# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [aiohttp: Multiple instances of excessive or unbounded memory/CPU use](https://agentprime.io/advisories/GHSA-2g87-pp6c-29x5.md)
  `GHSA-2g87-pp6c-29x5`, `CVE-2026-123817` · PyPI `aiohttp`: affected `<3.14.4`, fixed in `3.14.4` · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [russh: Unbounded memory allocation in agent protocol server via crafted constraint records](https://agentprime.io/advisories/GHSA-4wc5-f2rc-q74m.md)
  `GHSA-4wc5-f2rc-q74m`, `CVE-2026-111061` · crates.io `russh`: affected `<0.64.1`, fixed in `0.64.1` · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [IBM MQ Denial of Service](https://agentprime.io/advisories/CVE-2026-14511.md)
  `CVE-2026-14511` · CVE record: IBM MQ · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [IBM MQ Denial of Service](https://agentprime.io/advisories/CVE-2026-12343.md)
  `CVE-2026-12343` · CVE record: IBM MQ Operator and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [Unbounded Recursion in phongo_bson_visit_document/visit_array:](https://agentprime.io/advisories/CVE-2026-112368.md)
  `CVE-2026-112368` · CVE record: MongoDB Inc. PHP Driver · CVSS 8.2 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption](https://agentprime.io/advisories/CVE-2026-112157.md)
  `CVE-2026-112157` · CVE record: MemTensor memmy-agent · CVSS 2.3 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns](https://agentprime.io/advisories/CVE-2026-112366.md)
  `CVE-2026-112366` · CVE record: micromatch picomatch · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [libbluray through 1.5.1 Uncontrolled Memory Allocation via \_parse_extent_start_points](https://agentprime.io/advisories/CVE-2026-112283.md)
  `CVE-2026-112283` · CVE record: VideoLAN libbluray · CVSS 6.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx](https://agentprime.io/advisories/CVE-2026-112270.md)
  `CVE-2026-112270` · CVE record: sgl-project sglang · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations](https://agentprime.io/advisories/CVE-2026-112269.md)
  `CVE-2026-112269` · CVE record: sgl-project sglang · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [Denial-of-service vulnerability in the SVG parser and renderer impacts Qt](https://agentprime.io/advisories/CVE-2026-8168.md)
  `CVE-2026-8168` · CVE record: qt qt · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser](https://agentprime.io/advisories/CVE-2026-112214.md)
  `CVE-2026-112214` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [Apache Kylin: Potential computed-column resource exhaustion](https://agentprime.io/advisories/CVE-2026-108837.md)
  `CVE-2026-108837` · CVE record: Apache Software Foundation Apache Kylin · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service](https://agentprime.io/advisories/CVE-2026-112083.md)
  `CVE-2026-112083` · CVE record: sgl-project SGLang · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service](https://agentprime.io/advisories/CVE-2026-112082.md)
  `CVE-2026-112082` · CVE record: sgl-project SGLang · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-108121.md)
  `CVE-2026-108121` · CVE record: Koozali SME Server · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection, Denial of service, CWE-20
- [A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media…](https://agentprime.io/advisories/CVE-2025-52290.md)
  `CVE-2025-52290` · CVE record · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [Gitea Actions artifact v4 API unbounded request body](https://agentprime.io/advisories/CVE-2026-105964.md)
  `CVE-2026-105964` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Denial of service
- [Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing](https://agentprime.io/advisories/CVE-2026-112054.md)
  `CVE-2026-112054` · CVE record: Schroedinger schroedinger · CVSS 6.8 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Denial of service
- [libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count](https://agentprime.io/advisories/CVE-2026-112048.md)
  `CVE-2026-112048` · CVE record: SpatiaLite libspatialite · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Denial of service
- [OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()](https://agentprime.io/advisories/CVE-2026-112046.md)
  `CVE-2026-112046` · CVE record: OW2 ASM · CVSS 6.8 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Denial of service
- [AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources](https://agentprime.io/advisories/CVE-2026-111985.md)
  `CVE-2026-111985` · CVE record: AUTOMATIC1111 stable-diffusion-webui · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Denial of service
- [libtta through 2.3 Divide by Zero via tta_decoder_init_get_info](https://agentprime.io/advisories/CVE-2026-112013.md)
  `CVE-2026-112013` · CVE record: True Audio libtta · CVSS 6.8 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Denial of service
- [Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process](https://agentprime.io/advisories/GHSA-p3hm-x653-5rc6.md)
  `GHSA-p3hm-x653-5rc6` · npm `ip-address`: affected `<=10.7.3`, no fixed version yet · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 18 Oct 2026 · Tags: Denial of service
- [Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing](https://agentprime.io/advisories/CVE-2026-111923.md)
  `CVE-2026-111923` · CVE record: fleetdm fleet · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2026 · Tags: Denial of service
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination](https://agentprime.io/advisories/CVE-2026-111901.md)
  `CVE-2026-111901` · CVE record: thorsten phpMyFAQ · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2026 · Tags: Denial of service
- [Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd](https://agentprime.io/advisories/CVE-2026-89096.md)
  `CVE-2026-89096` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline](https://agentprime.io/advisories/CVE-2026-110755.md)
  `CVE-2026-110755` · CVE record · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline](https://agentprime.io/advisories/CVE-2026-110754.md)
  `CVE-2026-110754` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment](https://agentprime.io/advisories/CVE-2026-110752.md)
  `CVE-2026-110752` · CVE record · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service](https://agentprime.io/advisories/CVE-2026-68498.md)
  `CVE-2026-68498` · CVE record: FasterXML jackson-core · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [swoosh has email-derived URL path injection in Microsoft Graph endpoint](https://agentprime.io/advisories/GHSA-754j-98wh-57rf.md)
  `GHSA-754j-98wh-57rf`, `CVE-2026-54893`, `EEF-CVE-2026-54893` · Hex `swoosh`: affected `>=1.12.0, <1.26.3`, fixed in `1.26.3` · CVSS 2.1 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service, CWE-116, CWE-1284
- [Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns](https://agentprime.io/advisories/CVE-2026-59966.md)
  `CVE-2026-59966` · CVE record: TandoorRecipes recipes · CVSS 5.7 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding](https://agentprime.io/advisories/CVE-2026-85231.md)
  `CVE-2026-85231` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd](https://agentprime.io/advisories/CVE-2026-89098.md)
  `CVE-2026-89098` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge](https://agentprime.io/advisories/CVE-2026-111714.md)
  `CVE-2026-111714` · CVE record: AmauriC tarteaucitron.js · CVSS 2.3 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open](https://agentprime.io/advisories/CVE-2026-77474.md)
  `CVE-2026-77474` · CVE record: Dicklesworthstone destructive_command_guard · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service, CWE-693
- [libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU](https://agentprime.io/advisories/CVE-2026-68906.md)
  `CVE-2026-68906` · CVE record: mz-automation libiec61850 · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption, Denial of service
- [pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing](https://agentprime.io/advisories/CVE-2026-77630.md)
  `CVE-2026-77630` · CVE record: pupnp pupnp · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered](https://agentprime.io/advisories/CVE-2026-57487.md)
  `CVE-2026-57487` · CVE record: pupnp pupnp · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow](https://agentprime.io/advisories/CVE-2026-55862.md)
  `CVE-2026-55862` · CVE record: pupnp pupnp · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [libp2p-rust: Gossipsub GRAFT topics unbounded growth](https://agentprime.io/advisories/CVE-2026-95859.md)
  `CVE-2026-95859` · CVE record: libp2p rust-libp2p · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [J4Care dcm4che Inefficient Algorithmic Complexity](https://agentprime.io/advisories/CVE-2026-101021.md)
  `CVE-2026-101021` · CVE record: J4Care dcm4chee-arc-light · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [J4Care dcm4che Loop with Unreachable Exit Condition](https://agentprime.io/advisories/CVE-2026-105273.md)
  `CVE-2026-105273` · CVE record: J4Care dcm4chee-arc-light · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [J4Care dcm4che Loop with Unreachable Exit Condition](https://agentprime.io/advisories/CVE-2026-107621.md)
  `CVE-2026-107621` · CVE record: J4Care dcm4chee-arc-light · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [gocsaf/csaf: csaf_provider prone to uncontrolled resource consumption](https://agentprime.io/advisories/CVE-2026-107564.md)
  `CVE-2026-107564` · CVE record: gocsaf Development Community csaf_provider · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering](https://agentprime.io/advisories/CVE-2026-16251.md)
  `CVE-2026-16251` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Uncapped mention keys in user notification properties allow CPU exhaustion during post processing](https://agentprime.io/advisories/CVE-2026-19867.md)
  `CVE-2026-19867` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket](https://agentprime.io/advisories/CVE-2026-111384.md)
  `CVE-2026-111384` · CVE record: nezhahq nezha · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket](https://agentprime.io/advisories/CVE-2026-111383.md)
  `CVE-2026-111383` · CVE record: nezhahq nezha · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser](https://agentprime.io/advisories/CVE-2026-111378.md)
  `CVE-2026-111378` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly](https://agentprime.io/advisories/CVE-2026-111377.md)
  `CVE-2026-111377` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c).](https://agentprime.io/advisories/CVE-2025-55653.md)
  `CVE-2025-55653` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER](https://agentprime.io/advisories/CVE-2026-111279.md)
  `CVE-2026-111279` · CVE record: dragonflydb dragonfly · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service
- [ASP.NET Core Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-109468.md)
  `CVE-2026-109468` · CVE record: Microsoft Microsoft Visual Studio 2022 version 17.14 and 2 more · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service
- [Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation](https://agentprime.io/advisories/GHSA-hqm2-cfx2-2vgh.md)
  `GHSA-hqm2-cfx2-2vgh`, `CVE-2026-102682` · PyPI `pipecat-ai`: affected `>=0.0.98, <1.6.0`, fixed in `1.6.0` · CVSS 5.6 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service, Broken access control, CWE-345
- [containerd: Unpack DoS via repeated opaque whiteouts](https://agentprime.io/advisories/GHSA-rp3h-jf77-q9p4.md)
  `GHSA-rp3h-jf77-q9p4`, `CVE-2026-95838`, `GO-2026-6796` · Go `github.com/containerd/containerd` and 1 more: affected `<1.7.35`, fixed in `1.7.35` · CVSS 4.6 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service
- [kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash](https://agentprime.io/advisories/GHSA-g8cf-rcjf-c8cf.md)
  `GHSA-g8cf-rcjf-c8cf`, `CVE-2026-100354`, `GO-2026-6785` · Go `github.com/getkin/kin-openapi`: affected `<0.149.0`, fixed in `0.149.0` · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service
- [kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression](https://agentprime.io/advisories/GHSA-h4r5-mxv5-8mjc.md)
  `GHSA-h4r5-mxv5-8mjc`, `CVE-2026-100350`, `GO-2026-6787` · Go `github.com/getkin/kin-openapi`: affected `>=0.145.0, <0.146.0`, fixed in `0.146.0` · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service, CWE-1050
- [tinytag: Infinite loop when parsing certain M4A files containing invalid atoms](https://agentprime.io/advisories/GHSA-24cc-9352-h2pg.md)
  `GHSA-24cc-9352-h2pg`, `CVE-2026-104266` · PyPI `tinytag`: affected `>=2.0.0, <2.3.0`, fixed in `2.3.0` · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTEwLTE1VDIwOjE2OjQ3LjAwMDAwMFoiLCJHSFNBLTI0Y2MtOTM1Mi1oMnBnIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTEwLTE5VDE3OjA4OjA0LjAwMDAwMFoiLCJHSFNBLTV3cjgtZ2NxZi1ncWYzIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTEwLTE5VDE3OjA4OjA0LjAwMDAwMFoiLCJHSFNBLTV3cjgtZ2NxZi1ncWYzIl0>. Everything for agents: <https://agentprime.io/llms.txt>.