# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads](https://agentprime.io/advisories/GHSA-3pph-fpjx-jg34.md)
  `GHSA-3pph-fpjx-jg34`, `CVE-2026-88932` · npm `multer`: affected `>=2.2.0, <2.4.0`, fixed in `2.4.0` · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service, CWE-459
- [Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE](https://agentprime.io/advisories/GHSA-f67j-2jqw-jpq7.md)
  `GHSA-f67j-2jqw-jpq7`, `CVE-2026-101895` · npm `@angular/platform-server`: affected `<=19.2.25 || >=20.0.0, <20.3.31 || >=21.0.0, <21.2.23 || >=22.0.0, <22.1.6`, fixed in `20.3.31`, `21.2.23`, `22.1.6` · CVSS 8.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [VxWorks 7 Memory allocation](https://agentprime.io/advisories/CVE-2026-102006.md)
  `CVE-2026-102006` · CVE record: Wind River Systems Inc VxWorks 7 · CVSS 5.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS](https://agentprime.io/advisories/GHSA-q4xh-88c3-wmh7.md)
  `GHSA-q4xh-88c3-wmh7`, `CVE-2026-68497` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.14.0, <2.18.10 || >=2.19.0, <2.21.6 || >=2.22.0, <2.22.2`, fixed in `2.18.10`, `2.21.6`, `2.22.2` · CVSS 7.5 High · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [VxWorks Memory Allocation](https://agentprime.io/advisories/CVE-2026-102005.md)
  `CVE-2026-102005` · CVE record: Wind River Inc VxWorks 7 · CVSS 5.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [VxWorks 7 Memory Resource leak](https://agentprime.io/advisories/CVE-2026-97686.md)
  `CVE-2026-97686` · CVE record: Wind River VxWorks 7 · CVSS 5.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption](https://agentprime.io/advisories/CVE-2026-101098.md)
  `CVE-2026-101098` · CVE record: ag-ui-protocol ag-ui · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint](https://agentprime.io/advisories/CVE-2026-101333.md)
  `CVE-2026-101333` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 3.7 Low · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [Denial of Service in mH-DEVELOPER](https://agentprime.io/advisories/CVE-2026-82936.md)
  `CVE-2026-82936` · CVE record: F&F Filipowski mH-DEVELOPER · CVSS 5.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size](https://agentprime.io/advisories/GHSA-q95c-ccq6-j5j6.md)
  `GHSA-q95c-ccq6-j5j6`, `CVE-2026-92103`, `EEF-CVE-2026-92103` · Hex `mint`: affected `>=0.1.0, <1.10.2`, fixed in `1.10.2` · CVSS 6.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory](https://agentprime.io/advisories/GHSA-9x8p-qrf4-jq7g.md)
  `GHSA-9x8p-qrf4-jq7g`, `CVE-2026-91043`, `EEF-CVE-2026-91043` · Hex `mint`: affected `>=1.1.0, <1.10.2`, fixed in `1.10.2` · CVSS 8.2 High · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of service](https://agentprime.io/advisories/CVE-2026-101040.md)
  `CVE-2026-101040` · CVE record: Ricoh SP 330DN and 3 more · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [Trusted Domain Project OpenARC libopenarc arc-canon.c arc_parse_canon_t null pointer dereference](https://agentprime.io/advisories/CVE-2026-100895.md)
  `CVE-2026-100895` · CVE record: Trusted Domain Project OpenARC · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service, Memory corruption
- [Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference](https://agentprime.io/advisories/CVE-2026-100890.md)
  `CVE-2026-100890` · CVE record: Trusted Domain Project OpenDMARC · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service, Memory corruption
- [Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service](https://agentprime.io/advisories/CVE-2026-94408.md)
  `CVE-2026-94408` · CVE record: Elastic Elasticsearch · CVSS 4.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service](https://agentprime.io/advisories/CVE-2026-94397.md)
  `CVE-2026-94397` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service](https://agentprime.io/advisories/CVE-2026-94396.md)
  `CVE-2026-94396` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Kibana Leading to denial of service](https://agentprime.io/advisories/CVE-2026-94400.md)
  `CVE-2026-94400` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service](https://agentprime.io/advisories/CVE-2026-94399.md)
  `CVE-2026-94399` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service](https://agentprime.io/advisories/CVE-2026-94398.md)
  `CVE-2026-94398` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-82300.md)
  `CVE-2026-82300` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-82294.md)
  `CVE-2026-82294` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 M...](https://agentprime.io/advisories/GHSA-p6g9-7v3x-m8mv.md)
  `GHSA-p6g9-7v3x-m8mv`, `CVE-2026-100650`, `PYSEC-2026-4184` · PyPI `vllm`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS](https://agentprime.io/advisories/CVE-2026-100662.md)
  `CVE-2026-100662` · CVE record: netty netty · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation](https://agentprime.io/advisories/CVE-2026-100661.md)
  `CVE-2026-100661` · CVE record: netty netty · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention](https://agentprime.io/advisories/CVE-2026-100660.md)
  `CVE-2026-100660` · CVE record: netty netty · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass](https://agentprime.io/advisories/CVE-2026-100651.md)
  `CVE-2026-100651` · CVE record: vllm-project vllm · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass](https://agentprime.io/advisories/CVE-2026-100649.md)
  `CVE-2026-100649` · CVE record: vllm-project vllm · CVSS 6.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding](https://agentprime.io/advisories/CVE-2026-100648.md)
  `CVE-2026-100648` · CVE record: vllm-project vllm · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API](https://agentprime.io/advisories/CVE-2026-100600.md)
  `CVE-2026-100600` · CVE record: openclaw clawhub · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [OpenClaw before 2026.8.1 Denial of Service via Rate Limit](https://agentprime.io/advisories/CVE-2026-100572.md)
  `CVE-2026-100572` · CVE record: OpenClaw OpenClaw · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass](https://agentprime.io/advisories/CVE-2026-100571.md)
  `CVE-2026-100571` · CVE record: OpenClaw OpenClaw · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade](https://agentprime.io/advisories/CVE-2026-100558.md)
  `CVE-2026-100558` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2](https://agentprime.io/advisories/CVE-2026-100542.md)
  `CVE-2026-100542` · CVE record: OpenClaw OpenClaw · CVSS 2.3 Low · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [OpenClaw before 2026.8.2 Denial of Service via Browser Relay](https://agentprime.io/advisories/CVE-2026-100527.md)
  `CVE-2026-100527` · CVE record: OpenClaw OpenClaw · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service
- [SOAP: Unbounded Recursion in Server-Side cleanup_xml_node](https://agentprime.io/advisories/CVE-2026-91765.md)
  `CVE-2026-91765` · CVE record: PHP Group PHP · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [Containerd has image-pull DoS via crafted OCI index graph amplification](https://agentprime.io/advisories/GHSA-pg57-6jwg-q645.md)
  `GHSA-pg57-6jwg-q645`, `CVE-2026-53493`, `GO-2026-6597` · Go `github.com/containerd/containerd` and 1 more: affected `<1.7.36`, fixed in `1.7.36` · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [Zammad: Denial of Service via OTRS Import Controller](https://agentprime.io/advisories/CVE-2026-56725.md)
  `CVE-2026-56725` · CVE record: zammad zammad · CVSS 8.7 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass, Denial of service
- [RabbitMQ: Consecutive topic wildcards cause combinatorial routing work](https://agentprime.io/advisories/CVE-2026-67419.md)
  `CVE-2026-67419` · CVE record: rabbitmq rabbitmq-server · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service](https://agentprime.io/advisories/CVE-2026-67408.md)
  `CVE-2026-67408` · CVE record: rabbitmq rabbitmq-server · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [RabbitMQ: Atom exhaustion: to_atom on global-parameter :name](https://agentprime.io/advisories/CVE-2026-67227.md)
  `CVE-2026-67227` · CVE record: rabbitmq rabbitmq-server · CVSS 5.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list](https://agentprime.io/advisories/CVE-2026-67226.md)
  `CVE-2026-67226` · CVE record: rabbitmq rabbitmq-server · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression](https://agentprime.io/advisories/CVE-2026-67413.md)
  `CVE-2026-67413` · CVE record: rabbitmq rabbitmq-server · CVSS 6.0 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service](https://agentprime.io/advisories/CVE-2026-67415.md)
  `CVE-2026-67415` · CVE record: rabbitmq rabbitmq-server · CVSS 5.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values](https://agentprime.io/advisories/CVE-2026-66071.md)
  `CVE-2026-66071` · CVE record: rabbitmq rabbitmq-server · CVSS 6.0 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [RabbitMQ: Atom table exhaustion via management API node field](https://agentprime.io/advisories/CVE-2026-66073.md)
  `CVE-2026-66073` · CVE record: rabbitmq rabbitmq-server · CVSS 6.0 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [RabbitMQ: Stream-protocol frame length never validated against frame_max](https://agentprime.io/advisories/CVE-2026-67225.md)
  `CVE-2026-67225` · CVE record: rabbitmq rabbitmq-server · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [RabbitMQ: Web-STOMP unbounded pre-auth accumulation](https://agentprime.io/advisories/CVE-2026-67230.md)
  `CVE-2026-67230` · CVE record: rabbitmq rabbitmq-server · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client](https://agentprime.io/advisories/CVE-2026-67222.md)
  `CVE-2026-67222` · CVE record: rabbitmq rabbitmq-server · CVSS 5.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder](https://agentprime.io/advisories/CVE-2026-92550.md)
  `CVE-2026-92550` · CVE record: Apache Software Foundation Apache Qpid Broker-J · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder](https://agentprime.io/advisories/CVE-2026-92560.md)
  `CVE-2026-92560` · CVE record: Apache Software Foundation Apache Qpid Broker-J · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing](https://agentprime.io/advisories/CVE-2026-92564.md)
  `CVE-2026-92564` · CVE record: Apache Software Foundation Apache Qpid Broker-J · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review](https://agentprime.io/advisories/CVE-2026-87722.md)
  `CVE-2026-87722` · CVE record: Gerrit Gerrit · CVSS 8.7 High · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review](https://agentprime.io/advisories/CVE-2026-87721.md)
  `CVE-2026-87721` · CVE record: Gerrit Gerrit · CVSS 8.7 High · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME](https://agentprime.io/advisories/GHSA-f6v3-2qmr-vfjx.md)
  `GHSA-f6v3-2qmr-vfjx`, `CVE-2026-61816`, `PKSA-r8x8-972m-nrc1` · Packagist `zbateson/mail-mime-parser`: affected `>=2.0.0, <3.0.6 || >=4.0.0, <4.0.2`, fixed in `3.0.6`, `4.0.2` · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [hpack: Unbounded variable integer decoding can cause run-away computation on malformed input](https://agentprime.io/advisories/GHSA-8v8h-hg4w-mvq2.md)
  `GHSA-8v8h-hg4w-mvq2`, `CVE-2026-59980`, `PYSEC-2026-4053` · PyPI `hpack`: affected `<4.2.0`, fixed in `4.2.0` · CVSS 6.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service](https://agentprime.io/advisories/CVE-2026-65827.md)
  `CVE-2026-65827` · CVE record: docmost docmost · CVSS 6.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service, CWE-409
- [Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion](https://agentprime.io/advisories/CVE-2026-71540.md)
  `CVE-2026-71540` · CVE record: wazuh wazuh · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [Wazuh: Unbounded Recursion in os_xml \`\_getattributes()\` Causes analysisd Worker Thread Stack Exhaustion](https://agentprime.io/advisories/CVE-2026-61811.md)
  `CVE-2026-61811` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [Habitica: Regex Injection / ReDoS in Member Search](https://agentprime.io/advisories/CVE-2026-54461.md)
  `CVE-2026-54461` · CVE record: HabitRPG habitica · CVSS 6.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTA5LTI0VDE3OjM3OjU5LjI4MDAwMFoiLCJDVkUtMjAyNi01NDQ2MSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTA5LTI5VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi02Nzk4NyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTA5LTI5VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi02Nzk4NyJd>. Everything for agents: <https://agentprime.io/llms.txt>.