# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Inefficient Algorithmic Complexity in hMailServer](https://agentprime.io/advisories/CVE-2026-107582.md)
  `CVE-2026-107582` · CVE record: Progressive Robot Ltd hMailServer · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Inefficient Algorithmic Complexity in hMailServer](https://agentprime.io/advisories/CVE-2026-107581.md)
  `CVE-2026-107581` · CVE record: Progressive Robot Ltd hMailServer · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Inefficient Algorithmic Complexity in hMailServer](https://agentprime.io/advisories/CVE-2026-107580.md)
  `CVE-2026-107580` · CVE record: Progressive Robot Ltd hMailServer · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Inefficient Algorithmic Complexity in hMailServer](https://agentprime.io/advisories/CVE-2026-107579.md)
  `CVE-2026-107579` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Inefficient Algorithmic Complexity in hMailServer](https://agentprime.io/advisories/CVE-2026-107576.md)
  `CVE-2026-107576` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer](https://agentprime.io/advisories/CVE-2026-107577.md)
  `CVE-2026-107577` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Inefficient Algorithmic Complexity in hMailServer](https://agentprime.io/advisories/CVE-2026-107575.md)
  `CVE-2026-107575` · CVE record: Progressive Robot Ltd hMailServer · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Inefficient Regular Expression Complexity in hMailServer](https://agentprime.io/advisories/CVE-2026-107572.md)
  `CVE-2026-107572` · CVE record: Progressive Robot Ltd hMailServer · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Inefficient Algorithmic Complexity in hMailServer](https://agentprime.io/advisories/CVE-2026-107574.md)
  `CVE-2026-107574` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the Supplier does not con…](https://agentprime.io/advisories/CVE-2026-95184.md)
  `CVE-2026-95184` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.](https://agentprime.io/advisories/CVE-2026-95116.md)
  `CVE-2026-95116` · CVE record · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76271.md)
  `CVE-2026-76271` · CVE record: Splunk Splunk Enterprise · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Ghost: Regular Expression Denial of Service in External Media Inliner](https://agentprime.io/advisories/GHSA-9m4w-fmjw-fvjq.md)
  `GHSA-9m4w-fmjw-fvjq`, `BIT-ghost-2026-105645`, `CVE-2026-105645` · npm `ghost`: affected `>=5.37.0, <6.67.0`, fixed in `6.67.0` · CVSS 4.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Ghost: Regular Expression Denial of Service in Content Import](https://agentprime.io/advisories/GHSA-fwh9-qg68-vxp4.md)
  `GHSA-fwh9-qg68-vxp4`, `BIT-ghost-2026-105646`, `CVE-2026-105646` · npm `ghost`: affected `>=4.0.0, <6.67.0`, fixed in `6.67.0` · CVSS 4.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS](https://agentprime.io/advisories/GHSA-cqgh-8p3p-mx4m.md)
  `GHSA-cqgh-8p3p-mx4m`, `CVE-2026-106121` · Maven `com.rabbitmq:amqp-client`: affected `<5.36.1`, fixed in `5.36.1` · CVSS 4.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion](https://agentprime.io/advisories/GHSA-cgc7-9qp3-86m3.md)
  `GHSA-cgc7-9qp3-86m3`, `CVE-2026-105749`, `PYSEC-2026-4195`, `PYSEC-2026-4211` · PyPI `docling` and 1 more: affected `>=2.0.0, <2.131.0`, fixed in `2.131.0` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError](https://agentprime.io/advisories/GHSA-343h-94h5-c4wr.md)
  `GHSA-343h-94h5-c4wr`, `CVE-2026-106449` · Maven `at.yawk.lz4:lz4-java` and 1 more: affected `<1.11.4`, fixed in `1.11.4` · CVSS 3.7 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs](https://agentprime.io/advisories/GHSA-gm45-99xc-r7wv.md)
  `GHSA-gm45-99xc-r7wv`, `CVE-2026-106450` · Maven `at.yawk.lz4:lz4-java` and 1 more: affected `<1.11.4`, fixed in `1.11.4` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop](https://agentprime.io/advisories/GHSA-wmxv-xphr-5c9g.md)
  `GHSA-wmxv-xphr-5c9g`, `CVE-2026-106116` · NuGet `SixLabors.ImageSharp`: affected `>=2.0.0, <3.2.0 || >=4.0.0, <4.1.2`, fixed in `3.2.0`, `4.1.2` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions](https://agentprime.io/advisories/GHSA-gwg2-r3hj-4w44.md)
  `GHSA-gwg2-r3hj-4w44`, `CVE-2026-106114` · NuGet `SixLabors.ImageSharp`: affected `>=1.0.0-beta0001, <3.2.0 || >=4.0.0, <4.1.2`, fixed in `3.2.0`, `4.1.2` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile](https://agentprime.io/advisories/GHSA-jrfj-fhj2-jjvm.md)
  `GHSA-jrfj-fhj2-jjvm`, `CVE-2026-107219`, `GO-2026-6681` · Go `github.com/xuri/excelize/v2`: affected `>=2.3.1, <2.11.1-0.20260906004932-2badfcd5841d`, fixed in `2.11.1-0.20260906004932-2badfcd5841d` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Excelize: Unbounded \<col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process](https://agentprime.io/advisories/GHSA-fq3v-74gv-27gm.md)
  `GHSA-fq3v-74gv-27gm`, `CVE-2026-107223`, `GO-2026-6678` · Go `github.com/xuri/excelize/v2`: affected `>=2.1.0, <2.11.1`, fixed in `2.11.1` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2026-1403.md)
  `CVE-2026-1403` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Denial of Service in Absolute Secure Access](https://agentprime.io/advisories/CVE-2026-97717.md)
  `CVE-2026-97717` · CVE record: Absolute Security Secure Access · CVSS 6.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Denial of Service in Absolute Secure Access](https://agentprime.io/advisories/CVE-2026-97716.md)
  `CVE-2026-97716` · CVE record: Absolute Security Secure Access · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Denial of Service in Absolute Secure Access](https://agentprime.io/advisories/CVE-2026-97715.md)
  `CVE-2026-97715` · CVE record: Absolute Security Secure Access · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Denial of service vulnerability in Secure Access](https://agentprime.io/advisories/CVE-2026-97714.md)
  `CVE-2026-97714` · CVE record: Absolute Security Secure Access · CVSS 8.2 High · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Infinite Loop in Telerik Document Processing XLS Import](https://agentprime.io/advisories/CVE-2026-106164.md)
  `CVE-2026-106164` · CVE record: Progress Software Telerik Document Processing Libraries · CVSS 7.3 High · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Twisted: IMAP wildcardToRegexp() ReDoS](https://agentprime.io/advisories/GHSA-8pqf-f4m5-798g.md)
  `GHSA-8pqf-f4m5-798g`, `CVE-2026-106454`, `PYSEC-2026-4304` · PyPI `twisted`: affected `<=26.4.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header](https://agentprime.io/advisories/GHSA-4v53-57pg-c464.md)
  `GHSA-4v53-57pg-c464`, `CVE-2026-106452` · Maven `at.yawk.lz4:lz4-java` and 1 more: affected `<1.11.2`, fixed in `1.11.2` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError](https://agentprime.io/advisories/GHSA-6cx8-rjf8-pr8g.md)
  `GHSA-6cx8-rjf8-pr8g`, `CVE-2026-106453` · Maven `at.yawk.lz4:lz4-java` and 1 more: affected `<1.11.2`, fixed in `1.11.2` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server](https://agentprime.io/advisories/GHSA-68jq-fhch-4xq4.md)
  `GHSA-68jq-fhch-4xq4`, `CVE-2026-106104` · npm `quasar`: affected `<2.23.3`, fixed in `2.23.3` · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Cisco NX-OS Software Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20173.md)
  `CVE-2026-20173` · CVE record: Cisco Cisco NX-OS Software · CVSS 5.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources](https://agentprime.io/advisories/CVE-2026-107166.md)
  `CVE-2026-107166` · CVE record: Open5GS · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [ImageMagick: Denial of service with crafted XMP profile](https://agentprime.io/advisories/CVE-2026-107208.md)
  `CVE-2026-107208` · CVE record: ImageMagick ImageMagick · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [ImageMagick: Policy Bypass in CUT encoder](https://agentprime.io/advisories/CVE-2026-106580.md)
  `CVE-2026-106580` · CVE record: ImageMagick ImageMagick · CVSS 4.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, Denial of service
- [ImageMagick: Denial of service possible when parsing an XMP profile.](https://agentprime.io/advisories/CVE-2026-106576.md)
  `CVE-2026-106576` · CVE record: ImageMagick ImageMagick · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [ImageMagick: Denial of service in MVG decoder](https://agentprime.io/advisories/CVE-2026-106573.md)
  `CVE-2026-106573` · CVE record: ImageMagick ImageMagick · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [ImageMagick: Stack Overflown CALS decoder due to missing depth check.](https://agentprime.io/advisories/CVE-2026-106572.md)
  `CVE-2026-106572` · CVE record: ImageMagick ImageMagick · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [ImageMagick: Denial of service in distributed pixel cache server](https://agentprime.io/advisories/CVE-2026-106570.md)
  `CVE-2026-106570` · CVE record: ImageMagick ImageMagick · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [ImageMagick: Denial of service in ASE decoder because of missing security checks](https://agentprime.io/advisories/CVE-2026-106569.md)
  `CVE-2026-106569` · CVE record: ImageMagick ImageMagick · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [ImageMagick: Infinite Loop when reading a crafted XMP profile](https://agentprime.io/advisories/CVE-2026-106568.md)
  `CVE-2026-106568` · CVE record: ImageMagick ImageMagick · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [ImageMagick: Infinite Loop in PSD decoder on 32-bit builds](https://agentprime.io/advisories/CVE-2026-106567.md)
  `CVE-2026-106567` · CVE record: ImageMagick ImageMagick · CVSS 5.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service, CWE-196
- [ImageMagick: Infinite Loop in bzip2 compressed images.](https://agentprime.io/advisories/CVE-2026-106565.md)
  `CVE-2026-106565` · CVE record: ImageMagick ImageMagick · CVSS 5.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()](https://agentprime.io/advisories/CVE-2026-107168.md)
  `CVE-2026-107168` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header](https://agentprime.io/advisories/CVE-2026-107159.md)
  `CVE-2026-107159` · CVE record: miniupnp project miniupnpd · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion](https://agentprime.io/advisories/CVE-2026-84897.md)
  `CVE-2026-84897` · CVE record: wolfSSL Inc. wolfSSH · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service, CWE-372, CWE-405
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93679.md)
  `CVE-2026-93679` · CVE record: IBM Langflow OSS · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Sssd: sssd-kcm: local denial of service via excessive memory preallocation](https://agentprime.io/advisories/CVE-2026-80048.md)
  `CVE-2026-80048` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service
- [Gitea migration memory exhaustion from zero page size](https://agentprime.io/advisories/CVE-2026-104633.md)
  `CVE-2026-104633` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service
- [Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding](https://agentprime.io/advisories/GHSA-6r3q-mjv7-xr8m.md)
  `GHSA-6r3q-mjv7-xr8m`, `CVE-2026-41510`, `GO-2026-6668` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.1`, fixed in `3.8.1` · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service, CWE-693
- [Sssd: sssd: denial of service via race condition in autofs responder](https://agentprime.io/advisories/CVE-2026-104045.md)
  `CVE-2026-104045` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service
- [CVE-2026-106550](https://agentprime.io/advisories/CVE-2026-106550.md)
  `CVE-2026-106550` · CVE record: Mozilla Node-convict · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service, Broken access control, Prototype pollution
- [Sssd: sssd: denial of service via incomplete identity provider authentication requests](https://agentprime.io/advisories/CVE-2026-104046.md)
  `CVE-2026-104046` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service
- [Uncontrolled Recursion in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-103008.md)
  `CVE-2026-103008` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service
- [Uncontrolled Recursion in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-103006.md)
  `CVE-2026-103006` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service
- [Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-103005.md)
  `CVE-2026-103005` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service
- [Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-102411.md)
  `CVE-2026-102411` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service
- [Uncontrolled Recursion in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-102409.md)
  `CVE-2026-102409` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service
- [Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-102408.md)
  `CVE-2026-102408` · CVE record: Elastic Elasticsearch · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTEwLTA2VDE5OjMxOjM5LjE5NjAwMFoiLCJDVkUtMjAyNi0xMDI0MDgiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTEwLTA4VDExOjQ5OjA2LjA4MTAwMFoiLCJDVkUtMjAyNi0xMDc1ODMiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTEwLTA4VDExOjQ5OjA2LjA4MTAwMFoiLCJDVkUtMjAyNi0xMDc1ODMiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.