# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service](https://agentprime.io/advisories/GHSA-3m45-vrpj-xmrq.md) `GHSA-3m45-vrpj-xmrq`, `CVE-2026-65631`, `EEF-CVE-2026-65631` · Hex `jose`: affected `>=1.7.7, <1.11.13`, fixed in `1.11.13` · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types](https://agentprime.io/advisories/GHSA-fpj2-9h59-32pp.md) `GHSA-fpj2-9h59-32pp`, `CVE-2026-65628`, `EEF-CVE-2026-65628` · Hex `jose`: affected `>=1.5.0, <1.11.13`, fixed in `1.11.13` · CVSS 5.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Resource Exhaustion in MICE Service](https://agentprime.io/advisories/CVE-2026-70380.md) `CVE-2026-70380` · CVE record: WolfVision Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion](https://agentprime.io/advisories/CVE-2026-116467.md) `CVE-2026-116467` · CVE record: ggml-org llama.cpp · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [BUG-000186514 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-33521.md) `CVE-2026-33521` · CVE record: Esri ArcGIS Server · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Consul vulnerable to a denial of service in HTTP APIs](https://agentprime.io/advisories/CVE-2026-105626.md) `CVE-2026-105626` · CVE record: HashiCorp Consul and 1 more · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses](https://agentprime.io/advisories/CVE-2026-81038.md) `CVE-2026-81038` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service, Memory corruption - [Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity](https://agentprime.io/advisories/CVE-2026-81039.md) `CVE-2026-81039` · CVE record: zephyrproject zephyr · CVSS 4.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Apache Vysper: Unbounded allocation](https://agentprime.io/advisories/CVE-2026-115721.md) `CVE-2026-115721` · CVE record: Apache Software Foundation Apache Vysper · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames](https://agentprime.io/advisories/CVE-2026-93849.md) `CVE-2026-93849` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Unbounded response body buffering and decompression in hackney](https://agentprime.io/advisories/EEF-CVE-2026-97200.md) `EEF-CVE-2026-97200`, `CVE-2026-97200` · Hex `hackney`: affected `>=2.0.0-beta.1, <4.9.0`, fixed in `4.9.0` · CVSS 8.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service, CWE-409 - [SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit](https://agentprime.io/advisories/GHSA-j363-h72p-296m.md) `GHSA-j363-h72p-296m`, `CVE-2026-108529`, `EEF-CVE-2026-108529` · Hex `bandit`: affected `>=0.3.4, <1.14.0`, fixed in `1.14.0` · CVSS 8.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit](https://agentprime.io/advisories/GHSA-47x4-3fxf-82fr.md) `GHSA-47x4-3fxf-82fr`, `CVE-2026-110499`, `EEF-CVE-2026-110499` · Hex `bandit`: affected `>=0.3.6, <1.14.0`, fixed in `1.14.0` · CVSS 8.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit](https://agentprime.io/advisories/GHSA-jwh3-j29h-qfmw.md) `GHSA-jwh3-j29h-qfmw`, `CVE-2026-111101`, `EEF-CVE-2026-111101` · Hex `bandit`: affected `>=0.1.0, <1.14.0`, fixed in `1.14.0` · CVSS 8.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Quadratic bignum parsing of Content-Length and Host port values in Bandit](https://agentprime.io/advisories/GHSA-29cr-8477-rg6r.md) `GHSA-29cr-8477-rg6r`, `CVE-2026-113436`, `EEF-CVE-2026-113436` · Hex `bandit`: affected `>=1.0.0-pre.7, <1.14.0`, fixed in `1.14.0` · CVSS 8.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [WebSocket 1-byte continuation frames bypass \`max_fragmented_message_size\` in Bandit](https://agentprime.io/advisories/GHSA-cpx7-qf6w-jc63.md) `GHSA-cpx7-qf6w-jc63`, `CVE-2026-114213`, `EEF-CVE-2026-114213` · Hex `bandit`: affected `>=1.11.0, <1.14.0`, fixed in `1.14.0` · CVSS 8.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit](https://agentprime.io/advisories/GHSA-p2qv-vx88-385x.md) `GHSA-p2qv-vx88-385x`, `CVE-2026-115269`, `EEF-CVE-2026-115269` · Hex `bandit`: affected `>=1.4.0, <1.14.0`, fixed in `1.14.0` · CVSS 8.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit](https://agentprime.io/advisories/GHSA-c3g7-2pg5-qvwh.md) `GHSA-c3g7-2pg5-qvwh`, `CVE-2026-108525`, `EEF-CVE-2026-108525` · Hex `bandit`: affected `>=0.3.1, <1.14.0`, fixed in `1.14.0` · CVSS 8.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources](https://agentprime.io/advisories/CVE-2026-116120.md) `CVE-2026-116120` · CVE record: NocoDB · CVSS 6.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c.](https://agentprime.io/advisories/CVE-2026-104591.md) `CVE-2026-104591` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation](https://agentprime.io/advisories/CVE-2026-116095.md) `CVE-2026-116095` · CVE record: smg-project smg · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length](https://agentprime.io/advisories/CVE-2026-115825.md) `CVE-2026-115825` · CVE record · CVSS 7.5 High · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies](https://agentprime.io/advisories/CVE-2026-115824.md) `CVE-2026-115824` · CVE record · CVSS 7.5 High · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies](https://agentprime.io/advisories/CVE-2026-115822.md) `CVE-2026-115822` · CVE record · CVSS 7.5 High · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers](https://agentprime.io/advisories/CVE-2026-115817.md) `CVE-2026-115817` · CVE record · CVSS 7.5 High · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Im...](https://agentprime.io/advisories/GHSA-mm38-5g96-7j6x.md) `GHSA-mm38-5g96-7j6x`, `CVE-2026-116177`, `PYSEC-2026-4352` · PyPI `vllm`: affected `>=0.10.2, <0.25.0`, fixed in `0.25.0` · CVSS 8.7 High · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override](https://agentprime.io/advisories/CVE-2026-116179.md) `CVE-2026-116179` · CVE record: vllm-project vllm · CVSS 8.7 High · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option](https://agentprime.io/advisories/CVE-2026-116159.md) `CVE-2026-116159` · CVE record: ImageMagick ImageMagick · CVSS 4.8 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 7.1.2-33 Memory Leak in magick compare](https://agentprime.io/advisories/CVE-2026-116158.md) `CVE-2026-116158` · CVE record: ImageMagick ImageMagick · CVSS 2.0 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading](https://agentprime.io/advisories/CVE-2026-116157.md) `CVE-2026-116157` · CVE record: ImageMagick ImageMagick · CVSS 4.8 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option](https://agentprime.io/advisories/CVE-2026-116156.md) `CVE-2026-116156` · CVE record: ImageMagick ImageMagick · CVSS 4.8 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile](https://agentprime.io/advisories/CVE-2026-116155.md) `CVE-2026-116155` · CVE record: ImageMagick ImageMagick · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit](https://agentprime.io/advisories/CVE-2026-116154.md) `CVE-2026-116154` · CVE record: ImageMagick ImageMagick · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path](https://agentprime.io/advisories/CVE-2026-116152.md) `CVE-2026-116152` · CVE record: ImageMagick ImageMagick · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder](https://agentprime.io/advisories/CVE-2026-116151.md) `CVE-2026-116151` · CVE record: ImageMagick ImageMagick · CVSS 6.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder](https://agentprime.io/advisories/CVE-2026-116150.md) `CVE-2026-116150` · CVE record: ImageMagick ImageMagick · CVSS 2.3 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder](https://agentprime.io/advisories/CVE-2026-116146.md) `CVE-2026-116146` · CVE record: ImageMagick ImageMagick · CVSS 6.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder](https://agentprime.io/advisories/CVE-2026-116144.md) `CVE-2026-116144` · CVE record: ImageMagick ImageMagick · CVSS 4.8 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders](https://agentprime.io/advisories/CVE-2026-116143.md) `CVE-2026-116143` · CVE record: ImageMagick ImageMagick · CVSS 4.8 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder](https://agentprime.io/advisories/CVE-2026-116141.md) `CVE-2026-116141` · CVE record: ImageMagick ImageMagick · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service - [Travisun Opptrix preParsing handler webhook Buffer.concat denial of service](https://agentprime.io/advisories/CVE-2026-115971.md) `CVE-2026-115971` · CVE record: Travisun Opptrix · CVSS 6.9 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Denial of service - [Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters](https://agentprime.io/advisories/CVE-2026-114629.md) `CVE-2026-114629` · CVE record · CVSS 7.5 High · Not analysed yet · Published 24 Oct 2026 · Tags: Denial of service - [Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()](https://agentprime.io/advisories/CVE-2026-116011.md) `CVE-2026-116011` · CVE record: CrowCpp Crow · CVSS 8.7 High · Not analysed yet · Published 24 Oct 2026 · Tags: Denial of service - [undici vulnerable to Denial of Service via unbounded memory in the EventSource parser](https://agentprime.io/advisories/GHSA-4qv8-2p9j-2685.md) `GHSA-4qv8-2p9j-2685`, `CVE-2026-109924` · npm `undici`: affected `>=6.5.0, <6.29.1 || >=7.0.0, <7.30.1 || >=8.0.0, <8.12.2`, fixed in `6.29.1`, `7.30.1`, `8.12.2` · CVSS 5.