# Denial of service. Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [remote abort and memory disclosure from a malformed cursor.ns](https://agentprime.io/advisories/CVE-2026-120956.md) `CVE-2026-120956` · CVE record: MongoDB C Driver · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)](https://agentprime.io/advisories/CVE-2026-120678.md) `CVE-2026-120678` · CVE record: MongoDB C Driver · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-115716.md) `CVE-2026-115716` · CVE record: Elastic APM Server · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-115715.md) `CVE-2026-115715` · CVE record: Elastic Elasticsearch · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Uncontrolled Recursion in Elasticsearch Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-115290.md) `CVE-2026-115290` · CVE record: Elastic Elasticsearch · CVSS 7.5 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [phpMyAdmin ShapeFile SHP File loadFromFile infinite loop](https://agentprime.io/advisories/CVE-2026-121261.md) `CVE-2026-121261` · CVE record: phpMyAdmin ShapeFile · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Potential memory exhaustion in MultiPartParser via base64-encoded file upload](https://agentprime.io/advisories/CVE-2026-108147.md) `CVE-2026-108147` · CVE record: djangoproject Django · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser](https://agentprime.io/advisories/CVE-2026-118487.md) `CVE-2026-118487` · CVE record: Eclipse Foundation Eclipse Vert.x · CVSS 7.5 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions](https://agentprime.io/advisories/CVE-2026-119741.md) `CVE-2026-119741` · CVE record: RsyncProject rsync · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client](https://agentprime.io/advisories/CVE-2026-118488.md) `CVE-2026-118488` · CVE record: Eclipse Foundation Eclipse Vert.x · CVSS 5.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph](https://agentprime.io/advisories/CVE-2026-121444.md) `CVE-2026-121444` · CVE record: darylldoyle svg-sanitizer · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing](https://agentprime.io/advisories/CVE-2026-121438.md) `CVE-2026-121438` · CVE record: lepture mistune · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via \_process_emphasis_delimiters](https://agentprime.io/advisories/CVE-2026-121437.md) `CVE-2026-121437` · CVE record: lepture mistune · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization](https://agentprime.io/advisories/CVE-2026-121423.md) `CVE-2026-121423` · CVE record: surrealdb surrealdb · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly](https://agentprime.io/advisories/CVE-2026-121412.md) `CVE-2026-121412` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2](https://agentprime.io/advisories/CVE-2026-121410.md) `CVE-2026-121410` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token](https://agentprime.io/advisories/CVE-2026-121409.md) `CVE-2026-121409` · CVE record: FreeRDP FreeRDP · CVSS 8.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload](https://agentprime.io/advisories/CVE-2026-121406.md) `CVE-2026-121406` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control](https://agentprime.io/advisories/CVE-2026-121405.md) `CVE-2026-121405` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA](https://agentprime.io/advisories/CVE-2026-121404.md) `CVE-2026-121404` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP](https://agentprime.io/advisories/CVE-2026-121403.md) `CVE-2026-121403` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet](https://agentprime.io/advisories/CVE-2026-121400.md) `CVE-2026-121400` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length](https://agentprime.io/advisories/CVE-2026-121399.md) `CVE-2026-121399` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertion](https://agentprime.io/advisories/CVE-2026-121396.md) `CVE-2026-121396` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder](https://agentprime.io/advisories/CVE-2026-121395.md) `CVE-2026-121395` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder](https://agentprime.io/advisories/CVE-2026-121394.md) `CVE-2026-121394` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion](https://agentprime.io/advisories/CVE-2026-121393.md) `CVE-2026-121393` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE](https://agentprime.io/advisories/CVE-2026-121391.md) `CVE-2026-121391` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response](https://agentprime.io/advisories/CVE-2026-121390.md) `CVE-2026-121390` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging](https://agentprime.io/advisories/CVE-2026-121389.md) `CVE-2026-121389` · CVE record: FreeRDP FreeRDP · CVSS 2.3 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST](https://agentprime.io/advisories/CVE-2026-121388.md) `CVE-2026-121388` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Missing Release of Memory after Effective Lifetime in µD3TN](https://agentprime.io/advisories/CVE-2026-121512.md) `CVE-2026-121512` · CVE record: D3TN GmbH µD3TN · CVSS 7.5 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter](https://agentprime.io/advisories/CVE-2026-89295.md) `CVE-2026-89295` · CVE record: Eclipse Foundation Eclipse Mnestix · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Divide by zero in NVIDIA CUDA Toolkit and others](https://agentprime.io/advisories/CVE-2026-65160.md) `CVE-2026-65160` · CVE record: NVIDIA CUDA Toolkit and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.](https://agentprime.io/advisories/CVE-2026-108048.md) `CVE-2026-108048` · CVE record: AM System ALO Suite · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags](https://agentprime.io/advisories/CVE-2026-119843.md) `CVE-2026-119843` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [Apache JClouds: XML External Entity (XXE) in provider-response parsing](https://agentprime.io/advisories/CVE-2026-119724.md) `CVE-2026-119724` · CVE record: Apache Software Foundation Apache JClouds · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool](https://agentprime.io/advisories/CVE-2026-115215.md) `CVE-2026-115215` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Google Android](https://agentprime.io/advisories/CVE-2026-49924.md) `CVE-2026-49924` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()](https://agentprime.io/advisories/CVE-2026-119738.md) `CVE-2026-119738` · CVE record: Nexbox A95X and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [Uncontrolled Recursion in HDF5 H5B\_\_iterate_helper() via Crafted File](https://agentprime.io/advisories/CVE-2026-120689.md) `CVE-2026-120689` · CVE record: The HDF Group HDF5 · CVSS 4.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [CVE-2026-120596](https://agentprime.io/advisories/CVE-2026-120596.md) `CVE-2026-120596` · CVE record: Ethernut / egnite GmbH Nut/Net TCP/IP Stack · CVSS 7.5 High · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation](https://agentprime.io/advisories/CVE-2026-118052.md) `CVE-2026-118052` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 6.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service, CWE-667 - [Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser](https://agentprime.io/advisories/CVE-2026-120458.md) `CVE-2026-120458` · CVE record: Ultra Video Group Kvazaar · CVSS 6.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [QuickJS-NG before 0.16.0 Memory Leak via Atomics.store](https://agentprime.io/advisories/CVE-2026-120440.md) `CVE-2026-120440` · CVE record: quickjs-ng QuickJS-NG · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [@fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers](https://agentprime.io/advisories/CVE-2026-117531.md) `CVE-2026-117531` · CVE record: @fastify/multipart @fastify/multipart · CVSS 5.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Huawei HarmonyOS](https://agentprime.io/advisories/CVE-2026-101174.md) `CVE-2026-101174` · CVE record: Huawei HarmonyOS · CVSS 5.7 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [Uncontrolled resource consumption in Huawei HarmonyOS](https://agentprime.io/advisories/CVE-2026-101173.md) `CVE-2026-101173` · CVE record: Huawei HarmonyOS · CVSS 6.5 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [Uncontrolled recursion in Huawei HarmonyOS](https://agentprime.io/advisories/CVE-2026-101180.md) `CVE-2026-101180` · CVE record: Huawei HarmonyOS · CVSS 4.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [Reachable assertion in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20600.md) `CVE-2026-20600` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [Reachable assertion in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20593.md) `CVE-2026-20593` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server.](https://agentprime.io/advisories/CVE-2026-106806.md) `CVE-2026-106806` · CVE record · CVSS 7.5 High · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling.](https://agentprime.io/advisories/CVE-2026-106805.md) `CVE-2026-106805` · CVE record · CVSS 7.5 High · Not analysed yet · Published 2 Nov 2026 · Tags: Denial of service - [Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource](https://agentprime.io/advisories/CVE-2026-84170.md) `CVE-2026-84170` · CVE record: Apache Software Foundation Apache Wicket · CVSS 8.3 High · Not analysed yet · Published 1 Nov 2026 · Tags: Denial of service - [Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names](https://agentprime.io/advisories/CVE-2026-83594.md) `CVE-2026-83594` · CVE record: Apache Software Foundation Apache Wicket · CVSS 8.3 High · Not analysed yet · Published 1 Nov 2026 · Tags: Denial of service - [ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumption](https://agentprime.io/advisories/CVE-2026-120237.md) `CVE-2026-120237` · CVE record: ag-ui-protocol ag-ui · CVSS 5.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Denial of service - [ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption](https://agentprime.io/advisories/CVE-2026-120235.md) `CVE-2026-120235` · CVE record: ag-ui-protocol ag-ui · CVSS 5.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Denial of service - [ag-ui-protocol ag-ui HTTP Transport e.text resource consumption](https://agentprime.io/advisories/CVE-2026-120234.md) `CVE-2026-120234` · CVE record: ag-ui-protocol ag-ui · CVSS 5.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Denial of service - [Gitea Helm chart upload decompression denial of service](https://agentprime.io/advisories/CVE-2026-117677.md) `CVE-2026-117677` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Denial of service, CWE-409 - [Delgan loguru ANSI Color-Markup \_colorizer.py AnsiParser.feed redos](https://agentprime.io/advisories/CVE-2026-120217.md) `CVE-2026-120217` · CVE record: Delgan loguru · CVSS 5.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .