# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in](https://agentprime.io/advisories/GHSA-q876-xr24-2mcx.md)
  `GHSA-q876-xr24-2mcx`, `CVE-2026-82760`, `EEF-CVE-2026-82760` · Hex `ash_authentication`: affected `>=4.8.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service
- [WWBN AVideo userVerifyEmail.php Unauthenticated Access Control](https://agentprime.io/advisories/CVE-2026-92915.md)
  `CVE-2026-92915` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service
- [Allocation of Resources Without Limits or Throttling in OOBM](https://agentprime.io/advisories/CVE-2026-25281.md)
  `CVE-2026-25281` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.4 High · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service
- [Duplicate Advisory: joi: Quadratic regular-expression backtracking in \`Joi.string().isoDate()\`](https://agentprime.io/advisories/GHSA-mrx9-2rrp-rhpx.md)
  `GHSA-mrx9-2rrp-rhpx` · npm `joi`: affected `>=18.0.0`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service
- [RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service](https://agentprime.io/advisories/GHSA-9pj6-vhgr-3mwh.md)
  `GHSA-9pj6-vhgr-3mwh`, `CVE-2026-63128` · crates.io `rmcp`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions](https://agentprime.io/advisories/GHSA-hcwq-8wjf-3gcr.md)
  `GHSA-hcwq-8wjf-3gcr`, `CVE-2026-57173`, `PYSEC-2026-4179` · PyPI `vllm`: affected `<0.24.0`, fixed in `0.24.0` · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software Logging Denial of Service](https://agentprime.io/advisories/CVE-2026-20154.md)
  `CVE-2026-20154` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Cisco Secure Adaptive Security Appliance Software and Secure Firewall Threat Defense Software EIGRP Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20222.md)
  `CVE-2026-20222` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 1 more · CVSS 7.4 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20295.md)
  `CVE-2026-20295` · CVE record: Cisco Cisco Secure Firewall Management Center (FMC) and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Firepower 3100 and 4200 Series DTLS Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20250.md)
  `CVE-2026-20250` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Apache MyFaces: Denial of Service via Unbounded Request Parsing](https://agentprime.io/advisories/CVE-2026-76646.md)
  `CVE-2026-76646` · CVE record: Apache Software Foundation Apache MyFaces · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock](https://agentprime.io/advisories/CVE-2026-46352.md)
  `CVE-2026-46352` · CVE record: OISF suricata · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference](https://agentprime.io/advisories/CVE-2026-92417.md)
  `CVE-2026-92417` · CVE record: Open5GS · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service, Memory corruption
- [Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion](https://agentprime.io/advisories/CVE-2026-92416.md)
  `CVE-2026-92416` · CVE record: Open5GS · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Artifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereference](https://agentprime.io/advisories/CVE-2026-92413.md)
  `CVE-2026-92413` · CVE record: Artifex MuPDF · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service, Memory corruption
- [node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion](https://agentprime.io/advisories/GHSA-r2pf-9cw4-5j65.md)
  `GHSA-r2pf-9cw4-5j65`, `CVE-2026-68904` · npm `node-opcua` and 2 more: affected `>=2.0.0, <2.170.0`, fixed in `2.170.0` · CVSS 7.0 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching](https://agentprime.io/advisories/CVE-2026-79651.md)
  `CVE-2026-79651` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state](https://agentprime.io/advisories/CVE-2026-18212.md)
  `CVE-2026-18212` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking](https://agentprime.io/advisories/CVE-2026-77409.md)
  `CVE-2026-77409` · CVE record: rabbitmq amqp091-go · CVSS 8.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching](https://agentprime.io/advisories/CVE-2026-19668.md)
  `CVE-2026-19668` · CVE record: ISC BIND 9 · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Validating resolver can abort while caching a mismatched NOQNAME proof](https://agentprime.io/advisories/CVE-2026-80274.md)
  `CVE-2026-80274` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [named aborts on a TKEY query when the user configuration has no global options statement](https://agentprime.io/advisories/CVE-2026-76163.md)
  `CVE-2026-76163` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [vllm-project vllm thinking_budget_state.py algorithmic complexity](https://agentprime.io/advisories/CVE-2026-92365.md)
  `CVE-2026-92365` · CVE record: vllm-project vllm · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [SVCB AliasMode additional-data error leaks qpcache references](https://agentprime.io/advisories/CVE-2026-81563.md)
  `CVE-2026-81563` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [ag-ui-protocol ag-ui JSON sse_parser.cpp resource consumption](https://agentprime.io/advisories/CVE-2026-92363.md)
  `CVE-2026-92363` · CVE record: ag-ui-protocol ag-ui · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [ag-ui-protocol ag-ui SSE Frame sse.rs resource consumption](https://agentprime.io/advisories/CVE-2026-92362.md)
  `CVE-2026-92362` · CVE record: ag-ui-protocol ag-ui · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Advantech EKI-1242IEIMS and others](https://agentprime.io/advisories/CVE-2026-73175.md)
  `CVE-2026-73175` · CVE record: Advantech EKI-1242IEIMS and 1 more · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [ag-ui-protocol ag-ui SSE Client client.go resource consumption](https://agentprime.io/advisories/CVE-2026-92361.md)
  `CVE-2026-92361` · CVE record: ag-ui-protocol ag-ui · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption](https://agentprime.io/advisories/CVE-2026-92356.md)
  `CVE-2026-92356` · CVE record: a2ui-project a2ui · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Security Advisory 0172](https://agentprime.io/advisories/CVE-2026-73438.md)
  `CVE-2026-73438` · CVE record: Arista Networks EOS · CVSS 7.0 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC](https://agentprime.io/advisories/CVE-2026-85501.md)
  `CVE-2026-85501` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Possible degradation of service from continuous queries on the same TCP/DoT connection](https://agentprime.io/advisories/CVE-2026-80225.md)
  `CVE-2026-80225` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array](https://agentprime.io/advisories/CVE-2026-92091.md)
  `CVE-2026-92091` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt](https://agentprime.io/advisories/CVE-2026-19248.md)
  `CVE-2026-19248` · CVE record: qt qt · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-14871.md)
  `CVE-2025-14871` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2026-1168.md)
  `CVE-2026-1168` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update](https://agentprime.io/advisories/CVE-2026-87828.md)
  `CVE-2026-87828` · CVE record: Unknown Seraphinite Accelerator · CVSS 5.7 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper.\_handle_release_message resource consumption](https://agentprime.io/advisories/CVE-2026-92220.md)
  `CVE-2026-92220` · CVE record: vllm-project vLLM · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [a2ui-project a2ui Basic Catalog safe_regex.ts redos](https://agentprime.io/advisories/CVE-2026-92114.md)
  `CVE-2026-92114` · CVE record: a2ui-project a2ui · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [emp3r0r has an unauthenticated HTTP Polling DoS](https://agentprime.io/advisories/GHSA-4595-rvpx-4q34.md)
  `GHSA-4595-rvpx-4q34`, `CVE-2026-61554`, `GO-2026-6487` · Go `github.com/jm33-m0/emp3r0r/core`: affected `<0.0.0-20260531142011-aed3d81641ab`, fixed in `0.0.0-20260531142011-aed3d81641ab` · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-87289.md)
  `CVE-2026-87289` · CVE record: Oracle Corporation Helidon · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-87285.md)
  `CVE-2026-87285` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 6.0 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-87283.md)
  `CVE-2026-87283` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 6.0 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-87282.md)
  `CVE-2026-87282` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 6.0 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-87279.md)
  `CVE-2026-87279` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 6.1 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-87277.md)
  `CVE-2026-87277` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-87274.md)
  `CVE-2026-87274` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 4.4 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-87267.md)
  `CVE-2026-87267` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87222.md)
  `CVE-2026-87222` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87215.md)
  `CVE-2026-87215` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87199.md)
  `CVE-2026-87199` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Hyperion Data Relationship Management](https://agentprime.io/advisories/CVE-2026-87148.md)
  `CVE-2026-87148` · CVE record: Oracle Corporation Oracle Hyperion Data Relationship Management · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Hyperion Data Relationship Management](https://agentprime.io/advisories/CVE-2026-87138.md)
  `CVE-2026-87138` · CVE record: Oracle Corporation Oracle Hyperion Data Relationship Management · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Report Manager](https://agentprime.io/advisories/CVE-2026-87126.md)
  `CVE-2026-87126` · CVE record: Oracle Corporation Oracle Report Manager · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-83480.md)
  `CVE-2026-83480` · CVE record: Oracle Corporation Helidon · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Mobile Application Server](https://agentprime.io/advisories/CVE-2026-83465.md)
  `CVE-2026-83465` · CVE record: Oracle Corporation Oracle Mobile Application Server · CVSS 8.2 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-83459.md)
  `CVE-2026-83459` · CVE record: Oracle Corporation Helidon · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-83458.md)
  `CVE-2026-83458` · CVE record: Oracle Corporation Helidon · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Demand Signal Repository](https://agentprime.io/advisories/CVE-2026-83457.md)
  `CVE-2026-83457` · CVE record: Oracle Corporation Oracle Demand Signal Repository · CVSS 8.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Depot Repair](https://agentprime.io/advisories/CVE-2026-83436.md)
  `CVE-2026-83436` · CVE record: Oracle Corporation Oracle Depot Repair · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTA5LTE1VDIwOjA1OjM0Ljc0ODAwMFoiLCJDVkUtMjAyNi04MzQzNiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTA5LTE3VDEzOjI3OjMwLjE2MzAwMFoiLCJDVkUtMjAyNi04OTQxOCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTA5LTE3VDEzOjI3OjMwLjE2MzAwMFoiLCJDVkUtMjAyNi04OTQxOCJd>. Everything for agents: <https://agentprime.io/llms.txt>.