# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication](https://agentprime.io/advisories/CVE-2026-119278.md) `CVE-2026-119278` · CVE record: mariadb-corporation mariadb-connector-j · CVSS 5.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service, CWE-129 - [Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer](https://agentprime.io/advisories/CVE-2026-119191.md) `CVE-2026-119191` · CVE record: digitalbazaar forge · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs](https://agentprime.io/advisories/GHSA-qr28-fpjm-wq7f.md) `GHSA-qr28-fpjm-wq7f`, `CVE-2026-118664` · npm `decode-uri-component`: affected `<0.5.1`, fixed in `0.5.1` · CVSS 8.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset](https://agentprime.io/advisories/GHSA-vpp8-g58w-m8mp.md) `GHSA-vpp8-g58w-m8mp` · PyPI `twisted`: affected `<26.10.0rc1`, fixed in `26.10.0rc1` · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size](https://agentprime.io/advisories/GHSA-9hj8-73fh-9963.md) `GHSA-9hj8-73fh-9963`, `CVE-2026-115907` · crates.io `zip`: affected `>=5.1.0, <9.0.0`, fixed in `9.0.0` · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction](https://agentprime.io/advisories/GHSA-q7v9-x93c-xqv3.md) `GHSA-q7v9-x93c-xqv3`, `CVE-2026-115909`, `RUSTSEC-2026-0429` · crates.io `zip`: affected `>=1.3.0, <9.0.0`, fixed in `9.0.0` · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Crass: Non-ASCII characters cause superlinear CPU consumption](https://agentprime.io/advisories/GHSA-8vfg-2r28-hvhj.md) `GHSA-8vfg-2r28-hvhj`, `CVE-2026-61848` · RubyGems `crass`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Crass: A large number of adjacent CSS comments can trigger a SystemStackError](https://agentprime.io/advisories/GHSA-wwpr-jff3-395c.md) `GHSA-wwpr-jff3-395c`, `CVE-2026-61847` · RubyGems `crass`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage](https://agentprime.io/advisories/GHSA-6jxj-px6v-747w.md) `GHSA-6jxj-px6v-747w`, `CVE-2026-61846` · RubyGems `crass`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Daptin: ParseAcceptLanguage \`\_\` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware](https://agentprime.io/advisories/GHSA-rhj7-vh3v-mcq6.md) `GHSA-rhj7-vh3v-mcq6`, `CVE-2026-62160`, `GO-2026-6890` · Go `github.com/daptin/daptin`: affected `<=0.12.15`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder](https://agentprime.io/advisories/CVE-2026-119123.md) `CVE-2026-119123` · CVE record: ImageMagick ImageMagick · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields](https://agentprime.io/advisories/CVE-2026-119119.md) `CVE-2026-119119` · CVE record: unclecode crawl4ai · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90870.md) `CVE-2026-90870` · CVE record: Progress Software WS_FTP Server · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Resource exhaustion from RPC sessions kept for requests to unknown interface](https://agentprime.io/advisories/CVE-2026-115793.md) `CVE-2026-115793` · CVE record: RT-Labs P-Net · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness](https://agentprime.io/advisories/CVE-2026-112200.md) `CVE-2026-112200` · CVE record: RT-Labs P-Net · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Infinite loop when reading PDPortDataCheck record of subslot 0](https://agentprime.io/advisories/CVE-2026-111731.md) `CVE-2026-111731` · CVE record: RT-Labs P-Net · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-90991.md) `CVE-2026-90991` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys](https://agentprime.io/advisories/CVE-2026-119051.md) `CVE-2026-119051` · CVE record: hughsk flat · CVSS 8.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing](https://agentprime.io/advisories/CVE-2019-25781.md) `CVE-2019-25781` · CVE record: Python-Markdown Markdown · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation](https://agentprime.io/advisories/CVE-2026-93007.md) `CVE-2026-93007` · CVE record: Red Hat Red Hat Ceph Storage 9 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash](https://agentprime.io/advisories/CVE-2026-105042.md) `CVE-2026-105042` · CVE record: Apache Software Foundation Apache Qpid Proton C · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [nipy nibabel Header volumeutils.py array_from_file memory allocation](https://agentprime.io/advisories/CVE-2026-118590.md) `CVE-2026-118590` · CVE record: nipy nibabel · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service - [nschloe meshio VTK Reader \_vtk_42.py memory allocation](https://agentprime.io/advisories/CVE-2026-118589.md) `CVE-2026-118589` · CVE record: nschloe meshio · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks](https://agentprime.io/advisories/GHSA-r4j5-9xpp-3985.md) `GHSA-r4j5-9xpp-3985`, `CVE-2026-115927` · PyPI `tornado`: affected `<6.6`, fixed in `6.6` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [Tornado: Quadratic CPU usage when parsing HTTP headers with line folding](https://agentprime.io/advisories/GHSA-pcg2-g6cj-q92c.md) `GHSA-pcg2-g6cj-q92c`, `CVE-2026-116577` · PyPI `tornado`: affected `<6.6`, fixed in `6.6` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion](https://agentprime.io/advisories/GHSA-2hw4-c9m4-f2fj.md) `GHSA-2hw4-c9m4-f2fj`, `CVE-2026-54462`, `GO-2026-6880` · Go `knative.dev/pkg`: affected `<0.0.0-20260531000007-52dbd5ece63f`, fixed in `0.0.0-20260531000007-52dbd5ece63f` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)](https://agentprime.io/advisories/GHSA-97r2-qh9m-474h.md) `GHSA-97r2-qh9m-474h`, `CVE-2026-116581` · npm `seroval`: affected `<1.6.8`, fixed in `1.6.8` · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-1284 - [Seroval \`fromJSON\`/\`fromCrossJSON\` denial of service via unvalidated array node length](https://agentprime.io/advisories/GHSA-wp97-x4hv-qvhp.md) `GHSA-wp97-x4hv-qvhp`, `CVE-2026-116584` · npm `seroval`: affected `>=1.4.1, <1.6.8`, fixed in `1.6.8` · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs](https://agentprime.io/advisories/GHSA-q69g-f4f5-v8m7.md) `GHSA-q69g-f4f5-v8m7`, `CVE-2026-115922` · PyPI `onnx`: affected `<1.22.0`, fixed in `1.22.0` · CVSS 6.2 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine](https://agentprime.io/advisories/GHSA-8397-8qf6-f2gm.md) `GHSA-8397-8qf6-f2gm`, `CVE-2026-115913` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [vLLM DeepSeek-OCR image processing vulnerable to denial of service](https://agentprime.io/advisories/GHSA-gq5q-89c7-vhvx.md) `GHSA-gq5q-89c7-vhvx`, `CVE-2026-115914` · PyPI `vllm`: affected `>=0.11.1, <0.32.0`, fixed in `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs](https://agentprime.io/advisories/GHSA-x567-49g5-p4cf.md) `GHSA-x567-49g5-p4cf`, `CVE-2026-115918`, `PYSEC-2026-4349` · PyPI `vllm`: affected `>=0.16.0, <0.32.0`, fixed in `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool](https://agentprime.io/advisories/GHSA-542m-9234-8gvf.md) `GHSA-542m-9234-8gvf`, `CVE-2026-115911`, `PYSEC-2026-4344` · PyPI `vllm`: affected `>=0.19.0, <0.32.0`, fixed in `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [Go JOSE: Panics in JSON parsing](https://agentprime.io/advisories/GHSA-vvm8-gf78-28g4.md) `GHSA-vvm8-gf78-28g4`, `CVE-2026-116586` · Go `github.com/go-jose/go-jose/v3` and 1 more: affected `<=3.0.5`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service](https://agentprime.io/advisories/GHSA-x8rm-f576-gq67.md) `GHSA-x8rm-f576-gq67`, `CVE-2026-115887` · npm `graphql-scalars`: affected `>=1.24.1, <2.0.1`, fixed in `2.0.1` · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations](https://agentprime.io/advisories/CVE-2026-118694.md) `CVE-2026-118694` · CVE record: trentm python-markdown2 · CVSS 8.7 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length](https://agentprime.io/advisories/CVE-2026-118689.md) `CVE-2026-118689` · CVE record: OvenMediaLabs OvenMediaEngine · CVSS 8.7 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)](https://agentprime.io/advisories/GHSA-pjh6-c8mg-3x7m.md) `GHSA-pjh6-c8mg-3x7m`, `CVE-2026-116579` · PyPI `autobahn`: affected `>=26.7.1, <26.10.1`, fixed in `26.10.1` · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-409 - [RE2JS: Quadratic-time denial of service in re2js lookbehind matching](https://agentprime.io/advisories/GHSA-gg6h-894w-4m9c.md) `GHSA-gg6h-894w-4m9c`, `CVE-2026-116795` · npm `re2js`: affected `>=2.2.0, <2.8.7`, fixed in `2.8.7` · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout](https://agentprime.io/advisories/GHSA-cwqr-hh33-gh44.md) `GHSA-cwqr-hh33-gh44`, `CVE-2026-112915` · PyPI `filelock`: affected `>=3.20.4, <4.2.1`, fixed in `4.2.1` · CVSS 5.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing](https://agentprime.io/advisories/GHSA-ccrj-gw8r-854m.md) `GHSA-ccrj-gw8r-854m`, `CVE-2026-118259` · Maven `io.opentelemetry:opentelemetry-api`: affected `<1.67.0`, fixed in `1.67.0` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex](https://agentprime.io/advisories/CVE-2026-118686.md) `CVE-2026-118686` · CVE record: espocrm espocrm · CVSS 8.7 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node](https://agentprime.io/advisories/CVE-2026-118646.md) `CVE-2026-118646` · CVE record: n8n-io n8n · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion](https://agentprime.io/advisories/CVE-2026-116273.md) `CVE-2026-116273` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-1188 - [MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords](https://agentprime.io/advisories/CVE-2026-116270.md) `CVE-2026-116270` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters](https://agentprime.io/advisories/CVE-2026-116268.md) `CVE-2026-116268` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message](https://agentprime.io/advisories/CVE-2026-116267.md) `CVE-2026-116267` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()](https://agentprime.io/advisories/CVE-2026-105614.md) `CVE-2026-105614` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 4.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions](https://agentprime.io/advisories/CVE-2026-105613.md) `CVE-2026-105613` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 4.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies](https://agentprime.io/advisories/CVE-2026-117501.md) `CVE-2026-117501` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload](https://agentprime.io/advisories/CVE-2026-117500.md) `CVE-2026-117500` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies](https://agentprime.io/advisories/CVE-2026-116285.md) `CVE-2026-116285` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block](https://agentprime.io/advisories/CVE-2026-116134.md) `CVE-2026-116134` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary](https://agentprime.io/advisories/CVE-2026-116133.md) `CVE-2026-116133` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts](https://agentprime.io/advisories/CVE-2026-116131.md) `CVE-2026-116131` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service - [Server-side expression parser denial of service](https://agentprime.io/advisories/CVE-2026-88858.md) `CVE-2026-88858` · CVE record: Grafana Grafana OSS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-20 - [Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches](https://agentprime.io/advisories/CVE-2026-114349.md) `CVE-2026-114349` · CVE record: Apache Software Foundation Apache Kafka · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-1284 - [Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation](https://agentprime.io/advisories/CVE-2026-111551.md) `CVE-2026-111551` · CVE record: Apache Software Foundation Apache Kafka · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-20 - [Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation](https://agentprime.io/advisories/CVE-2026-111496.md) `CVE-2026-111496` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption, Denial of service - [Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers](https://agentprime.io/advisories/CVE-2026-111108.md) `CVE-2026-111108` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .