Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServerApp.dll, TechnitiumLibrary.Net/Dns/DnsClient.cs components
- Denial of service
- CVSS 7.5 High
An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via supplying a crafted PSD file.
- Denial of service
- CVSS 7.5 High
ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition
- Denial of service
<14.14.0 · fixed in 14.14.0
GHSA-q62c-h75r-2xhc · CVE-2026-53460 - CVSS 5.5 Medium
ImageMagick Vulnerable to Stack Overflow in its MVG Decoder
- Denial of service
<14.14.0 · fixed in 14.14.0
GHSA-h36c-3666-h489 · CVE-2026-48734 - CVSS 4.7 Medium
ImageMagick has an Infinite Loop in subimage-search with crafted image
- Denial of service
<14.14.0 · fixed in 14.14.0
GHSA-5v62-8fq6-cp9m · CVE-2026-48733 - CVSS 7.5 High
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
- Denial of service
>=0.3.0, <1.5.2 · fixed in 1.5.2
GHSA-47q9-m4ww-924m · CVE-2026-48702 - CVSS 6.3 Medium
MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings
- Denial of service
<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7
GHSA-q2h6-ghwm-5qm8 · CVE-2026-48516 - CVSS 6.3 Medium
MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions
- Denial of service
<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7
GHSA-cxmj-83gh-fp49 · CVE-2026-48515 - CVSS 6.3 Medium
MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length
- Denial of service
<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7
GHSA-w567-gjr2-hm5j · CVE-2026-48514 - CVSS 6.3 Medium
MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement
- Denial of service
<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7
GHSA-wfr3-xj75-pfwh · CVE-2026-48513 - CVSS 6.3 Medium
MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement
- Denial of service
<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7
GHSA-cj9g-3mj2-g8vv · CVE-2026-48512 - CVSS 6.3 Medium
MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps
- Denial of service
<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7
GHSA-2x83-8g95-xh59 · CVE-2026-48511 - CVSS 6.3 Medium
MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
- Denial of service
- CWE-409
<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7
GHSA-v72x-2h86-7f8m · CVE-2026-48510 - CVSS 7.5 High
MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
- Denial of service
<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7
GHSA-vh6j-jc39-fggf · CVE-2026-48506 - CVSS 5.3 Medium
opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation
- Denial of service
<0.32.1 · fixed in 0.32.1
GHSA-w9wp-h8wv-79jx · CVE-2026-48504 - CVSS 8.2 High
MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
- Memory corruption
- Denial of service
>=3.0, <3.1.7 · fixed in 3.1.7
GHSA-382j-8mxh-c7x2 · CVE-2026-48502 - CVSS 6.8 Medium
jq: stack overflow in deep structural equality
- jq
- Denial of service
- CVSS 7.5 High
net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets
- Zephyr
- Denial of service
- CVSS 6.5 Medium
LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits
- danny-avila LibreChat
- Denial of service
- CVSS 6.5 Medium
LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork
- danny-avila LibreChat
- Denial of service
- CVSS 6.9 Medium
Reachable assertion in Schneider Electric PowerLogic™ P7
- Schneider Electric PowerLogic™ P7
- Denial of service
- CVSS 7.1 High
Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2
- Silicon Labs EmberZNet
- Denial of service
- CVSS 7.1 High
Level Control Move divide-by-zero in EmberZNet v9.0.2
- Silicon Labs EmberZNet
- Denial of service
- CVSS 7.1 High
Color Control color-temperature assertion abort in EmberZNet v9.0.2
- Silicon Labs EmberZNet
- Denial of service
- CVSS 7.1 High
Color Control hue/saturation assertion abort in EmberZNet v9.0.2
- Silicon Labs EmberZNet
- Denial of service
- CVSS 5.3 Medium
Denial of service via crafted DoH3 queries
- PowerDNS DNSdist
- Denial of service
- CVSS 5.3 Medium
Denial of service via IXFR queries
- PowerDNS DNSdist
- Denial of service
- CVSS 4.3 Medium
Insufficient input validation of internal web server
- PowerDNS Authoritative
- Denial of service
- CVSS 7.5 High
net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
- Linux kernel
- Denial of service
- CVSS 7.5 High
mptcp: allow subflow rcv wnd to shrink
- Linux kernel
- Denial of service
- CVSS 7.5 High
timers/migration: Fix livelock in tmigr_handle_remote_up()
- Linux kernel
- Denial of service
- CVSS 7.1 High
vsock/virtio: fix potential unbounded skb queue
- Linux kernel
- Denial of service
- CVSS 7.5 High
A reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted string.
- Denial of service
- CVSS 7.5 High
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Denial of service
- CVSS 6.5 Medium
Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control
- zephyr
- Denial of service
- CVSS 7.5 High
Sentry: Inefficient Regular Expression Complexity in sentry
- sentry
- Denial of service
- CVSS 7.7 High
AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 7.1 High
Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200
- TP-Link Systems Inc. Tapo C200 v3
- Denial of service
- CVSS 7.5 High
neigh: let neigh_xmit take skb ownership
- Linux kernel
- Denial of service
- CVSS 7.5 High
net: tls: fix strparser anchor skb leak on offload RX setup failure
- Linux kernel
- Denial of service
- CVSS 7.5 High
ceph: put folios not suitable for writeback
- Linux kernel
- Denial of service
- CVSS 5.9 Medium
Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
- Denial of service
<8.6.0 · fixed in 8.6.0
GHSA-mr8g-2mj4-pcq2 · CVE-2026-49870 - CVSS 6.2 Medium
opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
- Denial of service
>=0.0.202527, <0.0.202622 · fixed in 0.0.202622
GHSA-f2r5-5m7w-p5cx · CVE-2026-48496 - CVSS 8.2 High
tarfile opened in streaming mode mishandles EOF
- Python Software Foundation CPython
- Denial of service
- CWE-252
- CVSS 6.3 Medium
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
- Denial of service
>=2.10.0, <2.14.0 · fixed in 2.14.0
GHSA-3wrr-7qpf-2prh · CVE-2026-50193 - CVSS 7.1 High
MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering
- ArtifexSoftware mupdf
- Denial of service
- CVSS 5.5 Medium
Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)
- Denial of service
<0.14.3 · fixed in 0.14.3
GHSA-xp79-5mx3-jx52 · CVE-2026-52814 - CVSS 7.1 High
dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling
- NetworkConfiguration dhcpcd
- Denial of service
- CVSS 0.0 None
Duplicate Advisory: ImageMagick: Memory leak in coders/txt.c without freetype
- Denial of service
<14.10.3 · fixed in 14.10.3
GHSA-98gv-6gmj-cm6m - CVSS 7.5 High
Duplicate Advisory: Traefik vulnerable to HTTP/2 request causing denial of service
- Denial of service
<2.10.5 · fixed in 2.10.5
GHSA-pvrg-q6jw-42p7 - CVSS 8.7 High
Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy
- Cap-go capgo
- Denial of service
- CVSS 7.5 High
An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- SQL injection
- Denial of service
- CVSS 7.5 High
An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- SQL injection
- Denial of service
- CVSS 7.1 High
Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)
- zephyr
- Denial of service
- CWE-20
-
skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery
- Path traversal
- Command injection
<0.1.3 · fixed in 0.1.3
GHSA-74p7-6h78-gw8p - CVSS 7.1 High
Gophish contains a denial of service vulnerability
- Denial of service
<=0.12.1 · no fixed version yet
GHSA-42jc-v69j-g38f · CVE-2026-39904 - CVSS 8.8 High
Capgo - Rate Limit Bypass via User-Controlled device_id Parameter
- Capgo
- Denial of service
- CVSS 5.3 Medium
Capgo - Denial of Service via Unlimited Demo App Creation
- Capgo
- Denial of service
- CVSS 7.5 High
Grafana: Pre-authentication denial of service in the public dashboard query handler
- Denial of service
<1.9.2-0.20260616075434-82ef13993059 || >=2.0.0-beta1 || >=12.0.0 || >=12.3.0 || >=12.4.0 || >=13.0.0 · fixed in 1.9.2-0.20260616075434-82ef13993059
GHSA-3w66-95m3-8jxg · CVE-2026-42127 - CVSS 5.9 Medium
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Denial of service