# Denial of service.

Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Pillow: Infinite loop in MIC n_frames when the embedded TIFF](https://agentprime.io/advisories/GHSA-22hg-r758-rrw9.md)
  `GHSA-22hg-r758-rrw9`, `BIT-pillow-2026-112390`, `CVE-2026-112390` · PyPI `pillow`: affected `>=7.2.0, <13.0.0`, fixed in `13.0.0` · CVSS 8.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Pillow: Quadratic GIF comment copying during save](https://agentprime.io/advisories/GHSA-fc9g-5qg7-mf45.md)
  `GHSA-fc9g-5qg7-mf45`, `BIT-pillow-2026-112891`, `CVE-2026-112891` · PyPI `pillow`: affected `>=9.2.0, <13.0.0`, fixed in `13.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout](https://agentprime.io/advisories/CVE-2026-111817.md)
  `CVE-2026-111817` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service](https://agentprime.io/advisories/CVE-2026-111810.md)
  `CVE-2026-111810` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion](https://agentprime.io/advisories/CVE-2026-111805.md)
  `CVE-2026-111805` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8](https://agentprime.io/advisories/CVE-2026-110803.md)
  `CVE-2026-110803` · CVE record: vaadin framework · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service, CWE-667
- [ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)](https://agentprime.io/advisories/GHSA-c9rx-x947-fp3h.md)
  `GHSA-c9rx-x947-fp3h`, `CVE-2026-113650` · npm `sanitize-html`: affected `>=2.18.0, <2.18.1`, fixed in `2.18.1` · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [ApostropheCMS: Import archives can exhaust server storage and deny service](https://agentprime.io/advisories/GHSA-9g7p-m758-rp72.md)
  `GHSA-9g7p-m758-rp72`, `CVE-2026-112955` · npm `@apostrophecms/import-export`: affected `<3.7.1`, fixed in `3.7.1` · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [pypdf: Possible infinite loop in PdfWriter.find_outline_item](https://agentprime.io/advisories/GHSA-qfv9-64jg-mh7p.md)
  `GHSA-qfv9-64jg-mh7p`, `CVE-2026-113792` · PyPI `pypdf`: affected `<6.20.1`, fixed in `6.20.1` · CVSS 6.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [pypdf: Possible infinite loop when removing tree items](https://agentprime.io/advisories/GHSA-9mx8-4j7g-633p.md)
  `GHSA-9mx8-4j7g-633p`, `CVE-2026-113793` · PyPI `pypdf`: affected `<6.20.1`, fixed in `6.20.1` · CVSS 6.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [pypdf: Possible infinite loop when hitting EOF in standard xref table](https://agentprime.io/advisories/GHSA-39mj-jf6j-2qj3.md)
  `GHSA-39mj-jf6j-2qj3`, `CVE-2026-113794` · PyPI `pypdf`: affected `<6.20.0`, fixed in `6.20.0` · CVSS 6.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [pypdf: Possible large memory usage for streams with multiple filters](https://agentprime.io/advisories/GHSA-7mh2-4gg2-979f.md)
  `GHSA-7mh2-4gg2-979f`, `CVE-2026-113795` · PyPI `pypdf`: affected `<6.20.0`, fixed in `6.20.0` · CVSS 6.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization](https://agentprime.io/advisories/GHSA-5588-rp99-5fjh.md)
  `GHSA-5588-rp99-5fjh`, `CVE-2026-113729`, `GO-2026-6826` · Go `github.com/moov-io/signedxml`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-76489.md)
  `CVE-2026-76489` · CVE record: Cisco Cisco Open Source Snort3 and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76491.md)
  `CVE-2026-76491` · CVE record: Cisco Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Multiple Cisco Products Snort 3 Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-76445.md)
  `CVE-2026-76445` · CVE record: Cisco Cisco Open Source Snort3 and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Multiple Cisco Products Snort 3 Software Hardening Release: October 2026](https://agentprime.io/advisories/CVE-2026-20356.md)
  `CVE-2026-20356` · CVE record: Cisco Cisco Cyber Vision and 3 more · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Multiple Cisco Products Snort 3 Netflow Denial of Service Vulnerabilities](https://agentprime.io/advisories/CVE-2026-20019.md)
  `CVE-2026-20019` · CVE record: Cisco Cisco Open Source Snort3 and 2 more · CVSS 5.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Pydantic AI Harness tool-call limit bypass in nested CodeMode calls](https://agentprime.io/advisories/GHSA-3589-pxp7-3gj8.md)
  `GHSA-3589-pxp7-3gj8`, `CVE-2026-114386` · PyPI `pydantic-ai-harness`: affected `<0.59.0`, fixed in `0.59.0` · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Reachable Assertion in ntpsec](https://agentprime.io/advisories/CVE-2026-102483.md)
  `CVE-2026-102483` · CVE record: NTPsec ntpsec · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export](https://agentprime.io/advisories/GHSA-86wm-68pq-5jwq.md)
  `GHSA-86wm-68pq-5jwq`, `CVE-2026-113711` · npm `apostrophe` and 1 more: affected `<4.33.0`, fixed in `4.33.0` · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Specific RPZ configurations and query patterns may result in an unexpected exit](https://agentprime.io/advisories/CVE-2026-97313.md)
  `CVE-2026-97313` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization](https://agentprime.io/advisories/CVE-2026-96888.md)
  `CVE-2026-96888` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption, Denial of service
- [Amplified resource exhaustion in inbound message processing](https://agentprime.io/advisories/CVE-2026-19630.md)
  `CVE-2026-19630` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof](https://agentprime.io/advisories/CVE-2026-86147.md)
  `CVE-2026-86147` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Denial of service
- [Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service](https://agentprime.io/advisories/CVE-2026-82425.md)
  `CVE-2026-82425` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser](https://agentprime.io/advisories/CVE-2026-82230.md)
  `CVE-2026-82230` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames](https://agentprime.io/advisories/CVE-2026-82210.md)
  `CVE-2026-82210` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request](https://agentprime.io/advisories/CVE-2026-81755.md)
  `CVE-2026-81755` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly](https://agentprime.io/advisories/CVE-2026-80463.md)
  `CVE-2026-80463` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes](https://agentprime.io/advisories/CVE-2026-78066.md)
  `CVE-2026-78066` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path](https://agentprime.io/advisories/CVE-2026-78058.md)
  `CVE-2026-78058` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service, Memory corruption
- [Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder](https://agentprime.io/advisories/CVE-2026-78048.md)
  `CVE-2026-78048` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count](https://agentprime.io/advisories/CVE-2026-74757.md)
  `CVE-2026-74757` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits](https://agentprime.io/advisories/CVE-2026-61902.md)
  `CVE-2026-61902` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation](https://agentprime.io/advisories/CVE-2026-58064.md)
  `CVE-2026-58064` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Out-of-Bounds Write in Redis Command Parser](https://agentprime.io/advisories/CVE-2026-56388.md)
  `CVE-2026-56388` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service, Memory corruption, CWE-252
- [Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser](https://agentprime.io/advisories/CVE-2026-56387.md)
  `CVE-2026-56387` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser](https://agentprime.io/advisories/CVE-2026-54427.md)
  `CVE-2026-54427` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser](https://agentprime.io/advisories/CVE-2026-54426.md)
  `CVE-2026-54426` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding](https://agentprime.io/advisories/CVE-2026-54425.md)
  `CVE-2026-54425` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver](https://agentprime.io/advisories/CVE-2026-41114.md)
  `CVE-2026-41114` · CVE record: Apache Software Foundation Apache IoTDB JDBC driver · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Aggregate DNS name chained pointer decompression work leads to degradation of service.](https://agentprime.io/advisories/CVE-2026-96405.md)
  `CVE-2026-96405` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers](https://agentprime.io/advisories/CVE-2026-114236.md)
  `CVE-2026-114236` · CVE record: Red Hat Confidential Compute Attestation and 4 more · CVSS 3.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()](https://agentprime.io/advisories/CVE-2026-111074.md)
  `CVE-2026-111074` · CVE record: Eclipse Foundation Eclipse OpenJ9 · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption, Denial of service
- [Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS](https://agentprime.io/advisories/CVE-2026-85642.md)
  `CVE-2026-85642` · CVE record: Unknown Formidable Forms · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs](https://agentprime.io/advisories/GHSA-3cgq-c484-rx5j.md)
  `GHSA-3cgq-c484-rx5j` · PyPI `vllm`: affected `>=0.7.3`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml](https://agentprime.io/advisories/CVE-2026-92822.md)
  `CVE-2026-92822` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in...](https://agentprime.io/advisories/GHSA-823j-m4cj-hmjf.md)
  `GHSA-823j-m4cj-hmjf`, `CVE-2026-114052`, `PYSEC-2026-4361` · PyPI `vllm`: affected `>=0.24.0, <0.31.0`, fixed in `0.31.0` · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [jackson-core 3.x async parser hex-digit accumulation bypasses maxNumberLength at chunk boundary](https://agentprime.io/advisories/GHSA-vvjm-vc27-799r.md)
  `GHSA-vvjm-vc27-799r`, `CVE-2026-110729` · Maven `tools.jackson.core:jackson-core`: affected `>=3.2.0, <=3.2.3`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [IBM Cyber Fraud Reachable Assertion](https://agentprime.io/advisories/CVE-2026-9825.md)
  `CVE-2026-9825` · CVE record: IBM CyberFraud · CVSS 3.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service](https://agentprime.io/advisories/CVE-2026-93441.md)
  `CVE-2026-93441` · CVE record: IBM QRadar Security Information and Event Management · CVSS 8.6 High · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key](https://agentprime.io/advisories/CVE-2026-85783.md)
  `CVE-2026-85783` · CVE record · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service, CWE-405
- [Uncontrolled resource consumption in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91664.md)
  `CVE-2026-91664` · CVE record: Oracle Corporation Oracle Essbase · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91660.md)
  `CVE-2026-91660` · CVE record: Oracle Corporation Oracle Essbase · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91582.md)
  `CVE-2026-91582` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 3.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91524.md)
  `CVE-2026-91524` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Oracle Database Server](https://agentprime.io/advisories/CVE-2026-91479.md)
  `CVE-2026-91479` · CVE record: Oracle Corporation Oracle Database Server · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-91435.md)
  `CVE-2026-91435` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [Improper resource shutdown in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-91427.md)
  `CVE-2026-91427` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 2.3 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/tag/dos.md>
Older: <https://agentprime.io/advisories/tag/dos.md?cursor=WyIyMDI2LTEwLTIwVDIxOjI1OjU0LjQ2MTAwMFoiLCJDVkUtMjAyNi05MTQyNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=dos&cursor=WyIyMDI2LTEwLTIxVDIwOjQyOjExLjAwMDAwMFoiLCJHSFNBLTc0cjItN2ZmOS1tamoyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/dos/?cursor=WyIyMDI2LTEwLTIxVDIwOjQyOjExLjAwMDAwMFoiLCJHSFNBLTc0cjItN2ZmOS1tamoyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.