# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths](https://agentprime.io/advisories/CVE-2020-37280.md) `CVE-2020-37280` · CVE record: PelionIoT cbor-sync · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [IBM Power Systems Firmware Denial of Service](https://agentprime.io/advisories/CVE-2026-16678.md) `CVE-2026-16678` · CVE record: IBM Virtualization Management Interface · CVSS 4.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)](https://agentprime.io/advisories/CVE-2026-83536.md) `CVE-2026-83536` · CVE record: Red Hat Red Hat OpenStack Platform 18.0 · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions](https://agentprime.io/advisories/CVE-2026-105466.md) `CVE-2026-105466` · CVE record: IBM Db2 · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction](https://agentprime.io/advisories/CVE-2026-109363.md) `CVE-2026-109363` · CVE record: ZcashFoundation zebra · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count](https://agentprime.io/advisories/CVE-2026-109351.md) `CVE-2026-109351` · CVE record: GitoxideLabs gix-pack · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance](https://agentprime.io/advisories/CVE-2026-109350.md) `CVE-2026-109350` · CVE record: GitoxideLabs gix-pack · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header](https://agentprime.io/advisories/CVE-2026-109349.md) `CVE-2026-109349` · CVE record: GitoxideLabs gix-pack · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing](https://agentprime.io/advisories/CVE-2026-109348.md) `CVE-2026-109348` · CVE record: GitoxideLabs gix-mailmap · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering](https://agentprime.io/advisories/CVE-2026-109339.md) `CVE-2026-109339` · CVE record: surrealdb surrealdb and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template](https://agentprime.io/advisories/CVE-2026-109310.md) `CVE-2026-109310` · CVE record: siyuan-note siyuan · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation](https://agentprime.io/advisories/CVE-2026-109299.md) `CVE-2026-109299` · CVE record: open-webui open-webui · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex](https://agentprime.io/advisories/CVE-2026-109298.md) `CVE-2026-109298` · CVE record: open-webui open-webui · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules](https://agentprime.io/advisories/CVE-2026-109297.md) `CVE-2026-109297` · CVE record: open-webui open-webui · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service, CWE-436 - [Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop](https://agentprime.io/advisories/CVE-2026-109295.md) `CVE-2026-109295` · CVE record: open-webui open-webui · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image](https://agentprime.io/advisories/CVE-2026-109294.md) `CVE-2026-109294` · CVE record: open-webui open-webui · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service, CWE-409 - [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation](https://agentprime.io/advisories/CVE-2026-109278.md) `CVE-2026-109278` · CVE record: ImageMagick ImageMagick · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [ImageMagick before 7.1.2-32 Policy Bypass via -script Operation](https://agentprime.io/advisories/CVE-2026-109277.md) `CVE-2026-109277` · CVE record: ImageMagick ImageMagick · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [ImageMagick before 7.1.2-32 Memory Leak via -process Option](https://agentprime.io/advisories/CVE-2026-109270.md) `CVE-2026-109270` · CVE record: ImageMagick ImageMagick · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder](https://agentprime.io/advisories/CVE-2026-109267.md) `CVE-2026-109267` · CVE record: ImageMagick ImageMagick · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder](https://agentprime.io/advisories/CVE-2026-109264.md) `CVE-2026-109264` · CVE record: ImageMagick ImageMagick · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder](https://agentprime.io/advisories/CVE-2026-109263.md) `CVE-2026-109263` · CVE record: ImageMagick ImageMagick · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder](https://agentprime.io/advisories/CVE-2026-109262.md) `CVE-2026-109262` · CVE record: ImageMagick ImageMagick · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder](https://agentprime.io/advisories/CVE-2026-109261.md) `CVE-2026-109261` · CVE record: ImageMagick ImageMagick · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder](https://agentprime.io/advisories/CVE-2026-109260.md) `CVE-2026-109260` · CVE record: ImageMagick ImageMagick · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer](https://agentprime.io/advisories/CVE-2026-109240.md) `CVE-2026-109240` · CVE record: FreeRDP FreeRDP · CVSS 2.3 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror](https://agentprime.io/advisories/CVE-2026-96618.md) `CVE-2026-96618` · CVE record: hexpm hex · CVSS 2.1 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service, CWE-409 - [SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters](https://agentprime.io/advisories/CVE-2026-109228.md) `CVE-2026-109228` · CVE record: sgl-project sglang · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing](https://agentprime.io/advisories/CVE-2026-109227.md) `CVE-2026-109227` · CVE record: sgl-project sglang · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload](https://agentprime.io/advisories/CVE-2026-109225.md) `CVE-2026-109225` · CVE record: sgl-project sglang · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet](https://agentprime.io/advisories/CVE-2026-109205.md) `CVE-2026-109205` · CVE record: LogicalDOC LogicalDOC Community Edition · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service](https://agentprime.io/advisories/CVE-2026-108769.md) `CVE-2026-108769` · CVE record: zhayujie CowAgent · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources](https://agentprime.io/advisories/CVE-2026-108768.md) `CVE-2026-108768` · CVE record: zhayujie CowAgent · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure](https://agentprime.io/advisories/CVE-2026-19740.md) `CVE-2026-19740` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service, CWE-459 - [Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update](https://agentprime.io/advisories/CVE-2026-19739.md) `CVE-2026-19739` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service, CWE-459 - [Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures](https://agentprime.io/advisories/CVE-2026-19738.md) `CVE-2026-19738` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [zhayujie CowAgent Media Download memory allocation](https://agentprime.io/advisories/CVE-2026-108683.md) `CVE-2026-108683` · CVE record: zhayujie CowAgent · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [zhayujie CowAgent Web Console upload read denial of service](https://agentprime.io/advisories/CVE-2026-108682.md) `CVE-2026-108682` · CVE record: zhayujie CowAgent · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering](https://agentprime.io/advisories/CVE-2026-108859.md) `CVE-2026-108859` · CVE record: mark3labs mcp-go · CVSS 8.7 High · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [zhayujie CowAgent Web Console web_channel.py denial of service](https://agentprime.io/advisories/CVE-2026-108681.md) `CVE-2026-108681` · CVE record: zhayujie CowAgent · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption](https://agentprime.io/advisories/CVE-2026-108577.md) `CVE-2026-108577` · CVE record: Konstanty Bialkowski libmodplug · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint](https://agentprime.io/advisories/CVE-2026-108755.md) `CVE-2026-108755` · CVE record: hatchet-dev hatchet · CVSS 6.9 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /\_chat/routes WebSocket](https://agentprime.io/advisories/CVE-2026-108748.md) `CVE-2026-108748` · CVE record: quarkiverse quarkus-langchain4j · CVSS 6.9 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket](https://agentprime.io/advisories/CVE-2026-108714.md) `CVE-2026-108714` · CVE record: modelcontextprotocol kotlin-sdk · CVSS 8.7 High · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service](https://agentprime.io/advisories/CVE-2026-14854.md) `CVE-2026-14854` · CVE record: Unknown WooCommerce Bookings · CVSS 7.5 High · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS](https://agentprime.io/advisories/GHSA-6c27-994x-c52f.md) `GHSA-6c27-994x-c52f`, `CVE-2026-97853`, `EEF-CVE-2026-97853` · Hex `decimal`: affected `>=0.1.0, <3.1.2`, fixed in `3.1.2` · CVSS 6.9 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Denial of service - [SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing](https://agentprime.io/advisories/CVE-2026-108545.md) `CVE-2026-108545` · CVE record: SillyTavern SillyTavern · CVSS 8.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Denial of service - [Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage](https://agentprime.io/advisories/GHSA-j3hg-9rp3-5hw9.md) `GHSA-j3hg-9rp3-5hw9`, `CVE-2026-107805`, `GO-2026-6734` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20260729084040-acb59fdd81db, <1.9.10-0.20260901043436-8c9b9a1aff21`, fixed in `1.9.10-0.20260901043436-8c9b9a1aff21` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Contao: The registration module re-sends activation mails](https://agentprime.io/advisories/GHSA-mfxh-vp55-7gc6.md) `GHSA-mfxh-vp55-7gc6`, `CVE-2026-107843`, `PKSA-s71c-hg32-kv3f` · Packagist `contao/core-bundle`: affected `>=4.1.0, <5.3.50 || >=5.4.0-RC1, <5.7.12`, fixed in `5.3.50`, `5.7.12` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service, CWE-204 - [Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API](https://agentprime.io/advisories/GHSA-wq92-8x3r-fm38.md) `GHSA-wq92-8x3r-fm38`, `CVE-2026-91970`, `GO-2026-6757` · Go `code.vikunja.io/api`: affected `>=2.5.0, <2.6.0`, fixed in `2.6.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Vikunja: Unbounded CSV row cardinality permits API process termination](https://agentprime.io/advisories/GHSA-pqf9-h8g4-8gmh.md) `GHSA-pqf9-h8g4-8gmh`, `CVE-2026-91969`, `GO-2026-6746` · Go `code.vikunja.io/api`: affected `>=2.5.0, <2.6.0`, fixed in `2.6.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Vikunja: Unbounded nested task-filter recursion permits API process termination](https://agentprime.io/advisories/GHSA-xxc3-xpmc-vmvr.md) `GHSA-xxc3-xpmc-vmvr`, `CVE-2026-91968`, `GO-2026-6759` · Go `code.vikunja.io/api`: affected `>=2.5.0, <2.6.0`, fixed in `2.6.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Vikunja: Denial of service via decompression bomb in the data import](https://agentprime.io/advisories/GHSA-w7jp-mf2v-8342.md) `GHSA-w7jp-mf2v-8342`, `CVE-2026-91979`, `GO-2026-6756` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service, CWE-409 - [Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification](https://agentprime.io/advisories/GHSA-4vh2-39rq-rq8j.md) `GHSA-4vh2-39rq-rq8j`, `CVE-2026-91971`, `GO-2026-6717` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud \`getFileURL\` Endpoint Leads to Remote Denial of Service](https://agentprime.io/advisories/GHSA-4jfq-pmq9-257h.md) `GHSA-4jfq-pmq9-257h`, `CVE-2026-107839`, `GO-2026-6716` · Go `github.com/luskaner/ageLANServer/server`: affected `<1.8.2-0.20260809203301-1dd40166a593`, fixed in `1.8.2-0.20260809203301-1dd40166a593` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels](https://agentprime.io/advisories/GHSA-6r69-c6wg-7g8m.md) `GHSA-6r69-c6wg-7g8m`, `CVE-2026-107840`, `GO-2026-6720` · Go `github.com/jhaals/yopass`: affected `<0.0.0-20260727191436-61e31ead04a4`, fixed in `0.0.0-20260727191436-61e31ead04a4` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion](https://agentprime.io/advisories/CVE-2026-107838.md) `CVE-2026-107838` · CVE record: RIOT-OS RIOT · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service, CWE-252 - [pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination](https://agentprime.io/advisories/GHSA-vq8p-m3wm-gv5f.md) `GHSA-vq8p-m3wm-gv5f`, `CVE-2026-48484`, `PYSEC-2026-4293` · PyPI `pyload-ng`: affected `<0.5.0b3.dev101`, fixed in `0.5.0b3.dev101` · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service, CWE-20 - [Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha](https://agentprime.io/advisories/GHSA-94x4-5g3f-jjxp.md) `GHSA-94x4-5g3f-jjxp` · Maven `org.xerial.snappy:snappy-java`: affected `*`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Red Lion Controls N-Tron 700 Series Reachable Assertion](https://agentprime.io/advisories/CVE-2026-39453.md) `CVE-2026-39453` · CVE record: Red Lion Controls 700 Series · CVSS 8.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .