Denial of service.

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

• Denial of service

<6.12.2 · fixed in 6.12.2

pypdf: Manipulated XMP metadata streams can exhaust RAM

• Denial of service

<6.12.1 · fixed in 6.12.1

Rockwell Automation Logix 5370 and 5570 Controllers Vulnerable To Denial of Service Via CIP

• Rockwell Automation CompactLogix, ControlLogix
• Denial of service

Denial-of-service in the Graphics: ImageLib component

• Mozilla Firefox
• Mozilla Thunderbird
• Denial of service

Denial-of-service in the Audio/Video: Playback component

• Mozilla Firefox
• Mozilla Thunderbird
• Denial of service

Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc

• Insecure deserialization
• Denial of service

>=0.4.0, <1.0.0 · fixed in 1.0.0

Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc

• Denial of service

>=0.3.0-alpha.2, <1.0.0 · fixed in 1.0.0

linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request

• Denial of service

<=2.3.8 · no fixed version yet

Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

• Denial of service

>=3.1.0, <=3.1.11 · no fixed version yet

Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

• Denial of service

>=4.2.0.Final, <4.2.15.Final · fixed in 4.2.15.Final

markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

• Denial of service

<14.2.0 · fixed in 14.2.0

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

• Denial of service

>=0.4.1, <1.3.1 · fixed in 1.3.1

OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

• Denial of service

<2.8.0 · fixed in 2.8.0

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

• Denial of service

<0.0.30 · fixed in 0.0.30

UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

• Denial of service

>=2.0.1, <2.0.10 · fixed in 2.0.10

protobufjs: Memory amplification from preserved unknown fields in binary decode

• Denial of service

>=8.2.0, <8.5.0 · fixed in 8.5.0

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

• Denial of service
• Memory corruption

>=8.0.0, <8.0.28 || >=9.0.0, <9.0.17 || >=10.0.0, <10.0.9 · fixed in 8.0.28, 9.0.17, 10.0.9

aiohttp: Incomplete websocket frame payloads bypass memory limits

• Denial of service

<3.14.1 · fixed in 3.14.1

aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

• Denial of service

<3.14.1 · fixed in 3.14.1

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

• Denial of service

<3.14.1 · fixed in 3.14.1

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

• Denial of service

<3.14.1 · fixed in 3.14.1

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

• Denial of service

>=2.8.0, <2.13.0 · fixed in 2.13.0

Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

protobufjs: Denial of service through unbounded Any expansion during JSON conversion

• Denial of service

<7.6.1 || >=8.0.0, <8.4.1 · fixed in 7.6.1, 8.4.1

protobufjs : Schema-derived names can shadow runtime-significant properties

• Denial of service
• CWE-754

<7.6.3 || >=8.0.0, <8.6.0 · fixed in 7.6.3, 8.6.0

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

• Denial of service

<=19.2.25 || >=20.0.0-next.0, <20.3.25 || >=21.0.0-next.0, <21.2.17 || >=22.0.0-next.0, <22.0.1 · fixed in 20.3.25, 21.2.17, 22.0.1

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

• Denial of service

<3.15.0 || >=4.0.0, <4.2.0 · fixed in 3.15.0, 4.2.0

@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

• Denial of service

<=18.2.14 || >=19.0.0-next.0, <19.2.23 || >=20.0.0-next.0, <20.3.22 || >=21.0.0-next.0, <21.2.15 || >=22.0.0-next.0, <22.0.0-rc.2 · fixed in 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2

ws: Memory exhaustion DoS from tiny fragments and data chunks

• Denial of service
• CWE-1050

>=1.1.0, <5.2.5 || >=6.0.0, <6.2.4 || >=7.0.0, <7.5.11 || >=8.0.0, <8.21.0 · fixed in 5.2.5, 6.2.4, 7.5.11, 8.21.0

Overly long URLs crash the Mattermost Desktop App

• Mattermost
• Denial of service

Leak in WASIp1 `fd_renumber` implementation

• Denial of service

Published by the maintainers · not yet reviewed by GitHub

>=0.0.0-0, <24.0.10 || >=25.0.0, <36.0.11 || >=37.0.0, <44.0.3 || >=45.0.0, <45.0.2 · fixed in 24.0.10, 36.0.11, 44.0.3, 45.0.2

An input handling flaw in the HTTP refresh token process of LLDAP v0.6.2 allows attackers to cause a Denial of Service (DoS) via sending a crafted refresh-token header.

• Denial of service

An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

• Denial of service

An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted request.

• Denial of service

An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service (DoS) via a crafted request or payload.

• Denial of service

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c).

• Denial of service

Avast antivirus stack overflow when scanning a malformed PDF file

• Gen Digital Avast Antivirus
• Gen Digital AVG Antivirus
• Denial of service

Avast antivirus infinite recursion when scanning a malformed PE file

• Gen Digital Avast Antivirus
• Gen Digital AVG Antivirus
• Denial of service

File Browser has a DoS Vulnerability via Public Login API

• Denial of service
• CWE-1284

<=1.11.0 · no fixed version yet

ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing

• Memory corruption
• Denial of service

<=0.3.0 · no fixed version yet

ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation

• Denial of service
• CWE-20

<=0.3.0 · no fixed version yet

Qiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain classical expressions.

• IBM Qiskit SDK
• Denial of service

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

• Denial of service

<6.12.0 · fixed in 6.12.0

pypdf: Possible large memory usage for large offsets for layout mode text

• Denial of service

<6.12.0 · fixed in 6.12.0

opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response

• open-telemetry opentelemetry-cpp
• Denial of service

Apache cxf-core: No restriction on attachment headers per message

• Denial of service

>=4.2.0, <4.2.2 || >=4.0.0, <4.1.7 || <3.6.12 · fixed in 4.2.2, 4.1.7, 3.6.12

Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown

• duck-organization questbot
• Denial of service

Idira Privileged Access Manager (PAM) Self-Hosted Vault: Denial of Service due to Unexpected Input Processing

• CyberArk Software, a Palo Alto Networks Company PAM SH Vault
• Denial of service

PingDirectory copying of virtual attributes leads to memory exhaustion

• Ping Identity PingDirectory
• Denial of service

@steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses

• Denial of service

<0.17.0 · fixed in 0.17.0

Idira Endpoint Privilege Manager Linux Agent: Potential bypass of Agent Daemon Initialization

• CyberArk Software, a Palo Alto Networks Company Idira Endpoint Privilege Manager
• Denial of service

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

• Denial of service
• CWE-1286

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

• Information disclosure
• Authentication bypass

<0.0.0-20260520170331-32a4091fb949 · fixed in 0.0.0-20260520170331-32a4091fb949

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

• Denial of service

<0.149.12 · fixed in 0.149.12

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

• Denial of service

<4.1.135.Final || >=4.2.0.Alpha1, <4.2.15.Final · fixed in 4.1.135.Final, 4.2.15.Final

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

• Denial of service
• CWE-248

<1.9.16 || >=1.10.0, <1.10.12 || >=1.11.0, <1.11.4 || >=1.12.0, <1.12.7 || >=1.13.0, <1.13.5 || >=1.14.0, <1.14.4 · fixed in 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4

joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

• Denial of service
• CWE-248

<17.13.4 || >=18.0.0, <18.2.1 · fixed in 17.13.4, 18.2.1

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final