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown](https://agentprime.io/advisories/GHSA-q7qp-rjg7-q26m.md) `GHSA-q7qp-rjg7-q26m`, `CVE-2026-113872` · npm `multer`: affected `>=2.0.0, <2.5.0`, fixed in `2.5.0` · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service, CWE-248 - [postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words](https://agentprime.io/advisories/GHSA-f2hq-32vh-53cc.md) `GHSA-f2hq-32vh-53cc` · npm `postal-mime`: affected `>=3.0.0, <4.0.8`, fixed in `4.0.8` · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)](https://agentprime.io/advisories/GHSA-gx7p-2j49-hfq4.md) `GHSA-gx7p-2j49-hfq4`, `CVE-2026-114055` · PyPI `vllm`: affected `>=0.7.3, <0.31.0`, fixed in `0.31.0` · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [pypdf: Possible long runtimes for repeated references to the same missing object](https://agentprime.io/advisories/GHSA-6c7f-9265-g8fw.md) `GHSA-6c7f-9265-g8fw`, `CVE-2026-115572` · PyPI `pypdf`: affected `<6.21.2`, fixed in `6.21.2` · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)](https://agentprime.io/advisories/GHSA-jr96-gvgh-j3r4.md) `GHSA-jr96-gvgh-j3r4`, `CVE-2026-115585` · PyPI `pypdf`: affected `<6.21.2`, fixed in `6.21.2` · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [pypdf: Possible long runtimes for large xref table header limits](https://agentprime.io/advisories/GHSA-gmh7-3g9r-mjh5.md) `GHSA-gmh7-3g9r-mjh5`, `CVE-2026-115580` · PyPI `pypdf`: affected `<6.21.2`, fixed in `6.21.2` · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [Echo: WebSocket proxy can retain connections and handlers after client disconnect](https://agentprime.io/advisories/GHSA-9969-6676-49h5.md) `GHSA-9969-6676-49h5`, `CVE-2026-118262`, `GO-2026-6838` · Go `github.com/labstack/echo/v4` and 1 more: affected `>=4.15.0, <4.16.1`, fixed in `4.16.1` · CVSS 8.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [Echo: Decompress permits unbounded gzip expansion in v4](https://agentprime.io/advisories/GHSA-h7wr-284f-5qvc.md) `GHSA-h7wr-284f-5qvc`, `CVE-2026-118261`, `GO-2026-6842` · Go `github.com/labstack/echo/v4`: affected `>=4.0.0, <4.16.1`, fixed in `4.16.1` · CVSS 8.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service, CWE-409 - [Echo: BodyDump captures request and response bodies without size limits in v4](https://agentprime.io/advisories/GHSA-f48p-c9v4-h7xv.md) `GHSA-f48p-c9v4-h7xv`, `CVE-2026-118260`, `GO-2026-6840` · Go `github.com/labstack/echo/v4`: affected `>=4.0.0, <4.16.1`, fixed in `4.16.1` · CVSS 8.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH](https://agentprime.io/advisories/GHSA-2qrf-pqgx-qh9v.md) `GHSA-2qrf-pqgx-qh9v`, `CVE-2026-115774` · PyPI `twisted`: affected `<26.10.0rc1`, fixed in `26.10.0rc1` · CVSS 4.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer](https://agentprime.io/advisories/GHSA-53xc-49m8-p798.md) `GHSA-53xc-49m8-p798`, `CVE-2026-115776` · PyPI `twisted`: affected `<26.10.0rc1`, fixed in `26.10.0rc1` · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer](https://agentprime.io/advisories/GHSA-cwm5-jh59-mwxr.md) `GHSA-cwm5-jh59-mwxr`, `CVE-2026-115778` · PyPI `twisted`: affected `<26.10.0rc1`, fixed in `26.10.0rc1` · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree](https://agentprime.io/advisories/GHSA-3476-c5c2-fr73.md) `GHSA-3476-c5c2-fr73`, `CVE-2026-115775` · PyPI `twisted`: affected `<26.10.0rc1`, fixed in `26.10.0rc1` · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt](https://agentprime.io/advisories/CVE-2026-16762.md) `CVE-2026-16762` · CVE record: qt qt · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for \~15 s](https://agentprime.io/advisories/CVE-2026-89314.md) `CVE-2026-89314` · CVE record: Eclipse Foundation Eclipse KeyPont - GOSE · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service - [Part-DB: Attachment Size Limit Bypass via API Base64 Upload](https://agentprime.io/advisories/CVE-2026-86019.md) `CVE-2026-86019` · CVE record: Part-DB Part-DB-server · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .