Denial of service.

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

• Denial of service

<1.1.18 || >=2.0.0, <2.1.4 || >=3.0.0, <3.0.6 || >=4.0.0, <5.0.9 · fixed in 1.1.18, 2.1.4, 3.0.6, 5.0.9

Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute

• misp cti-transmute
• Denial of service

Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

• Denial of service

<1.0.2.7 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.3 · fixed in 1.0.2.7, 2.0.2, 2.1.3

PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

MLS wire decoder allocates attacker-declared opaque length before bounds check

• Legion of the Bouncy Castle Inc. BC-JAVA
• Denial of service

Possible OOM from unbounded up-front allocation on a definite-length read

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

Quadratic-time escaping when stringifying X.500 distinguished names

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

HSS public-key level count unbounded, enabling huge allocation on verify

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

BCFKS keystore load honours unbounded KDF cost from untrusted file

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

Resource allocation without limits in MediaTek, Inc. MediaTek chipset

• MediaTek, Inc. MediaTek chipset
• Denial of service

MLS hash-ratchet honours arbitrary 32-bit generation counter from sender

• Legion of the Bouncy Castle Inc. BC-JAVA
• Denial of service

OER parser recurses without depth limit on self-referential IEEE 1609.2 schema

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

DTLS handshake reassembler allocates buffer from unchecked 24-bit length

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

CRMF/CMP password-MAC honours unbounded iteration count

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

OpenPGP Argon2 S2K honours attacker-chosen memory and passes

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

OpenPGP user-attribute subpacket length bounded only by JVM max memory

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

BKS/UBER keystore allocates from untrusted lengths before integrity check

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Denial of service

ggml-org llama.cpp Jinja Minja Template parser.cpp assertion

• ggml-org llama.cpp
• Denial of service

An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame.

• Denial of service
• CWE-20

An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.

• Denial of service

The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service (DoS) via inputting unsafe paramete…

• Denial of service

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.

• Denial of service

Duplicate Advisory: better-auth has an external request basePath modification DoS

• Denial of service

<1.4.2 · fixed in 1.4.2

PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS

• zephyr
• Denial of service

guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1

• Denial of service

>=2.0.0, <2.4.1 · fixed in 2.4.1

Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation

• Denial of service

>=2.0.0, <2.4.1 · fixed in 2.4.1

Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys

• Denial of service

>=0.1.0, <2.4.1 · fixed in 2.4.1

Duplicate Advisory: Guzzle: Unbounded response cookies risk denial of service

• Denial of service

* · no fixed version yet

Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken

• Denial of service

>=1.15.1 · no fixed version yet

Duplicate Advisory: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

• Denial of service

>=1.13.0 · no fixed version yet

Duplicate Advisory: Axios: Excessive recursion in formDataToJSON can cause denial of service

• Denial of service

>=1.0.0 · no fixed version yet

Duplicate Advisory: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

• Denial of service

>=1.0.0 · no fixed version yet

Duplicate Advisory: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

• Denial of service

>=1.7.0 · no fixed version yet

FreeRDP before 3.29.0 Denial of Service via serial DeviceControl

• FreeRDP
• Denial of service

FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service

• FreeRDP
• Denial of service

FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response

• FreeRDP
• Denial of service

zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit

• Denial of service

<0.4.1 · fixed in 0.4.1

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

• Denial of service

<7.8.0 · fixed in 7.8.0

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

• Denial of service

<7.8.0 · fixed in 7.8.0

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

• Denial of service
• CWE-20

<7.8.0 · fixed in 7.8.0

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

• Server-side request forgery (SSRF)
• Denial of service

<7.8.0 · fixed in 7.8.0

re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

• Denial of service

<1.25.2 · fixed in 1.25.2

Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

• Denial of service

>=4.2.0, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

• Denial of service

<3.10.0 · fixed in 3.10.0

Spring Data: Unbounded property-path cache keyed by externally-supplied path string

• Denial of service

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.13 · fixed in 4.0.6, 3.5.12

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

• Denial of service
• CWE-20

<1.13.0 · fixed in 1.13.0

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

• Denial of service

<1.13.0 · fixed in 1.13.0

Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

• zephyr
• Denial of service

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

• Denial of service

>=5.0-alpha1, <5.6.3 · fixed in 5.6.3

Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service

• gnome-remote-desktop
• Red Hat Enterprise Linux 10
• Denial of service

Denial of Service via Unrestricted Payload Buffering in MCP Toolbox

• Google mcp-toolbox
• Denial of service

GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service

• allinurl goaccess
• Denial of service
• CWE-681

IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities

• IBM Engineering Requirements Management DOORS and DOORS Web Access
• Denial of service

IBM DataPower Gateway affected by denial of service

• IBM DataPower Gateway 10.6CD
• IBM DataPower Gateway 10.6.0
• Denial of service

IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries

• IBM Db2
• Denial of service

Memory leak in OpenVPN

• OpenVPN
• Denial of service

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

• IBM WebSphere Application Server
• IBM WebSphere Application Server - Liberty
• Denial of service

Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser

• Apache Software Foundation Apache Superset
• Denial of service

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

• Denial of service

<0.23.0 · fixed in 0.23.0