Denial of service.

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

• Denial of service

<0.23.0 · fixed in 0.23.0

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

• Denial of service

<0.23.0 · fixed in 0.23.0

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

• Denial of service

>=0.0.0-20251024001301-45f9c18bc3ee, <0.0.0-20260708075951-ec114e95d297 · fixed in 0.0.0-20260708075951-ec114e95d297

IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2

• IBM WebSphere Application Server - Liberty
• Denial of service

IBM Enterprise Build of Quarkus is affected by a DoS vulnerability

• IBM Enterprise Build of Quarkus
• Denial of service

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

• Denial of service

DFIR-IRIS Missing Brute Force Protection in User Authentication

• dfir-iris iris-web
• Denial of service

DFIR-IRIS Missing Brute Force Protection in OTP Validation

• dfir-iris iris-web
• Denial of service

Allocation of Resources Without Limits or Throttling in GitLab

• GitLab
• Denial of service

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

• Denial of service

<2.27.0 · fixed in 2.27.0

Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries

• svarshavchik Courier IMAP
• svarshavchik Courier Mail Server
• Denial of service

@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

• @fastify/rate-limit
• Authentication bypass
• Denial of service

nanoid: custom generators can loop indefinitely when size is zero

• Denial of service

<3.3.18 || >=4.0.0, <5.1.6 · fixed in 3.3.18, 5.1.6

nanoid: non-secure generators can loop indefinitely with negative size

• Denial of service

<3.3.16 || >=4.0.0, <5.1.16 · fixed in 3.3.16, 5.1.16

Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision

• Denial of service
• Broken access control

Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision

• Denial of service
• Broken access control

cJSON cJSON_Compare Exponential Complexity Denial of Service

• DaveGamble cJSON
• Denial of service

cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

• DaveGamble cJSON
• Denial of service

Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

• Apache Software Foundation Apache Traffic Server
• Denial of service

Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

• Apache Software Foundation Apache Traffic Server
• Denial of service

Apache Traffic Server: HostDB SRV handling leaks memory

• Apache Software Foundation Apache Traffic Server
• Denial of service

Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

• Apache Software Foundation Apache Traffic Server
• Denial of service

Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

• Apache Software Foundation Apache Traffic Server
• Denial of service

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

• Denial of service

<0.145.1 · fixed in 0.145.1

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

• IBM WebSphere Application Server
• IBM WebSphere Application Server - Liberty
• Denial of service

IBM WebSphere Application Server Liberty is affected by a denial of service

• IBM WebSphere Application Server - Liberty
• Denial of service

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

• Denial of service
• CWE-406

=1.0.0 · no fixed version yet

TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

• GeneralSandman TinyWeb
• Denial of service

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

• Denial of service

<1.6.1 · fixed in 1.6.1

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

• Memory corruption
• Denial of service

<1.6.1 · fixed in 1.6.1

Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

• tomaka rouille
• Denial of service

Resource allocation without limits in NVIDIA DCGM and others

• NVIDIA DCGM
• NVIDIA DCGM Exporter
• Denial of service

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

• Denial of service

>=1.7.0, <1.13.0 · fixed in 1.13.0

Apache Tomcat: DoS via WebSocket chat example

• Apache Software Foundation Apache Tomcat
• Denial of service

Quadratic Behavior in xml.etree.ElementPath Index Predicates

• Python Software Foundation CPython
• Denial of service

Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

• Pivotick
• Denial of service

Viridian STIMER division by zero

• Xen
• Denial of service

x86 shadow paging is deprecated

• Xen
• Denial of service

Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

• lookyloo
• Denial of service

Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion

• Denial of service

>=2.0.0-pre.4, <2.18.0 · fixed in 2.18.0

Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

• Denial of service

>=2.0.0-pre.1, <2.19.0 · fixed in 2.19.0

Uncontrolled resource consumption in Apple Safari and others

• Apple Safari
• Apple iOS and iPadOS
• Denial of service

Uncontrolled resource consumption in Apple macOS

• Apple macOS
• Denial of service

Uncontrolled resource consumption in Apple macOS

• Apple macOS
• Denial of service

Uncontrolled resource consumption in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Denial of service

Uncontrolled resource consumption in Apple macOS

• Apple macOS
• Denial of service

DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)

• zephyr
• Denial of service

facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser

• boazsegev facil.io
• Denial of service

BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

• Erlang OTP
• Memory corruption
• Denial of service

Denial of service via exponential certificate policy tree growth in path validation

• Erlang OTP
• Denial of service

NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag

• The HDF Group HDF5
• Memory corruption
• Denial of service

epmd permanent DoS via EMFILE on accept(2) in erts

• Erlang OTP
• Denial of service
• CWE-755

TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

• Erlang OTP
• Denial of service

Denial of service via unbounded document content extraction in Mattermost Server

• Mattermost
• Denial of service

ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion

• ggml-org whisper.cpp
• Denial of service

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

• Denial of service

<0.24.0 · fixed in 0.24.0

Apache Thrift: Rust binary protocol non-strict path missing string size limit

• Apache Software Foundation Apache Thrift
• Denial of service

Apache Thrift: Node.js quadratic-time DoS in server receive transports

• Apache Software Foundation Apache Thrift
• Denial of service

Apache Thrift: Unbounded Read Leading to Denial of Service

• Apache Software Foundation Apache Thrift
• Denial of service

ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion

• ggml-org llama.cpp
• Denial of service