Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
- Denial of service
- CWE-1284
>=3.1.0, <3.21.10 || >=4.0.0, <4.5.1 · fixed in 3.21.10, 4.5.1
GHSA-hxcr-hm88-mpq6 · CVE-2026-71314 - CVSS 5.9 Medium
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
- Denial of service
<1.75.0 · fixed in 1.75.0
GHSA-xhf4-832v-7xcr · CVE-2026-71310 - CVSS 6.6 Medium
Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters
- GitHub Enterprise Server
- Denial of service
- CVSS 7.1 High
boringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint
- boringproxy
- Denial of service
- CVSS 6.5 Medium
Uncontrolled resource consumption in Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out 6 (iLO 6)
- Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out 6 (iLO 6)
- Denial of service
- CVSS 7.7 High
Cisco IOS XE Software SNMP Denial of Service Vulnerability
- Cisco IOS XE Software
- Denial of service
- CVSS 7.5 High
Apache Answer: Denial of service via crafted Accept-Language header parsing
- Apache Software Foundation Apache Answer
- Denial of service
- CVSS 7.5 High
Client-Side Memory Leak in OCSP Response Checking
- OpenSSL
- Denial of service
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.5
- Denial of service
- CVSS 5.1 Medium
Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
- Stephan Muelle libkcapi
- Red Hat Enterprise Linux 10
- Denial of service
- CVSS 7.5 High
Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
- Denial of service
<0.35.0 · fixed in 0.35.0
GHSA-p2gc-fm5w-94jj · CVE-2026-66274 - CVSS 7.5 High
Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service
- SUSE Rancher
- Denial of service
- CVSS 4.3 Medium
Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent
- SUSE Rancher
- Denial of service
- CVSS 7.5 High
imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service
- theotherphil imagecli
- Denial of service
- CVSS 7.5 High
Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS
- Apache Software Foundation Apache Lucy
- Denial of service
- CVSS 7.5 High
Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery
- Apache Software Foundation Apache Qpid ProtonJ2
- Denial of service
- CVSS 6.5 Medium
Apache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming delivery
- Apache Software Foundation Apache Qpid Proton Dotnet
- Denial of service
- CVSS 6.5 Medium
Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery
- Apache Software Foundation Apache Qpid Broker-J
- Denial of service
- CVSS 6.5 Medium
Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery
- Apache Software Foundation Apache Qpid Proton-J
- Denial of service
- CVSS 6.5 Medium
Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
- Apache Software Foundation Apache Qpid ProtonJ2
- Denial of service
- CVSS 6.5 Medium
Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded
- Apache Software Foundation Apache Qpid Proton Dotnet
- Denial of service
- CVSS 6.5 Medium
Apache Qpid Broker-J: Incoming session flow control window can be exceeded
- Apache Software Foundation Apache Qpid Broker-J
- Denial of service
- CVSS 6.5 Medium
Apache Qpid Proton-J: Incoming session flow control window can be exceeded
- Apache Software Foundation Apache Qpid Proton-J
- Denial of service
- CVSS 7.5 High
Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow
- Apache Software Foundation Apache Qpid ProtonJ2
- Denial of service
- CVSS 7.5 High
Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow
- Apache Software Foundation Apache Qpid Proton Dotnet
- Denial of service
- CVSS 7.5 High
Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow
- Apache Software Foundation Apache Qpid Broker-J
- Denial of service
- CVSS 7.5 High
Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication
- Apache Software Foundation Apache Qpid ProtonJ2
- Denial of service
- CVSS 7.5 High
Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication
- Apache Software Foundation Apache Qpid Proton Dotnet
- Denial of service
- CVSS 7.5 High
Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication
- Apache Software Foundation Apache Qpid Broker-J
- Denial of service
- CVSS 7.5 High
Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication
- Apache Software Foundation Apache Qpid Proton-J
- Denial of service
- CVSS 7.5 High
Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- Apache Software Foundation Apache Qpid ProtonJ2
- Denial of service
- CVSS 7.5 High
Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- Apache Software Foundation Apache Qpid Proton Dotnet
- Denial of service
- CVSS 7.5 High
Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- Apache Software Foundation Apache Qpid Broker-J
- Denial of service
- CVSS 7.5 High
Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- Apache Software Foundation Apache Qpid Proton-J
- Denial of service
- CVSS 8.7 High
Regular expression denial of service in OpenStack Swift
- OpenStack Swift
- Denial of service
- CVSS 7.5 High
An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling
- Denial of service
- CVSS 7.5 High
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component
- Denial of service
- CVSS 6.5 Medium
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
- Denial of service
>=0.9.6, <0.11.0 · fixed in 0.11.0
GHSA-2f54-p244-32q6 · CVE-2026-70493 - CVSS 6.5 Medium
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
- Denial of service
>=0.9.0, <0.11.0 · fixed in 0.11.0
GHSA-73cq-mcgh-379c · CVE-2026-70489 - CVSS 6.9 Medium
Django GeoDjango vulnerable to denial of service through deeply nested geometry collections
- Denial of service
<5.2.17 || >=6.0a1, <6.0.8 || >=6.1a1, <6.1.1 · fixed in 5.2.17, 6.0.8, 6.1.1
GHSA-q238-5cxm-5c9h · CVE-2026-15830 - CVSS 7.1 High
SnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOM
- aizuda SnailJob (snail-job)
- Denial of service
- CVSS 8.7 High
Veeam Service Provider Console: A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to…
- Veeam Service Provider Console
- Denial of service
- CVSS 6.9 Medium
Potential denial-of-service vulnerability in check_for_language()
- Django
- Denial of service
- CVSS 4.0, no score published
Duplicate Advisory: jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
- Denial of service
>=3.0.0 · no fixed version yet
GHSA-642r-3gj9-2pj5 - CVSS 4.0, no score published
Duplicate Advisory: jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition
- Denial of service
>=3.0.0, <3.1.0 || >=2.19.0, <2.21.1 || >=2.15.0, <2.18.6 · fixed in 3.1.0, 2.21.1, 2.18.6
GHSA-6qm2-mcq7-53qp - CVSS 7.1 High
Perspective 5.0.0 DoS via Loop Expression Evaluation
- perspective
- Denial of service
- CVSS 8.7 High
Memory leak in Eclipse Foundation Eclipse Milo
- Eclipse Foundation Eclipse Milo
- Denial of service
- CVSS 6.9 Medium
Resource leak in Eclipse Foundation Eclipse Milo
- Eclipse Foundation Eclipse Milo
- Denial of service
- CWE-460
- CVSS 5.9 Medium
Uncontrolled resource consumption in node
- node
- Denial of service
- CVSS 7.5 High
Uncontrolled resource consumption in node
- node
- Denial of service
- CVSS 6.2 Medium
Uncontrolled resource consumption in node
- node
- Denial of service
- CVSS 7.5 High
open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c.
- Denial of service
- CVSS 7.5 High
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes component
- Denial of service
- CVSS 7.5 High
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItems(Sampling), Publish, TransferSubscriptions, and Dele…
- Denial of service
- CVSS 7.5 High
open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled.
- Denial of service
- CVSS 8.4 High
An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c
- Denial of service
- CVSS 5.1 Medium
Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation
- misskey
- Denial of service
- CVSS 8.7 High
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
- Denial of service
>=42.0.0, <49.0.0 · fixed in 49.0.0
GHSA-jwv3-5hgf-82ww · CVE-2026-69249 - CVSS 7.1 High
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
- Memory corruption
- Denial of service
<3.14.3 · fixed in 3.14.3
GHSA-cq5v-8q36-5273 · CVE-2026-69244 - CVSS 5.3 Medium
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
- Denial of service
<4.12.34 · fixed in 4.12.34
GHSA-8j4g-w8fx-2239 · CVE-2026-69207