# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service](https://agentprime.io/advisories/CVE-2026-111073.md)
  `CVE-2026-111073` · CVE record: Apache Software Foundation Apache Kafka · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-409
- [Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection](https://agentprime.io/advisories/CVE-2026-103410.md)
  `CVE-2026-103410` · CVE record: Juniper Networks Session Smart Router · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption, Denial of service
- [HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit](https://agentprime.io/advisories/GHSA-pxjf-g536-7r93.md)
  `GHSA-pxjf-g536-7r93`, `CVE-2026-116078`, `EEF-CVE-2026-116078` · Hex `bandit`: affected `>=0.3.1, <1.14.1`, fixed in `1.14.1` · CVSS 8.7 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [SAIL: WebP decoder division by zero through malformed animated canvas metadata](https://agentprime.io/advisories/CVE-2026-59959.md)
  `CVE-2026-59959` · CVE record: HappySeaFox sail · CVSS 4.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing](https://agentprime.io/advisories/CVE-2026-118037.md)
  `CVE-2026-118037` · CVE record: Progress Software Telerik Document Processing Libraries · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-606
- [Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering](https://agentprime.io/advisories/CVE-2026-118036.md)
  `CVE-2026-118036` · CVE record: Progress Software Telerik Document Processing Libraries · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing](https://agentprime.io/advisories/CVE-2026-118035.md)
  `CVE-2026-118035` · CVE record: Progress Software Telerik Document Processing Libraries · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [Resource allocation without limits in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-92665.md)
  `CVE-2026-92665` · CVE record: Dell PowerProtect Data Domain · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [a2ui-project a2ui Parser expression_parser.ts formatString resource consumption](https://agentprime.io/advisories/CVE-2026-118276.md)
  `CVE-2026-118276` · CVE record: a2ui-project a2ui · CVSS 5.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption](https://agentprime.io/advisories/CVE-2026-118275.md)
  `CVE-2026-118275` · CVE record: a2ui-project a2ui · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [a2ui-project a2ui Binder generic-binder.ts resource consumption](https://agentprime.io/advisories/CVE-2026-118274.md)
  `CVE-2026-118274` · CVE record: a2ui-project a2ui · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [a2ui-project a2ui data-model.ts DataModel.set resource consumption](https://agentprime.io/advisories/CVE-2026-118273.md)
  `CVE-2026-118273` · CVE record: a2ui-project a2ui · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response](https://agentprime.io/advisories/CVE-2026-118374.md)
  `CVE-2026-118374` · CVE record: OpenBSD LibreSSL · CVSS 8.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [a2ui-project a2ui data-context Resolver data-context.ts resource consumption](https://agentprime.io/advisories/CVE-2026-118271.md)
  `CVE-2026-118271` · CVE record: a2ui-project a2ui · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [jackson-dataformat-smile: unbounded eager byte\[\] allocation for raw binary in the async parser allows OutOfMemoryError denial of service](https://agentprime.io/advisories/CVE-2026-104895.md)
  `CVE-2026-104895` · CVE record: FasterXML jackson-dataformat-smile · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application…](https://agentprime.io/advisories/CVE-2026-106972.md)
  `CVE-2026-106972` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the applic…](https://agentprime.io/advisories/CVE-2026-106971.md)
  `CVE-2026-106971` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption, Denial of service
- [Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net](https://agentprime.io/advisories/GO-2026-6860.md)
  `GO-2026-6860`, `CVE-2026-78661` · Go `golang.org/x/net`: affected `<0.62.0`, fixed in `0.62.0` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [dd-trace: ReDOS in URL query string obfuscation](https://agentprime.io/advisories/GHSA-x94g-w73q-hpcw.md)
  `GHSA-x94g-w73q-hpcw`, `CVE-2026-116693` · npm `dd-trace`: affected `>=2.0.0, <5.131.1 || >=6.0.0, <6.20.1`, fixed in `5.131.1`, `6.20.1` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation](https://agentprime.io/advisories/GHSA-f5m9-jfrj-jjj7.md)
  `GHSA-f5m9-jfrj-jjj7`, `CVE-2026-116694` · PyPI `opentelemetry-propagator-jaeger`: affected `<1.45.0`, fixed in `1.45.0` · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation](https://agentprime.io/advisories/GHSA-qrxm-fqhp-jwvm.md)
  `GHSA-qrxm-fqhp-jwvm`, `CVE-2026-87018` · npm `undici`: affected `>=4.2.1, <6.29.1 || >=7.0.0, <7.30.1 || >=8.0.0, <8.12.2`, fixed in `6.29.1`, `7.30.1`, `8.12.2` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service, CWE-248
- [undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering](https://agentprime.io/advisories/GHSA-9fm3-97px-rjf6.md)
  `GHSA-9fm3-97px-rjf6`, `CVE-2026-109932` · npm `undici`: affected `>=5.15.0, <6.29.1 || >=7.0.0, <7.30.1 || >=8.0.0, <8.12.2`, fixed in `6.29.1`, `7.30.1`, `8.12.2` · CVSS 5.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service, CWE-405
- [MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length](https://agentprime.io/advisories/GHSA-f897-62hf-6gxq.md)
  `GHSA-f897-62hf-6gxq` · npm `@modelcontextprotocol/hono` and 3 more: affected `>=2.0.0, <2.0.1`, fixed in `2.0.1` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process](https://agentprime.io/advisories/GHSA-2v3c-qxhr-7vpv.md)
  `GHSA-2v3c-qxhr-7vpv`, `CVE-2026-109413`, `PKSA-fyjn-dgwp-4tt3`, `PKSA-xz3r-9gp4-4m1z` · Packagist `symfony/symfony` and 1 more: affected `>=2.0.0, <5.4.54 || >=6.0.0, <6.4.45 || >=7.0.0, <7.4.18 || >=8.0.0, <8.1.6`, fixed in `5.4.54`, `6.4.45`, `7.4.18`, `8.1.6` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header](https://agentprime.io/advisories/GHSA-r925-mgvr-h9cc.md)
  `GHSA-r925-mgvr-h9cc`, `CVE-2026-108082`, `PKSA-5gdh-tt4n-ckh2`, `PKSA-xmwy-rmx5-m7h4` · Packagist `symfony/http-foundation` and 1 more: affected `>=4.1.0, <5.4.54 || >=6.0.1, <6.4.46 || >=7.0.0, <7.4.19 || >=8.0.0, <8.1.7`, fixed in `5.4.54`, `6.4.46`, `7.4.19`, `8.1.7` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Go JOSE: DoS when parsing JWKs that contain RSA keys](https://agentprime.io/advisories/GHSA-mgcc-cww5-fp2q.md)
  `GHSA-mgcc-cww5-fp2q`, `CVE-2026-116587` · Go `github.com/go-jose/go-jose/v3` and 1 more: affected `<=3.0.5`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.](https://agentprime.io/advisories/CVE-2026-116656.md)
  `CVE-2026-116656` · CVE record: Tanium Enforce · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.](https://agentprime.io/advisories/CVE-2026-116659.md)
  `CVE-2026-116659` · CVE record: Tanium Enforce · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.](https://agentprime.io/advisories/CVE-2026-108309.md)
  `CVE-2026-108309` · CVE record: Tanium Endpoint Configuration Toolset Solution and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Tanium addressed a denial of service vulnerability in Enforce.](https://agentprime.io/advisories/CVE-2026-116657.md)
  `CVE-2026-116657` · CVE record: Tanium Enforce · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Tanium addressed a denial of service vulnerability in Tanium Server.](https://agentprime.io/advisories/CVE-2026-108310.md)
  `CVE-2026-108310` · CVE record: Tanium Tanium Server · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.](https://agentprime.io/advisories/CVE-2026-108331.md)
  `CVE-2026-108331` · CVE record: Tanium Endpoint Configuration Toolset Solution and 1 more · CVSS 3.3 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [libXtst RECORD EnableContext Reply Endless Loop](https://agentprime.io/advisories/CVE-2026-109088.md)
  `CVE-2026-109088` · CVE record: X.org libXtst · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Nextcloud server](https://agentprime.io/advisories/CVE-2026-77167.md)
  `CVE-2026-77167` · CVE record: Nextcloud server · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.](https://agentprime.io/advisories/GHSA-h2v8-394m-p7vv.md)
  `GHSA-h2v8-394m-p7vv`, `RUSTSEC-2026-0348` · crates.io `rustls`: affected `<0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2`, fixed in `0.23.46`, `0.24.0-dev.2` · CVSS 3.7 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)](https://agentprime.io/advisories/GHSA-j2w7-387v-m2rq.md)
  `GHSA-j2w7-387v-m2rq`, `CVE-2026-108359`, `PKSA-dxd5-wy68-pq29` · Packagist `phpoffice/phpspreadsheet`: affected `<1.30.7 || >=2.0.0, <2.1.19 || >=2.2.0, <2.4.8 || >=3.3.0, <3.10.8 || >=4.0.0, <5.10.0`, fixed in `1.30.7`, `2.1.19`, `2.4.8`, `3.10.8`, `5.10.0` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service](https://agentprime.io/advisories/GHSA-3x94-m842-937c.md)
  `GHSA-3x94-m842-937c`, `CVE-2026-108358`, `PKSA-96jv-mtjg-g2v8` · Packagist `phpoffice/phpspreadsheet`: affected `<1.30.7 || >=2.0.0, <2.1.19 || >=2.2.0, <2.4.8 || >=3.3.0, <3.10.8 || >=4.0.0, <5.10.0`, fixed in `1.30.7`, `2.1.19`, `2.4.8`, `3.10.8`, `5.10.0` · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: XML external entities (XXE), Denial of service
- [PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service](https://agentprime.io/advisories/GHSA-rxj4-h86g-25gc.md)
  `GHSA-rxj4-h86g-25gc`, `CVE-2026-108357`, `PKSA-zb3c-6qhx-m249` · Packagist `phpoffice/phpspreadsheet`: affected `>=3.3.0, <3.10.8 || >=4.0.0, <5.10.0`, fixed in `3.10.8`, `5.10.0` · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: XML external entities (XXE), Denial of service
- [dnspython dns.name.from_wire_parser() excessive CPU use](https://agentprime.io/advisories/GHSA-45c3-73f7-pv4m.md)
  `GHSA-45c3-73f7-pv4m`, `CVE-2026-114605` · PyPI `dnspython`: affected `<2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Datadog dd-trace-py: ReDoS in URL query string obfuscation](https://agentprime.io/advisories/GHSA-3633-r77q-h3v3.md)
  `GHSA-3633-r77q-h3v3`, `CVE-2026-116588` · PyPI `ddtrace`: affected `>=1.5.0, <3.19.9 || >=4.0.0, <4.15.6`, fixed in `3.19.9`, `4.15.6` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha](https://agentprime.io/advisories/GHSA-q233-g92q-qxp6.md)
  `GHSA-q233-g92q-qxp6`, `CVE-2026-108106` · Maven `org.xerial.snappy:snappy-java`: affected `<1.1.10.9`, fixed in `1.1.10.9` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines](https://agentprime.io/advisories/GHSA-m64x-33q8-m5h7.md)
  `GHSA-m64x-33q8-m5h7`, `CVE-2026-110856` · PyPI `gitpython`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service](https://agentprime.io/advisories/GHSA-4ffr-jq9g-5ffx.md)
  `GHSA-4ffr-jq9g-5ffx`, `CVE-2026-110869` · npm `nodemailer`: affected `>=3.0.0, <10.0.13`, fixed in `10.0.13` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service](https://agentprime.io/advisories/GHSA-4g23-2xm8-66gc.md)
  `GHSA-4g23-2xm8-66gc`, `CVE-2026-110872` · npm `nodemailer`: affected `>=3.0.0, <10.0.10`, fixed in `10.0.10` · CVSS 8.2 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure](https://agentprime.io/advisories/GHSA-j586-36cw-2gc2.md)
  `GHSA-j586-36cw-2gc2`, `CVE-2026-114613` · PyPI `msgpack`: affected `<1.2.3`, fixed in `1.2.3` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service, Memory corruption
- [vllm p2p never connected zmq_exhaustion](https://agentprime.io/advisories/GHSA-frvg-qw88-hww9.md)
  `GHSA-frvg-qw88-hww9`, `CVE-2026-94624`, `PYSEC-2026-4006` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption](https://agentprime.io/advisories/CVE-2026-117506.md)
  `CVE-2026-117506` · CVE record: a2aproject a2a-java · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [fpdf2: Exponential SVG '\<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'](https://agentprime.io/advisories/GHSA-wqw6-wpr3-45rh.md)
  `GHSA-wqw6-wpr3-45rh`, `CVE-2026-114610` · PyPI `fpdf2`: affected `>=2.5.0, <2.8.8`, fixed in `2.8.8` · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [a2aproject a2a-java ChildQueue queue.offer resource consumption](https://agentprime.io/advisories/CVE-2026-117505.md)
  `CVE-2026-117505` · CVE record: a2aproject a2a-java · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation](https://agentprime.io/advisories/GHSA-xxph-c9ww-hj94.md)
  `GHSA-xxph-c9ww-hj94`, `CVE-2026-102554` · Maven `com.google.guava:guava`: affected `>=4.0, <33.7.2`, fixed in `33.7.2` · CVSS 8.2 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service, Insecure deserialization
- [Frame poisoning in the CSS Parsing and Computation component](https://agentprime.io/advisories/CVE-2026-117933.md)
  `CVE-2026-117933` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service](https://agentprime.io/advisories/CVE-2026-117504.md)
  `CVE-2026-117504` · CVE record: a2aproject a2a-go · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [a2aproject a2a-go REST SSE handler rest.go resource consumption](https://agentprime.io/advisories/CVE-2026-117503.md)
  `CVE-2026-117503` · CVE record: a2aproject a2a-go · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop](https://agentprime.io/advisories/CVE-2026-117540.md)
  `CVE-2026-117540` · CVE record: darylldoyle svg-sanitizer · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity](https://agentprime.io/advisories/CVE-2026-116878.md)
  `CVE-2026-116878` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event](https://agentprime.io/advisories/CVE-2026-116877.md)
  `CVE-2026-116877` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters](https://agentprime.io/advisories/CVE-2026-116872.md)
  `CVE-2026-116872` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask](https://agentprime.io/advisories/CVE-2026-116871.md)
  `CVE-2026-116871` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Resource allocation without limits in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112671.md)
  `CVE-2026-112671` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service
- [Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder](https://agentprime.io/advisories/CVE-2026-116671.md)
  `CVE-2026-116671` · CVE record: Xpdf Xpdf · CVSS 2.1 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service, CWE-20

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTEwLTI2VDIwOjEwOjIwLjA2NzAwMFoiLCJDVkUtMjAyNi0xMTY2NzEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTEwLTI4VDE2OjM4OjA4LjUyNDAwMFoiLCJDVkUtMjAyNi0xMTExMDgiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTEwLTI4VDE2OjM4OjA4LjUyNDAwMFoiLCJDVkUtMjAyNi0xMTExMDgiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.