 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs](https://agentprime.io/advisories/CVE-2026-78543.md) `CVE-2026-78543` · CVE record: IBM App Connect Enterprise and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion](https://agentprime.io/advisories/CVE-2026-85664.md) `CVE-2026-85664` · CVE record: chroma-core chroma · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS](https://agentprime.io/advisories/GHSA-g83f-2j6r-q6m4.md) `GHSA-g83f-2j6r-q6m4`, `CVE-2026-82728`, `EEF-CVE-2026-82728` · Hex `mint`: affected `>=0.1.0, <1.10.0`, fixed in `1.10.0` · CVSS 8.2 High · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS](https://agentprime.io/advisories/GHSA-7p8w-j234-7qc8.md) `GHSA-7p8w-j234-7qc8`, `CVE-2026-82729`, `EEF-CVE-2026-82729` · Hex `mint`: affected `>=1.9.3, <1.10.0`, fixed in `1.10.0` · CVSS 6.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries](https://agentprime.io/advisories/CVE-2026-82309.md) `CVE-2026-82309` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service, CWE-405 - [SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency](https://agentprime.io/advisories/CVE-2026-85585.md) `CVE-2026-85585` · CVE record: siyuan-note siyuan · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [SiYuan before v3.8.2 Denial of Service via Auth Throttle](https://agentprime.io/advisories/CVE-2026-85584.md) `CVE-2026-85584` · CVE record: siyuan-note siyuan · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth](https://agentprime.io/advisories/CVE-2026-85582.md) `CVE-2026-85582` · CVE record: siyuan-note siyuan · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration](https://agentprime.io/advisories/CVE-2026-85581.md) `CVE-2026-85581` · CVE record: siyuan-note siyuan · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read](https://agentprime.io/advisories/CVE-2026-85534.md) `CVE-2026-85534` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [Memory leak in scan method](https://agentprime.io/advisories/CVE-2026-13148.md) `CVE-2026-13148` · CVE record: Softing smartLink HW-PN · CVSS 6.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [Eleveo Quality Management Conversation events denial of service](https://agentprime.io/advisories/CVE-2026-85407.md) `CVE-2026-85407` · CVE record: Eleveo Quality Management · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks.](https://agentprime.io/advisories/CVE-2021-44320.md) `CVE-2021-44320` · CVE record · CVSS 7.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service.](https://agentprime.io/advisories/CVE-2021-44319.md) `CVE-2021-44319` · CVE record · CVSS 7.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service - [MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion](https://agentprime.io/advisories/CVE-2026-85450.md) `CVE-2026-85450` · CVE record: themoos core-moos · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [MOOS-IvP through 24.8.1 pMarineViewer Unbounded Memory Consumption via NODE_REPORT](https://agentprime.io/advisories/CVE-2026-85449.md) `CVE-2026-85449` · CVE record: moos-ivp moos-ivp · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [MOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State Retention](https://agentprime.io/advisories/CVE-2026-85448.md) `CVE-2026-85448` · CVE record: moos-ivp moos-ivp · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [MOOS-IvP through 24.8.1 pRealm Unbounded REALMCAST_REQ Subscription Denial of Service](https://agentprime.io/advisories/CVE-2026-85447.md) `CVE-2026-85447` · CVE record: moos-ivp moos-ivp · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service](https://agentprime.io/advisories/CVE-2026-85446.md) `CVE-2026-85446` · CVE record: moos-ivp moos-ivp · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Count](https://agentprime.io/advisories/CVE-2026-85445.md) `CVE-2026-85445` · CVE record: moos-ivp moos-ivp · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [MOOS core-moos through 10.4.0 MOOSDB Accept Loop Denial of Service](https://agentprime.io/advisories/CVE-2026-85443.md) `CVE-2026-85443` · CVE record: themoos core-moos · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation](https://agentprime.io/advisories/CVE-2026-85442.md) `CVE-2026-85442` · CVE record: themoos core-moos · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [toml-node: Uncontrolled Recursion](https://agentprime.io/advisories/GHSA-82x6-q7mm-w9cf.md) `GHSA-82x6-q7mm-w9cf`, `CVE-2026-77465` · npm `toml`: affected `<4.2.0`, fixed in `4.2.0` · CVSS 7.5 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)](https://agentprime.io/advisories/GHSA-528h-pc64-c93x.md) `GHSA-528h-pc64-c93x`, `CVE-2026-71429` · npm `stream-json`: affected `<3.5.0`, fixed in `3.5.0` · CVSS 6.2 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph](https://agentprime.io/advisories/CVE-2026-85458.md) `CVE-2026-85458` · CVE record: Xpdf Xpdf · CVSS 2.1 Low · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload](https://agentprime.io/advisories/GHSA-6c5v-hqjr-5xxp.md) `GHSA-6c5v-hqjr-5xxp`, `CVE-2026-79921`, `GO-2026-6372` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 8.9 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [LiquidJS has an infinite loop vulnerability in its \`strip_html\` filter](https://agentprime.io/advisories/GHSA-m7fp-h3p4-hr49.md) `GHSA-m7fp-h3p4-hr49`, `CVE-2026-61556` · npm `liquidjs`: affected `>=10.26.0, <10.27.1`, fixed in `10.27.1` · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Attack vulnerability](https://agentprime.io/advisories/CVE-2026-84778.md) `CVE-2026-84778` · CVE record: migrateguru Migrate Guru – Site Migration \& Cloning · CVSS 7.5 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability](https://agentprime.io/advisories/CVE-2026-84776.md) `CVE-2026-84776` · CVE record: malcare MalCare Security · CVSS 7.5 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path](https://agentprime.io/advisories/CVE-2026-84971.md) `CVE-2026-84971` · CVE record: MongoDB libmongocrypt · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources](https://agentprime.io/advisories/CVE-2026-85107.md) `CVE-2026-85107` · CVE record: NousResearch hermes-agent · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk](https://agentprime.io/advisories/CVE-2026-71224.md) `CVE-2026-71224` · CVE record: Red Hat Red Hat Enterprise Linux 7 and 2 more · CVSS 4.7 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [Gfs2-utils: gfs2-utils: stack overflow via alloca(1<\=0.25.0-alpha.3`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [Recursor followed every glueless name server in a referral, with no per-query budget](https://agentprime.io/advisories/GHSA-6h5c-jjg5-wj59.md) `GHSA-6h5c-jjg5-wj59`, `CVE-2026-123606`, `RUSTSEC-2026-0515`, `RUSTSEC-2026-0521` · crates.io `hickory-resolver`: affected `>=0.26.0-beta.1, <0.26.2`, fixed in `0.26.2` · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption](https://agentprime.io/advisories/CVE-2026-85100.md) `CVE-2026-85100` · CVE record: 2FastLabs agent-squad · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Denial of service - [Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection](https://agentprime.io/advisories/GHSA-w878-pj84-3j5v.md) `GHSA-w878-pj84-3j5v`, `CVE-2026-67445`, `GO-2026-6363` · Go `github.com/axllent/mailpit`: affected `<1.30.4`, fixed in `1.30.4` · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling](https://agentprime.io/advisories/GHSA-75mr-qw9x-3r39.md) `GHSA-75mr-qw9x-3r39`, `CVE-2026-67446`, `GO-2026-6359` · Go `github.com/axllent/mailpit`: affected `<1.30.4`, fixed in `1.30.4` · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [RightNow-AI OpenFang tool_runner.rs shell_exec memory allocation](https://agentprime.io/advisories/CVE-2026-84888.md) `CVE-2026-84888` · CVE record: RightNow-AI OpenFang · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service](https://agentprime.io/advisories/CVE-2026-84887.md) `CVE-2026-84887` · CVE record: simular-ai Agent-S · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption](https://agentprime.io/advisories/CVE-2026-84886.md) `CVE-2026-84886` · CVE record: simular-ai Agent-S · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [simular-ai Agent-S CodeAgent code_agent.py denial of service](https://agentprime.io/advisories/CVE-2026-84885.md) `CVE-2026-84885` · CVE record: simular-ai Agent-S · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6](https://agentprime.io/advisories/CVE-2026-84851.md) `CVE-2026-84851` · CVE record: Amazon ion-c · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [sigoden aichat API Endpoint serve.rs memory allocation](https://agentprime.io/advisories/CVE-2026-84857.md) `CVE-2026-84857` · CVE record: sigoden aichat · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service](https://agentprime.io/advisories/CVE-2026-84856.md) `CVE-2026-84856` · CVE record: rowboatlabs rowboat · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh](https://agentprime.io/advisories/GO-2026-6355.md) `GO-2026-6355`, `CVE-2026-56855` · Go `golang.org/x/crypto`: affected `<0.56.0`, fixed in `0.56.0` · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh](https://agentprime.io/advisories/GO-2026-6354.md) `GO-2026-6354`, `CVE-2026-78662` · Go `golang.org/x/crypto`: affected `<0.56.0`, fixed in `0.56.0` · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2](https://agentprime.io/advisories/CVE-2026-49249.md) `CVE-2026-49249` · CVE record: malach-it boruta-server · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields](https://agentprime.io/advisories/CVE-2026-77121.md) `CVE-2026-77121` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [ntegrals openbrowser Browser Agent Message Construction agent.ts resource consumption](https://agentprime.io/advisories/CVE-2026-84833.md) `CVE-2026-84833` · CVE record: ntegrals openbrowser · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .