# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20281.md) `CVE-2026-20281` · CVE record: Cisco Cisco Session Initiation Protocol (SIP) Software · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [SQL Data Source Plugin: OOM DoS via $\_\_timeGroup macro](https://agentprime.io/advisories/CVE-2026-19475.md) `CVE-2026-19475` · CVE record: Grafana PostgreSQL Datasource and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown](https://agentprime.io/advisories/GHSA-6m44-fpc8-c3rq.md) `GHSA-6m44-fpc8-c3rq`, `CVE-2026-76098`, `PYSEC-2026-3863` · PyPI `mistune`: affected `>=3.3.0, <3.3.3`, fixed in `3.3.3` · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Grav: Authenticated ReDoS via regex_replace in Twig Sandbox](https://agentprime.io/advisories/GHSA-37f3-6p89-6qr9.md) `GHSA-37f3-6p89-6qr9`, `CVE-2026-62237`, `CVE-2026-62672`, `PKSA-wwkm-grbv-93ck` · Packagist `getgrav/grav`: affected `<2.0.4`, fixed in `2.0.4` · CVSS 6.0 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [qs array-limit bypass via bracket-key comma parsing](https://agentprime.io/advisories/GHSA-x5fp-wj9c-mxmx.md) `GHSA-x5fp-wj9c-mxmx`, `CVE-2026-82562` · npm `qs`: affected `>=6.14.2, <6.16.0`, fixed in `6.16.0` · CVSS 6.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-78588.md) `CVE-2026-78588` · CVE record: Elastic Filebeat · CVSS 6.5 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-78586.md) `CVE-2026-78586` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop](https://agentprime.io/advisories/GHSA-mpf4-983q-p7j4.md) `GHSA-mpf4-983q-p7j4`, `CVE-2026-82397`, `PYSEC-2026-3928` · PyPI `tornado`: affected `<6.5.8`, fixed in `6.5.8` · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service, CWE-1284 - [pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace](https://agentprime.io/advisories/GHSA-fc8x-2rww-xw9m.md) `GHSA-fc8x-2rww-xw9m`, `CVE-2026-82398`, `PYSEC-2026-3912` · PyPI `pypdf`: affected `<6.15.0`, fixed in `6.15.0` · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'](https://agentprime.io/advisories/GHSA-ww6m-cw3f-q94g.md) `GHSA-ww6m-cw3f-q94g`, `CVE-2026-81722`, `PYSEC-2026-3738` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [NLTK: Quadratic CPU Exhaustion in \`XMLCorpusView.\_read_xml_fragment()\`](https://agentprime.io/advisories/GHSA-vp2x-qp44-57v7.md) `GHSA-vp2x-qp44-57v7`, `CVE-2026-81723`, `PYSEC-2026-3871` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 6.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars](https://agentprime.io/advisories/GHSA-ff5c-cp5c-9wjf.md) `GHSA-ff5c-cp5c-9wjf`, `CVE-2026-12876`, `PYSEC-2026-3869` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 4.0, no score published · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input](https://agentprime.io/advisories/GHSA-cw6x-m8jw-qmrh.md) `GHSA-cw6x-m8jw-qmrh`, `CVE-2026-81724`, `PYSEC-2026-3739` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products](https://agentprime.io/advisories/CVE-2026-14255.md) `CVE-2026-14255` · CVE record: Autodesk Shared Components and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [ImageMagick: Memory Leak when providing invalid options to the cli](https://agentprime.io/advisories/GHSA-cvhv-g4rq-3hmw.md) `GHSA-cvhv-g4rq-3hmw`, `CVE-2026-66011` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability](https://agentprime.io/advisories/CVE-2026-84780.md) `CVE-2026-84780` · CVE record: WPGMaps WP Go Maps · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [WordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability](https://agentprime.io/advisories/CVE-2026-84775.md) `CVE-2026-84775` · CVE record: Really Simple Plugins Really Simple SSL · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Server-side request forgery in Eclipse Foundation Eclipse Ditto](https://agentprime.io/advisories/CVE-2026-84175.md) `CVE-2026-84175` · CVE record: Eclipse Foundation Eclipse Ditto · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service, Server-side request forgery (SSRF) - [FIPS mode assertion failure via malicious CERT payload](https://agentprime.io/advisories/CVE-2026-14957.md) `CVE-2026-14957` · CVE record: The Libreswan Project libreswan · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service, CWE-252 - [zhayujie CowAgent Bash Tool bash.py denial of service](https://agentprime.io/advisories/CVE-2026-84427.md) `CVE-2026-84427` · CVE record: zhayujie CowAgent · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service](https://agentprime.io/advisories/CVE-2026-84425.md) `CVE-2026-84425` · CVE record: zhayujie CowAgent · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record](https://agentprime.io/advisories/CVE-2026-81928.md) `CVE-2026-81928` · CVE record · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation](https://agentprime.io/advisories/CVE-2026-84289.md) `CVE-2026-84289` · CVE record: NousResearch hermes-agent · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Allowed UNC hostnames for attachments interpreted as a regular expression](https://agentprime.io/advisories/CVE-2026-84642.md) `CVE-2026-84642` · CVE record: Mozilla Thunderbird · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation](https://agentprime.io/advisories/GHSA-vp52-pcj8-j9qc.md) `GHSA-vp52-pcj8-j9qc`, `CVE-2026-84304`, `GO-2026-6348` · Go `google.golang.org/grpc`: affected `<1.83.1`, fixed in `1.83.1` · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [pypdf: Possible long runtimes/large memory usage when retrieving outlines](https://agentprime.io/advisories/GHSA-23w6-3w8w-8484.md) `GHSA-23w6-3w8w-8484`, `CVE-2026-84310`, `PYSEC-2026-3910` · PyPI `pypdf`: affected `<6.16.1`, fixed in `6.16.1` · CVSS 4.8 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service, CWE-405 - [pypdf: Possible long runtimes/large memory usage when extracting XForm objects](https://agentprime.io/advisories/GHSA-763m-79hh-57f2.md) `GHSA-763m-79hh-57f2`, `CVE-2026-84311`, `PYSEC-2026-3911` · PyPI `pypdf`: affected `<6.16.1`, fixed in `6.16.1` · CVSS 4.8 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [pypdf: Possible infinite loop for TreeObject.insert_child](https://agentprime.io/advisories/GHSA-jp53-mhqp-8xcg.md) `GHSA-jp53-mhqp-8xcg`, `CVE-2026-84309`, `PYSEC-2026-3913` · PyPI `pypdf`: affected `<6.16.0`, fixed in `6.16.0` · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption](https://agentprime.io/advisories/GHSA-cfqr-cjx5-5jcm.md) `GHSA-cfqr-cjx5-5jcm`, `CVE-2026-84305`, `PYSEC-2026-3923` · PyPI `sqlparse`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 5.1 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service](https://agentprime.io/advisories/CVE-2026-84288.md) `CVE-2026-84288` · CVE record: NousResearch hermes-agent · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [NousResearch hermes-agent Session Chat api_server.py denial of service](https://agentprime.io/advisories/CVE-2026-84287.md) `CVE-2026-84287` · CVE record: NousResearch hermes-agent · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Unauthenticated Denial-of-Service (DoS) Vulnerability in AOS-CX](https://agentprime.io/advisories/CVE-2026-73773.md) `CVE-2026-73773` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension](https://agentprime.io/advisories/GHSA-8rr7-cvq3-gmfh.md) `GHSA-8rr7-cvq3-gmfh`, `CVE-2026-86428`, `PKSA-zyf5-hrxv-hrd7` · Packagist `league/commonmark`: affected `>=1.5.0, <2.10.0`, fixed in `2.10.0` · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service, CWE-1050 - [Unauthenticated Denial-of-Service Vulnerabilities in AOS-CX](https://agentprime.io/advisories/CVE-2026-73759.md) `CVE-2026-73759` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Authenticated Denial-of-Service Vulnerabilities in the Command Line Interface of AOS-CX](https://agentprime.io/advisories/CVE-2026-73754.md) `CVE-2026-73754` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [league/commonmark: Denial of service in the SmartPunct and Attributes extensions](https://agentprime.io/advisories/GHSA-jjv6-8j6v-6j52.md) `GHSA-jjv6-8j6v-6j52`, `CVE-2026-86429`, `PKSA-nv44-1b4d-6gjg` · Packagist `league/commonmark`: affected `>=1.5.0, <2.9.1`, fixed in `2.9.1` · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service, CWE-1050 - [league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters](https://agentprime.io/advisories/GHSA-j8pm-gj4c-rq4x.md) `GHSA-j8pm-gj4c-rq4x`, `CVE-2026-86430`, `PKSA-9q1p-3s19-bp1q` · Packagist `league/commonmark`: affected `>=0.6.0, <2.9.1`, fixed in `2.9.1` · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service, CWE-1050 - [tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)](https://agentprime.io/advisories/GHSA-8423-8fgw-73vq.md) `GHSA-8423-8fgw-73vq`, `CVE-2026-91990` · PyPI `tornado`: affected `<6.5.8`, fixed in `6.5.8` · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer API](https://agentprime.io/advisories/CVE-2026-73746.md) `CVE-2026-73746` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 3.