Denial of service.

DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled

• zephyr
• Denial of service

Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser

• Ollama
• Denial of service

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

• Denial of service

<1.27.0 · fixed in 1.27.0

Gitea SSH Key Parser Denial of Service

• Broken access control
• Denial of service

<1.27.0 · fixed in 1.27.0

Reachable Assertion in Elasticsearch Leading to Denial of Service

• Elasticsearch
• Denial of service

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

• Denial of service

<1.27.0 · fixed in 1.27.0

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

• Elastic Kibana
• Denial of service

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

• Broken access control
• Denial of service

<1.27.0 · fixed in 1.27.0

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

• Elasticsearch
• Denial of service

QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls

• Amazon s2n-tls
• Denial of service

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

• Elasticsearch
• Denial of service

CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header

• GreycLab CImg
• Denial of service
• CWE-1284

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

• Elastic Kibana
• Denial of service

Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes

• aws-sdk-rust
• Denial of service

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

• Denial of service

<0.6.4 · fixed in 0.6.4

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

• Denial of service

<0.6.4 · fixed in 0.6.4

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

• Denial of service

<0.6.4 · fixed in 0.6.4

linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

• Denial of service

<5.0.2 · fixed in 5.0.2

Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

• Denial of service

<3.8.4 || >=4.0.0-beta.1, <4.3.9 || >=5.0.0-beta.1, <5.1.8 · fixed in 3.8.4, 4.3.9, 5.1.8

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

• Memory corruption
• Denial of service

<3.8.4 || >=4.0.0-rc.1, <4.3.9 || >=5.0.0-beta.1, <5.1.8 · fixed in 3.8.4, 4.3.9, 5.1.8

Uncontrolled resource consumption in Atlassian Confluence Data Center

• Atlassian Confluence Data Center
• Denial of service

Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability

• Denial of service

>=8.0.0, <8.0.26 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6 · fixed in 8.0.26, 9.0.15, 10.0.6

Libssh: libssh: denial of service via automatic certificate authentication loop

• Red Hat Enterprise Linux 10
• Red Hat Hardened Images
• Denial of service

Libssh: libssh: denial of service via sftp responses with unknown request ids

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Denial-of-service in the Graphics: WebGPU component

• Mozilla Firefox
• Mozilla Thunderbird
• Denial of service

Libssh: libssh: denial of service via oversized sftp read length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Libssh: libssh: denial of service via zero advertised channel packet size

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Guzzle: Unbounded response cookies risk denial of service

• Denial of service
• CWE-1325

<7.15.1 · fixed in 7.15.1

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

• Denial of service

<1.20.6 || >=2.0.0, <2.3.0 · fixed in 1.20.6, 2.3.0

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

• Denial of service

>=8.2.0, <12.3.0 · fixed in 12.3.0

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

• Denial of service

>=12.0.0, <12.3.0 · fixed in 12.3.0

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

• Denial of service

>=5.1.0, <12.3.0 · fixed in 12.3.0

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

• Denial of service

>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10

Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability

• Denial of service

>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.4, 9.0.18, 10.0.10

Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability

• Denial of service

>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.4, 9.0.18, 10.0.10

Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

• Denial of service

>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10

Axios form serializer maxDepth bypass via {} metatoken

• Denial of service

>=0.31.1, <0.33.0 || >=1.15.1, <1.18.0 · fixed in 0.33.0, 1.18.0

Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

• Denial of service

>=1.13.0, <1.18.0 · fixed in 1.18.0

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

• Denial of service

>=1.7.0, <1.18.0 · fixed in 1.18.0

protobufjs: Denial of Service via infinite loop in .proto option parsing

• Denial of service

>=7.5.0, <7.6.5 || >=8.0.0, <8.6.6 · fixed in 7.6.5, 8.6.6

node-tar: Decompression/parse DoS via unlimited input

• Denial of service

<7.5.19 · fixed in 7.5.19

node-tar: Negative tar entry size causes infinite loop in archive replace

• Denial of service

<7.5.18 · fixed in 7.5.18

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

• Denial of service

>=4.1.0, <6.6.7 · fixed in 6.6.7

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

• Denial of service

<1.9.0 · fixed in 1.9.0

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

• Denial of service

<3.3.0 · fixed in 3.3.0

Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

• Denial of service

<3.3.0 · fixed in 3.3.0

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

• Denial of service
• CWE-755

<3.3.0 · fixed in 3.3.0

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

• Denial of service

<3.3.0 · fixed in 3.3.0

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

• Denial of service

>=5.0.0, <5.2.0 · fixed in 5.2.0

js-yaml: YAML merge-key chains can force quadratic CPU consumption

• Denial of service

>=3.0.0, <3.15.0 || >=4.0.0, <4.3.0 · fixed in 3.15.0, 4.3.0

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

• Denial of service

>=5.0.0, <5.2.1 · fixed in 5.2.1

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

• Denial of service

<12.3.0 · fixed in 12.3.0

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

• Denial of service

<12.3.0 · fixed in 12.3.0

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

• Denial of service

<12.3.0 · fixed in 12.3.0

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

• Denial of service

<12.3.0 · fixed in 12.3.0

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

• Denial of service

<1.1.16 || >=2.0.0, <2.1.2 || >=3.0.0, <5.0.7 · fixed in 1.1.16, 2.1.2, 5.0.7

FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)

• freescout
• Denial of service

vLLM denial of service via prompt embeds on M-RoPE models

• Denial of service

>=0.12.0, <0.24.0 · fixed in 0.24.0

Tornado: Quadratic DoS via Crafted Multipart Parameters

• Denial of service

<6.5.3 · fixed in 6.5.3

Tornado: Quadratic DoS via Repeated Header Coalescing

• Denial of service

<6.5.3 · fixed in 6.5.3