Denial of service.

ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference

• ggml-org llama.cpp
• Denial of service
• Memory corruption

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU ex…

• Denial of service

ALSA: compress: Fix task creation error unwind

• Linux kernel
• Denial of service

usb: typec: tcpci_rt1711h: unregister TCPCI port with devres

• Linux kernel
• Denial of service

sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT

• Linux kernel
• Denial of service

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

• Denial of service

<3.5.33 || >=3.6.0, <3.6.14 || >=3.7.0-alpha.0, <3.7.1 · fixed in 3.5.33, 3.6.14, 3.7.1

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

• Denial of service

<0.66.5 · fixed in 0.66.5

libp2p: yamux connection DoS via oversized data frame

• Denial of service

<=0.7.0 · no fixed version yet

OmniFaces: Forged combined-resource IDs and related output/push boundaries

• Cross-site scripting (XSS)
• Information disclosure

<1.14.3 || >=2.0.0, <2.7.33 || >=3.0.0, <3.14.23 || >=4.0.0, <4.7.12 || >=5.0.0, <5.4.2 · fixed in 1.14.3, 2.7.33, 3.14.23, 4.7.12, 5.4.2

Shescape: Quadratic-time denial of service in the flag-protection

• Denial of service

>=2.1.11, <2.1.14 || >=3.0.0, <3.0.1 · fixed in 2.1.14, 3.0.1

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

• Denial of service

<0.23.18 || >=1.0.0-M1, <1.0.0-M42 · fixed in 0.23.18, 1.0.0-M42

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

• Denial of service

<1.1.17 || >=2.0.0, <2.1.3 || >=3.0.0, <3.0.3 || >=4.0.0, <5.0.8 · fixed in 1.1.17, 2.1.3, 3.0.3, 5.0.8

@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

• Denial of service

<0.2.16 · fixed in 0.2.16

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

• Path traversal
• Denial of service

<5.1.2 · fixed in 5.1.2

react-server-dom: Denial of Service in Server Functions

• Denial of service

>=19.0.0, <19.0.8 || >=19.1.0, <19.1.9 || >=19.2.0, <19.2.8 · fixed in 19.0.8, 19.1.9, 19.2.8

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

• Denial of service

<0.11.1 · fixed in 0.11.1

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

• Denial of service
• CWE-409

<4.0.0-20260613024411-3607f79bb44c · fixed in 4.0.0-20260613024411-3607f79bb44c

FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()

• FFmpeg
• Denial of service

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

• Denial of service

>=0.9.2, <0.10.0 · fixed in 0.10.0

Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

• Denial of service

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

• Denial of service

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

js-yaml: Exponential parsing time in flow collections leads to denial of service

• Denial of service

>=5.0.0, <5.2.2 · fixed in 5.2.2

Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

• Denial of service

>=1.11.0, <1.12.1 · fixed in 1.12.1

node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

• Denial of service

<7.5.21 · fixed in 7.5.21

SvelteKit: Big remote form function payloads can cause Node process to crash

• Denial of service
• CWE-248

<2.69.1 · fixed in 2.69.1

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

• Denial of service
• CWE-409

<0.32.0 · fixed in 0.32.0

ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in ICON decoder when allocation fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory leak in VIFF encoder when allocation fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in MIFF encoder when allocaton fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in YUV decoder when opening of blob fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in TIFF encoder when an allocation fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in JNG encoder when a blob could not be opened

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in hough lines operation when an operation fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in color transformation to log colorspace when operation fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in TIFF encoder when a temporary file could not be created.

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Heap-use-after-free via XMP profile could result in a crash

• Denial of service
• Memory corruption

<14.15.0 · fixed in 14.15.0

ImageMagick: Policy Bypass possible with matrix-backed operations

• Broken access control
• Denial of service

<14.15.0 · fixed in 14.15.0

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

• Denial of service

>=7.0.0, <7.18.0 · fixed in 7.18.0

ImageMagick: Infinite Loop in connected-components when providing invalid arguments

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Stack Overflow in MVG decoder due to missing depth check.

• Denial of service

<14.15.0 · fixed in 14.15.0

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

• Denial of service

<10.27.1 · fixed in 10.27.1

Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

• zephyr
• Denial of service

Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler

• Apache Software Foundation Apache NimBLE
• Denial of service

Apache Neethi: Remote PolicyReference fetch lacks resource bounds

• Apache Software Foundation Apache Neethi
• Denial of service

Apache Neethi: Missing global alternative-output budget across policy computation paths

• Apache Software Foundation Apache Neethi
• Denial of service

Apache Neethi: Uncontrolled recursion in policy processing

• Apache Software Foundation Apache Neethi
• Denial of service

Rhcs: memory leak during https connection leads to denial of service

• Red Hat Certificate System 9
• Red Hat Enterprise Linux 10
• Denial of service

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

• Denial of service

<6.14.2 · fixed in 6.14.2

pypdf: Possible infinite loop for not terminated inline images

• Denial of service

<6.14.1 · fixed in 6.14.1

pypdf: Possible long runtimes for repeated malformed cross-reference entries

• Denial of service

<6.14.0 · fixed in 6.14.0

pypdf: Possible large memory usage for wrong image dimensions

• Denial of service

<6.14.0 · fixed in 6.14.0

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

• Denial of service

<1.30.6 || >=2.0.0, <2.1.18 || >=2.2.0, <2.4.7 || >=3.3.0, <3.10.7 || >=4.0.0, <5.8.1 · fixed in 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

• Denial of service
• CWE-409

<1.30.6 || >=2.0.0, <2.1.18 || >=2.2.0, <2.4.7 || >=3.3.0, <3.10.7 || >=4.0.0, <5.8.1 · fixed in 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1

Unrestricted File Upload in BizimHesap Information Systems' Online Pre-Accounting Software

• BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software
• Denial of service

Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

CVE-2026-21723 Record

• Grafana OSS
• Denial of service

Next.js: Unbounded Server Action payload in Edge runtime

• Denial of service

>=13.0.0, <15.5.21 || >=16.0.0, <16.2.11 · fixed in 15.5.21, 16.2.11

Next.js: Denial of Service in the Image Optimization API using SVGs

• Denial of service

>=15.5.0, <15.5.21 || >=16.0.0, <16.2.11 · fixed in 15.5.21, 16.2.11

Next.js: Denial of Service in App Router using Server Actions

• Denial of service

>=13.0.0, <15.5.21 || >=16.0.0, <16.2.11 · fixed in 15.5.21, 16.2.11