Denial of service.

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption

• IBM WebSphere Application Server
• IBM WebSphere Application Server - Liberty
• Denial of service

Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

• IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Denial of service

Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

• Denial of service

>=0.0.0-0, <0.11.15 · fixed in 0.11.15

Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service

• Denial of service

>=0.6.3, <0.9.0 · fixed in 0.9.0

SurrealDB: Denial of Service via deep operator chains

• Denial of service

>=3.0.0, <3.1.5 · fixed in 3.1.5

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

• Path traversal
• Denial of service

>=2.12.0, <2.14.2 · fixed in 2.14.2

SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

• Denial of service

<1.7.1 · fixed in 1.7.1

OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

• Denial of service

<0.0.0-20260617104123-db57c62602b2 || >=0.1.0, <=2.5.4 · fixed in 0.0.0-20260617104123-db57c62602b2

Grafana Tempo vulnerable to an out-of-memory crash

• Denial of service

<1.5.1-0.20260303204923-b13f74291d48 · fixed in 1.5.1-0.20260303204923-b13f74291d48

Langflow: Unauthenticated DoS through multipart form boundary file upload

• Denial of service

<1.0.19 · fixed in 1.0.19

py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

• Denial of service

<1.1.3 · fixed in 1.1.3

Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser

• Denial of service

<1.8.1 · fixed in 1.8.1

Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit

• Denial of service

<1.8.1 · fixed in 1.8.1

Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`

• Denial of service

<1.3.7 · fixed in 1.3.7

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

• Denial of service
• CWE-272

<1.8.1 · fixed in 1.8.1

CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

• Denial of service

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

• Denial of service

<2.2.1 · fixed in 2.2.1

libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL`

• strukturag libde265
• Denial of service

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

• Denial of service

>=1.0.0, <1.10.6 || >=2.0.0, <2.14.3 · fixed in 1.10.6, 2.14.3

symfony/ux-live-component: Denial of service via unbounded batch action requests

• Denial of service

>=2.5.0, <2.36.0 || >=3.0.0, <3.1.0 · fixed in 2.36.0, 3.1.0

containerd image-triggered runtime DoS via unbounded group parsing

• Denial of service

>=1.7.0, <1.7.33 · fixed in 1.7.33

parse-server: Denial of service via exponential-time processing of deeply nested query operators

• Denial of service

<8.6.82 || >=9.0.0, <9.9.1-alpha.12 · fixed in 8.6.82, 9.9.1-alpha.12

undici WebSocket client vulnerable to denial of service via fragment count bypass

• Denial of service

<6.27.0 || >=7.0.0, <7.28.0 || >=8.0.0, <8.5.0 · fixed in 6.27.0, 7.28.0, 8.5.0

Memory leak in NI grpc-device BeginSidebandStream

• NI grpc-device
• NI InstrumentStudio
• Denial of service

DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform

• Hitachi Virtual Storage Platform E990, E1090, E1090H
• Hitachi Virtual Storage Platform E390, E590, E790, E390H, E590H, E790H
• Denial of service

PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service

• Denial of service

<3.4.10 || >=4.0.0, <4.0.7 || >=4.1.0, <4.1.7 · fixed in 3.4.10, 4.0.7, 4.1.7

spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation

• Denial of service
• CWE-1284

<11.4.3 · fixed in 11.4.3

Uncontrolled resource consumption in node

• node
• Denial of service

pam_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication

• mcdope pam_usb
• Denial of service

AutoGPT has a DoS vulnerability in MediaDurationBlock

• Significant-Gravitas AutoGPT
• Denial of service

AutoGPT has a DoS vulnerability in AddAudioToVideoBlock

• Significant-Gravitas AutoGPT
• Denial of service

AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock

• Significant-Gravitas AutoGPT
• Denial of service

AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock

• Significant-Gravitas AutoGPT
• Denial of service

AutoGPT has a DoS vulnerability in LoopVideoBlock

• Significant-Gravitas AutoGPT
• Denial of service

Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint

• nesquena hermes-webui
• Denial of service

pypdf: Missing stream length values ignore defined limits

• Denial of service

<6.13.3 · fixed in 6.13.3

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

• Denial of service

>=8.0.0, <8.5.0 · fixed in 8.5.0

JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables

• Denial of service

>=4.1.0, <4.2.1 || >=4.0.0, <4.0.16 || <3.30.14 · fixed in 4.2.1, 4.0.16, 3.30.14

JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry

• Denial of service

>=4.1.0, <4.2.1 || >=4.0.0, <4.0.16 || <3.30.14 · fixed in 4.2.1, 4.0.16, 3.30.14

NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation

• Memory corruption
• Denial of service

<6.1.1 · fixed in 6.1.1

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

• Denial of service

<6.9.10 · fixed in 6.9.10

libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler

• libssh2
• Denial of service

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

• Information disclosure
• Authentication bypass

<1.9.1 · fixed in 1.9.1

Multer vulnerable to Denial of Service via deeply nested field names

• Denial of service

>=1.0.0, <2.2.0 || >=3.0.0-alpha.1, <3.0.0-alpha.2 · fixed in 2.2.0, 3.0.0-alpha.2

Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification

• envoy
• Denial of service
• CWE-405

Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoS

• rxi microtar
• Memory corruption
• Denial of service

WEB SERVICE (HTTP) DENIAL OF SERVICE VIA SLOW HEADERS ON REGESTA SMART HD-PLC OF TELDAT

• Teldat Regesta Smart HD-PLC - TLDPH16D2
• Denial of service

Uncontrolled resource consumption in Google Android

• Google Android
• Denial of service

Uncontrolled resource consumption in Google Android

• Google Android
• Denial of service

Improper privilege management in Oracle Corporation Oracle Solaris

• Oracle Corporation Oracle Solaris
• Privilege escalation
• Denial of service

Missing authentication in Oracle Corporation JD Edwards EnterpriseOne Tools

• Oracle Corporation JD Edwards EnterpriseOne Tools
• Information disclosure
• Broken access control

Uncontrolled resource consumption in Oracle Corporation Oracle Enterprise Manager Base Platform

• Oracle Corporation Oracle Enterprise Manager Base Platform
• Denial of service

Uncontrolled resource consumption in Oracle Corporation MySQL Server and others

• Oracle Corporation MySQL Server
• Oracle Corporation MySQL Cluster
• Denial of service

Uncontrolled resource consumption in Oracle Corporation MySQL Router

• Oracle Corporation MySQL Router
• Denial of service

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

• Code injection
• Denial of service

<0.22.0 · fixed in 0.22.0

Rockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple Vulnerabilities

• Rockwell Automation FLEX I/O EtherNet/IP Adapters
• Denial of service

Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning

• Denial of service

=6.3.0 · no fixed version yet

pypdf: Possible infinite loop when processing outlines/bookmarks in writer

• Denial of service

<6.13.0 · fixed in 6.13.0

pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

• Denial of service

<6.13.0 · fixed in 6.13.0

pypdf: Possible large memory usage for form XObjects during text extraction

• Denial of service

<6.12.2 · fixed in 6.12.2