Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
- Denial of service
>=10.0.7, <10.0.23 || >=11.0.7, <11.0.23 · fixed in 10.0.23, 11.0.23
GHSA-9299-c6m4-mjhc · CVE-2024-7708 - CVSS 6.3 Medium
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
- Denial of service
<3.1.6 · fixed in 3.1.6
GHSA-f5gf-2cj8-52g2 · CVE-2026-59942 - CVSS 6.3 Medium
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
- Denial of service
<3.1.6 · fixed in 3.1.6
GHSA-8hg6-c449-896m · CVE-2026-59941 - CVSS 5.3 Medium
n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads
- Denial of service
<1.123.58 || >=2.0.0, <2.28.0 · fixed in 1.123.58, 2.28.0
GHSA-w867-jm58-p9pv · CVE-2026-58661 - CVSS 8.7 High
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
- Denial of service
<4.1.136.Final · fixed in 4.1.136.Final
GHSA-558v-64gr-wgg4 · CVE-2026-59901 - CVSS 6.9 Medium
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
- Denial of service
>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final
GHSA-q4f6-jm68-57ww · CVE-2026-59899 - CVSS 7.5 High
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
- Denial of service
<4.2.16.Final · fixed in 4.2.16.Final
GHSA-hpcc-26xq-25fv · CVE-2026-56816 - CVSS 8.7 High
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
- Denial of service
>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final
GHSA-jppx-w49h-x2qq · CVE-2026-56745 - CVSS 8.7 High
Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
- Denial of service
>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final
GHSA-q6cq-mhr2-jmr5 · CVE-2026-55851 - CVSS 7.5 High
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
- Denial of service
>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final
GHSA-mvh2-crg5-v77c · CVE-2026-55833 - CVSS 7.5 High
Netty SPDY SETTINGS frame count materializes unbounded settings map
- Denial of service
>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final
GHSA-6jqx-86gh-f27w · CVE-2026-55831 - CVSS 7.1 High
Server crash via aggregation pipeline expression with compound wildcard index specification
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Transaction Command Insufficient Input Validation Leading to Process Termination
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Find command with $meta sort can lead to crash
- MongoDB Server
- Denial of service
- CVSS 7.1 High
MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion
- MongoDB Server
- Denial of service
- CVSS 5.3 Medium
MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination
- MongoDB Server
- Denial of service
- CVSS 6.9 Medium
Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service
- MongoDB Server
- Denial of service
- CVSS 7.1 High
$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Aggregation Framework Memory Exhaustion Leading to Process Termination
- MongoDB Server
- Denial of service
- CVSS 4.3 Medium
Resource allocation without limits in Elgg
- Elgg
- Denial of service
- CVSS 8.7 High
FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer
- FFmpeg
- Denial of service
- CVSS 7.5 High
Unexpected exit in certain situations with NSEC and NSEC3 both present
- ISC BIND 9
- Denial of service
- CVSS 7.5 High
Record ordering based unexpected exit with CNAME or DNAME
- ISC BIND 9
- Denial of service
- CVSS 7.5 High
Potential memory usage beyond configured limits
- ISC BIND 9
- Denial of service
- CVSS 6.5 Medium
Key Record using PRIVATEDNS algorithm may lead to unexpected exit
- ISC BIND 9
- Denial of service
- CWE-1284
- CVSS 5.3 Medium
XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX
- Progress Software Telerik UI for ASP.NET AJAX
- Denial of service
- CVSS 5.9 Medium
Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration
- NLnet Labs Unbound
- Denial of service
- CVSS 3.7 Low
Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
- NLnet Labs Unbound
- Denial of service
- CVSS 5.9 Medium
Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
- NLnet Labs Unbound
- Denial of service
- CVSS 6.9 Medium
ReDoS in Open Mercato
- Open Mercato
- Denial of service
- CVSS 6.9 Medium
Denial-of-Service in OpenCanary's MongoDB module
- Thinkst Applied Research OpenCanary
- Denial of service
- CWE-20
- CVSS 6.6 Medium
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives
- Denial of service
>=0.4.5, <0.4.9 || >=0.5.0, <0.5.4 || >=0.6.0, <0.6.11 || >=0.7.0, <0.7.5 || >=0.8.0, <0.8.3 · fixed in 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3
GHSA-px8p-9vwx-vf98 · CVE-2026-45820 - CVSS 5.5 Medium
An issue in Unistal Systems Pvt.
- Denial of service
- CWE-703
- CVSS 6.5 Medium
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- Elastic Kibana
- Denial of service
- CVSS 6.5 Medium
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- Elastic Kibana
- Denial of service
- CVSS 6.5 Medium
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 8.7 High
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
- Denial of service
>=5.9.3, <5.10.1 · fixed in 5.10.1
GHSA-8r6m-32jq-jx6q · CVE-2026-73569 - CVSS 5.3 Medium
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
- Denial of service
>=2.0.0, <2.0.10 · fixed in 2.0.10
GHSA-9mqv-5hh9-4cgg · CVE-2026-73565 - CVSS 4.0, no score published
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
- Denial of service
- Broken access control
<1.82.1 · fixed in 1.82.1
GHSA-hrxh-6v49-42gf - CVSS 8.7 High
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
- Denial of service
<2.18.8 || >=2.19.0, <2.21.4 · fixed in 2.18.8, 2.21.4
GHSA-r7wm-3cxj-wff9 · CVE-2026-68494 - CVSS 7.6 High
Improper access control in Oracle Corporation Oracle Production Scheduling
- Oracle Corporation Oracle Production Scheduling
- Information disclosure
- Broken access control
- CVSS 3.1 Low
Uncontrolled resource consumption in Oracle Corporation Oracle Time and Labor
- Oracle Corporation Oracle Time and Labor
- Denial of service
- CVSS 6.6 Medium
Improper access control in Oracle Corporation Oracle HRMS (US)
- Oracle Corporation Oracle HRMS (US)
- Broken access control
- Denial of service
- CVSS 4.8 Medium
Missing authentication in Oracle Corporation Oracle Workflow
- Oracle Corporation Oracle Workflow
- Authentication bypass
- Denial of service
- CVSS 6.5 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle Agile Engineering Data Management
- Oracle Corporation Oracle Agile Engineering Data Management
- Denial of service
- CVSS 6.5 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle Agile Engineering Data Management
- Oracle Corporation Oracle Agile Engineering Data Management
- Denial of service
- CVSS 5.3 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle Agile Engineering Data Management
- Oracle Corporation Oracle Agile Engineering Data Management
- Denial of service
- CVSS 2.8 Low
Improper resource shutdown in Oracle Corporation Oracle Agile Engineering Data Management
- Oracle Corporation Oracle Agile Engineering Data Management
- Denial of service
- CVSS 9.4 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle Agile Engineering Data Management
- Oracle Corporation Oracle Agile Engineering Data Management
- Broken access control
- Authentication bypass
- CVSS 7.1 High
Information disclosure in Oracle Corporation Oracle Commerce Guided Search Platform Services
- Oracle Corporation Oracle Commerce Guided Search Platform Services
- Information disclosure
- Denial of service
- CVSS 8.1 High
Improper access control in Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience…
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager
- Broken access control
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle Commerce Guided Search Platform Services
- Oracle Corporation Oracle Commerce Guided Search Platform Services
- Broken access control
- Authentication bypass
- CVSS 6.2 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience…
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager
- Denial of service
- CVSS 4.9 Medium
Uncontrolled resource consumption in Oracle Corporation MySQL Server and others
- Oracle Corporation MySQL Server
- Oracle Corporation MySQL Cluster
- Denial of service
- CVSS 4.9 Medium
Uncontrolled resource consumption in Oracle Corporation MySQL Server and others
- Oracle Corporation MySQL Server
- Oracle Corporation MySQL Cluster
- Denial of service
- CVSS 4.2 Medium
Information disclosure in Oracle Corporation Oracle HRMS (US)
- Oracle Corporation Oracle HRMS (US)
- Information disclosure
- Denial of service
- CVSS 6.5 Medium
Uncontrolled resource consumption in Oracle Corporation MySQL Server and others
- Oracle Corporation MySQL Server
- Oracle Corporation MySQL Cluster
- Denial of service
- CVSS 6.5 Medium
Uncontrolled resource consumption in Oracle Corporation MySQL Server and others
- Oracle Corporation MySQL Server
- Oracle Corporation MySQL Cluster
- Denial of service