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-73744.md) `CVE-2026-73744` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 3.5 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Authenticated Denial of Service Vulnerabilities in HPE Networking Fabric Composer API](https://agentprime.io/advisories/CVE-2026-73728.md) `CVE-2026-73728` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Unauthenticated Denial-of-Service (DoS) Vulnerability in the API of HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73715.md) `CVE-2026-73715` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Django REST framework: Potential bypass of Django \`DATA_UPLOAD_MAX_MEMORY_SIZE\` when parsing oversized JSON and urlencoded request bodies via DRF \`request.data\`](https://agentprime.io/advisories/GHSA-2m8g-3cmr-wg3w.md) `GHSA-2m8g-3cmr-wg3w`, `CVE-2026-73228`, `PYSEC-2026-3827` · PyPI `djangorestframework`: affected `<3.17.2`, fixed in `3.17.2` · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72682.md) `CVE-2026-72682` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72652.md) `CVE-2026-72652` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-56143.md) `CVE-2026-56143` · CVE record: Elastic Elasticsearch · CVSS 4.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-33465.md) `CVE-2026-33465` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM](https://agentprime.io/advisories/GHSA-c83g-rgw3-j3cx.md) `GHSA-c83g-rgw3-j3cx`, `CVE-2026-73089` · npm `browserslist`: affected `<4.28.7`, fixed in `4.28.7` · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints](https://agentprime.io/advisories/CVE-2026-49329.md) `CVE-2026-49329` · CVE record: Red Hat Red Hat OpenShift Container Platform 4.13 and 4 more · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [httpd parks a request worker indefinitely on a malformed chunk size sent after the headers](https://agentprime.io/advisories/CVE-2026-69664.md) `CVE-2026-69664` · CVE record: Erlang OTP · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception](https://agentprime.io/advisories/CVE-2026-74835.md) `CVE-2026-74835` · CVE record: Erlang OTP · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [httpc memory exhaustion via unbounded response header accumulation](https://agentprime.io/advisories/CVE-2026-55951.md) `CVE-2026-55951` · CVE record: Erlang OTP · CVSS 8.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [httpd applies no timeout while receiving a request body, parking a worker on a stalled client](https://agentprime.io/advisories/CVE-2026-71380.md) `CVE-2026-71380` · CVE record: Erlang OTP · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [httpd does not enforce the documented default max_clients connection limit](https://agentprime.io/advisories/CVE-2026-70399.md) `CVE-2026-70399` · CVE record: Erlang OTP · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Resource allocation without limits in Schneider Electric EcoStruxure™ OPC UA Server Expert and others](https://agentprime.io/advisories/CVE-2024-10085.md) `CVE-2024-10085` · CVE record: Schneider Electric EcoStruxure™ OPC UA Server Expert and 1 more · CVSS 8.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Rockwell Automation 1756-ENBT Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-84235.md) `CVE-2026-84235` · CVE record: Rockwell Automation 1756-ENBT Module · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Rockwell Automation ArmorStart® LT Denial Of Service](https://agentprime.io/advisories/CVE-2026-19472.md) `CVE-2026-19472` · CVE record: Rockwell Automation ArmorStart® LT · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Denial-of-service in the PDF Viewer component](https://agentprime.io/advisories/CVE-2026-84138.md) `CVE-2026-84138` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads](https://agentprime.io/advisories/GHSA-33wq-x3q2-c92h.md) `GHSA-33wq-x3q2-c92h`, `CVE-2026-82743`, `EEF-CVE-2026-82743` · Hex `ash`: affected `>=2.19.0, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory](https://agentprime.io/advisories/GHSA-mgwj-c69v-6f83.md) `GHSA-mgwj-c69v-6f83`, `CVE-2026-82742`, `EEF-CVE-2026-82742` · Hex `ash`: affected `>=1.29.0-rc0, <3.32.2`, fixed in `3.32.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .