# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [GNU Binutils Section Merge merge.c \_bfd_write_merged_section null pointer dereference](https://agentprime.io/advisories/CVE-2026-90830.md) `CVE-2026-90830` · CVE record: GNU Binutils · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, Memory corruption - [GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference](https://agentprime.io/advisories/CVE-2026-90829.md) `CVE-2026-90829` · CVE record: GNU Binutils · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, Memory corruption - [GNU Binutils ELF Orphan Section ldelf.c elf_orphan_compatible null pointer dereference](https://agentprime.io/advisories/CVE-2026-90828.md) `CVE-2026-90828` · CVE record: GNU Binutils · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, Memory corruption - [Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.](https://agentprime.io/advisories/CVE-2026-12759.md) `CVE-2026-12759` · CVE record: IBM Cloud Pak for Business Automation · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Apple macOS](https://agentprime.io/advisories/CVE-2026-84553.md) `CVE-2026-84553` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Resource allocation without limits in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86892.md) `CVE-2026-86892` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-65410.md) `CVE-2026-65410` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, CWE-248 - [Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-13260.md) `CVE-2026-13260` · CVE record: IBM Verify Identity Access and 3 more · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [FFmpeg Duration hlsproto.c parse_playlist denial of service](https://agentprime.io/advisories/CVE-2026-90816.md) `CVE-2026-90816` · CVE record: FFmpeg · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption](https://agentprime.io/advisories/CVE-2026-17463.md) `CVE-2026-17463` · CVE record: IBM Db2 · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS](https://agentprime.io/advisories/CVE-2026-15893.md) `CVE-2026-15893` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [webhook through 2.8.3 Memory Exhaustion via Oversized Request Body](https://agentprime.io/advisories/CVE-2026-91080.md) `CVE-2026-91080` · CVE record: adnanh webhook · CVSS 8.7 High · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [DotVVM: ReDOS in routing](https://agentprime.io/advisories/CVE-2026-57577.md) `CVE-2026-57577` · CVE record: riganti dotvvm · CVSS 8.2 High · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference](https://agentprime.io/advisories/CVE-2026-90802.md) `CVE-2026-90802` · CVE record: GNU Binutils · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, Memory corruption - [Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size](https://agentprime.io/advisories/CVE-2026-15923.md) `CVE-2026-15923` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference](https://agentprime.io/advisories/CVE-2026-90792.md) `CVE-2026-90792` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, Memory corruption - [Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder](https://agentprime.io/advisories/CVE-2026-82435.md) `CVE-2026-82435` · CVE record: Apache Software Foundation Apache Storm Worker · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC](https://agentprime.io/advisories/CVE-2026-82439.md) `CVE-2026-82439` · CVE record: Apache Software Foundation Apache Storm DRPC · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting](https://agentprime.io/advisories/CVE-2026-86349.md) `CVE-2026-86349` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertion](https://agentprime.io/advisories/CVE-2026-90786.md) `CVE-2026-90786` · CVE record: Dvidelabs flatcc · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion](https://agentprime.io/advisories/CVE-2026-90785.md) `CVE-2026-90785` · CVE record: Dvidelabs flatcc · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Dvidelabs flatcc semantics.c fb_clear_parser memory leak](https://agentprime.io/advisories/CVE-2026-90784.md) `CVE-2026-90784` · CVE record: Dvidelabs flatcc · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint](https://agentprime.io/advisories/CVE-2026-90928.md) `CVE-2026-90928` · CVE record: filebrowser filebrowser · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message](https://agentprime.io/advisories/CVE-2026-90927.md) `CVE-2026-90927` · CVE record: filebrowser filebrowser · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [vllm-project vLLM tiktoken vocab File mod.rs new denial of service](https://agentprime.io/advisories/CVE-2026-90713.md) `CVE-2026-90713` · CVE record: vllm-project vLLM · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of service](https://agentprime.io/advisories/CVE-2026-90712.md) `CVE-2026-90712` · CVE record: Gitlawb openclaude · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Mattermost Markdown autolink parsing denial of service](https://agentprime.io/advisories/CVE-2026-12882.md) `CVE-2026-12882` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion](https://agentprime.io/advisories/CVE-2026-11993.md) `CVE-2026-11993` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion](https://agentprime.io/advisories/CVE-2026-90685.md) `CVE-2026-90685` · CVE record: GPAC · CVSS 2.4 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [GPAC MP4Box base_scenegraph.c gf_node_get_field_count assertion](https://agentprime.io/advisories/CVE-2026-90684.md) `CVE-2026-90684` · CVE record: GPAC · CVSS 2.4 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [GPAC MP4Box base_scenegraph.c gf_node_unregister assertion](https://agentprime.io/advisories/CVE-2026-90683.md) `CVE-2026-90683` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference](https://agentprime.io/advisories/CVE-2026-90622.md) `CVE-2026-90622` · CVE record: GNU libredwg · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, Memory corruption - [GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion](https://agentprime.io/advisories/CVE-2026-90613.md) `CVE-2026-90613` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [GPAC MP4Box scene_dump.c gf_sm_dump_command_list assertion](https://agentprime.io/advisories/CVE-2026-90612.md) `CVE-2026-90612` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [GPAC MP4Box loader_xmt.c xmt_parse_element assertion](https://agentprime.io/advisories/CVE-2026-90611.md) `CVE-2026-90611` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [GPAC MP4Box vrml_tools.c null pointer dereference](https://agentprime.io/advisories/CVE-2026-90609.md) `CVE-2026-90609` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, Memory corruption - [Infinite loop in Samsung Exynos 850 firmware](https://agentprime.io/advisories/CVE-2023-37366.md) `CVE-2023-37366` · CVE record: Samsung Exynos 850 firmware · CVSS 2.8 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service](https://agentprime.io/advisories/CVE-2026-15892.md) `CVE-2026-15892` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Denial of service - [TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources](https://agentprime.io/advisories/CVE-2026-90584.md) `CVE-2026-90584` · CVE record: TooTallNate Java-WebSocket · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Denial of service - [evanchiu serverless-todo API Todo Endpoint index.js saveTodos resource consumption](https://agentprime.io/advisories/CVE-2026-90582.md) `CVE-2026-90582` · CVE record: evanchiu serverless-todo · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Denial of service - [GPAC MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereference](https://agentprime.io/advisories/CVE-2026-90576.md) `CVE-2026-90576` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Denial of service, Memory corruption - [GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference](https://agentprime.io/advisories/CVE-2026-90573.md) `CVE-2026-90573` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Denial of service, Memory corruption - [Duplicate Advisory: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)](https://agentprime.io/advisories/GHSA-vm5r-23w9-m8hx.md) `GHSA-vm5r-23w9-m8hx` · npm `nodemailer`: affected `>=9.1.0, <=10.0.4`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 13 Sept 2026 · Tags: Denial of service - [Resource allocation without limits in UnrealIRCd](https://agentprime.io/advisories/CVE-2026-90668.md) `CVE-2026-90668` · CVE record: UnrealIRCd UnrealIRCd · CVSS 8.7 High · Not analysed yet · Published 13 Sept 2026 · Tags: Denial of service - [IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer dereference](https://agentprime.io/advisories/CVE-2026-90485.md) `CVE-2026-90485` · CVE record: IOBit Uninstaller · CVSS 6.8 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Denial of service, Memory corruption - [vLLM before 0.28.0 Denial of Service via audio extraction](https://agentprime.io/advisories/CVE-2026-90554.md) `CVE-2026-90554` · CVE record: vllm-project vLLM · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Denial of service - [msgpack-java through 0.9.12 Stack Overflow via Nested Arrays](https://agentprime.io/advisories/CVE-2026-90472.md) `CVE-2026-90472` · CVE record: msgpack msgpack-java · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Denial of service - [AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server](https://agentprime.io/advisories/CVE-2026-54135.md) `CVE-2026-54135` · CVE record: SimulPiscator AirSane · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service - [Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns](https://agentprime.io/advisories/CVE-2026-82617.md) `CVE-2026-82617` · CVE record: Apache Software Foundation Apache OpenNLP · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service - [Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer](https://agentprime.io/advisories/CVE-2026-67211.md) `CVE-2026-67211` · CVE record: Apache Software Foundation Apache OpenNLP · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service - [Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read](https://agentprime.io/advisories/CVE-2026-89147.md) `CVE-2026-89147` · CVE record: net-snmp Net-SNMP · CVSS 8.7 High · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service, CWE-1088 - [libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses](https://agentprime.io/advisories/CVE-2026-89146.md) `CVE-2026-89146` · CVE record: libp2p libp2p-rendezvous · CVSS 8.7 High · Not analysed yet · Published 11 Sept 2026 · Tags: Memory corruption, Denial of service - [multiparty vulnerable to Denial of Service via unbounded part-header accumulation](https://agentprime.io/advisories/CVE-2026-87908.md) `CVE-2026-87908` · CVE record: multiparty multiparty · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service - [Infinite loop in strongSwan](https://agentprime.io/advisories/CVE-2026-78132.md) `CVE-2026-78132` · CVE record: strongSwan strongSwan · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service - [Memory leak in strongSwan](https://agentprime.io/advisories/CVE-2026-78131.md) `CVE-2026-78131` · CVE record: strongSwan strongSwan · CVSS 3.7 Low · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service - [Infinite loop in strongSwan](https://agentprime.io/advisories/CVE-2026-78129.md) `CVE-2026-78129` · CVE record: strongSwan strongSwan · CVSS 5.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service - [Memory leak in strongSwan](https://agentprime.io/advisories/CVE-2026-78127.md) `CVE-2026-78127` · CVE record: strongSwan strongSwan · CVSS 3.7 Low · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service - [Memory leak in strongSwan](https://agentprime.io/advisories/CVE-2026-78124.md) `CVE-2026-78124` · CVE record: strongSwan strongSwan · CVSS 3.7 Low · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service - [Stack overflow in nscd due to unbounded alloca use](https://agentprime.io/advisories/CVE-2026-89092.md) `CVE-2026-89092` · CVE record: The GNU C Library glibc · CVSS 4.2 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service - [An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the FastExplorationFSM::optTimerCallback() i…](https://agentprime.io/advisories/CVE-2026-71646.md) `CVE-2026-71646` · CVE record · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .