Denial of service.

Axios: Excessive recursion in formDataToJSON can cause denial of service

• Denial of service

>=0.28.0, <0.33.0 || >=1.0.0, <1.18.0 · fixed in 0.33.0, 1.18.0

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains

• NLNETLABS Net::DNS
• Denial of service

Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

• Denial of service

>=0.28.0, <0.33.0 || >=1.0.0, <1.18.0 · fixed in 0.33.0, 1.18.0

xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER

• neutrinolabs xrdp
• Denial of service

Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects

• Denial of service

* · no fixed version yet

Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName

• Denial of service

wifi: iwlwifi: mld: stop TX during firmware restart

• Linux kernel
• Denial of service

scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues

• Linux kernel
• Denial of service

Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

• Linux kernel
• Denial of service

vsock/virtio: bind uarg before filling zerocopy skb

• Linux kernel
• Denial of service

ipv6: fix possible infinite loop in fib6_select_path()

• Linux kernel
• Denial of service

KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()

• Linux kernel
• Denial of service

nfsd: fix posix_acl leak on SETACL decode failure

• Linux kernel
• Denial of service

nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race

• Linux kernel
• Denial of service

Duplicate Advisory: SurrealDB no JavaScript script function default timeout could facilitate DoS

• Denial of service

* · no fixed version yet

Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions

• Apache Software Foundation Apache Traffic Server
• Denial of service

IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack

• IBM Engineering Lifecycle Management
• Denial of service

IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service

• IBM Db2
• Denial of service

Vulnerabilities in IBM WebSphere Application affects IBM PowerVM Novalink.

• IBM PowerVM Novalink
• Denial of service

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

• Denial of service

<0.26.22 · fixed in 0.26.22

vLLM: Speech-to-text upload size limit is enforced after full UploadFile read

• Denial of service

>=0.22.0, <0.24.0 · fixed in 0.24.0

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

• Denial of service

<0.24.0 · fixed in 0.24.0

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

• OALDERS HTTP::Date
• Denial of service

Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration

• GitHub Enterprise Server
• Denial of service

Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods

• Mattermost
• Denial of service

OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs

• OpenClaw
• Denial of service

Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS)

• wazuh
• Denial of service

h2o has HTTP/2 state amplification

• h2o
• Denial of service

h2o is vulnerable to musl libc stack overflow

• h2o
• Denial of service

Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB

• h2o quicly
• Denial of service

Quicly is vulnerable to memory exhaustion

• h2o quicly
• Denial of service

AutomationDirect Productivity Suite Divide By Zero

• AutomationDirect Productivity Suite
• Denial of service

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

• Path traversal
• Denial of service

<26.6.1 · fixed in 26.6.1

Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

• Denial of service

<1.7.4 || >=1.8.0-rc.0, <1.8.1 · fixed in 1.7.4, 1.8.1

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

• Denial of service

<1.7.4 || >=1.8.0-rc.0, <1.8.1 · fixed in 1.7.4, 1.8.1

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes

• CODECHILD XML::Bare
• Denial of service

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes

• CODECHILD HTML::Bare
• Denial of service

Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service

• microsoft UFO
• Denial of service
• Broken access control

Loki detected_fields query limits results in unbounded memory allocation

• Grafana Loki
• Denial of service

Feast: resource exhaustion via websocket endpoint

• Feast Feature Server
• Red Hat OpenShift AI (RHOAI)
• Denial of service

adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files

• Denial of service
• CWE-409

* || >=1.4.0, <1.4.3 || >=1.5.0, <1.5.1 || >=1.6.0, <1.6.1 · fixed in 1.4.3, 1.5.1, 1.6.1

Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

• Denial of service
• CWE-1284

>=0.32.6, <0.32.8 · fixed in 0.32.8

dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

• Denial of service

<2.32.0 · fixed in 2.32.0

dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS

• Denial of service

<=1.24.1 · no fixed version yet

dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

• Denial of service

<3.43.0 · fixed in 3.43.0

dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

• Denial of service

<5.100.0 · fixed in 5.100.0

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

• Denial of service

<4.8.2 · fixed in 4.8.2

dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

• Denial of service

<1.62.0 · fixed in 1.62.0

websocket-driver: Resource limit bypass via message compression

• Denial of service

<0.7.5 · fixed in 0.7.5

websocket-driver: Memory exhaustion in HTTP header parser

• Denial of service

<0.8.1 · fixed in 0.8.1

websocket-driver: Resource limit bypass via message compression

• Denial of service

<0.8.1 · fixed in 0.8.1

websocket-driver: Memory exhaustion via abuse of protocol length headers

• Denial of service

<0.8.1 · fixed in 0.8.1

Wekan: Arbitrary file read and server DoS via attachment versions.original.path

• wekan
• Path traversal
• Denial of service

Resource exhaustion vulnerability in the Secure Access publisher

• Absolute Security Secure Access
• Denial of service

Memory management vulnerability in Secure Access clients

• Absolute Security Secure Access
• Memory corruption
• Denial of service

Memory management vulnerability in Secure Access servers

• Absolute Security Secure Access
• Denial of service

Memory management vulnerability in Secure Access servers

• Absolute Secutity Secure Access
• Memory corruption
• Denial of service

Memory management error in Secure Access servers prior to 14.55

• Absolute Security Secure Access
• Denial of service

Protobuf: Unbounded recursion depth in embedded-message decoding

• Denial of service

>=0.8.0, <0.16.1 · fixed in 0.16.1