Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.7 High
Expat Denial of Service via storeAtts() Quadratic Complexity
- libexpat
- Denial of service
- CVSS 7.5 High
WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability
- Nexcess Starter Templates by Kadence WP
- Denial of service
- CVSS 7.5 High
Denial-of-service in the Widget component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
- CVSS 5.3 Medium
ArcadeDB before 26.8.1 Denial of Service via range()
- ArcadeData arcadedb
- Denial of service
- CVSS 5.3 Medium
SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM
- siyuan
- Denial of service
- CVSS 7.5 High
An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c
- Denial of service
- CVSS 7.5 High
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
- Denial of service
<11.5.14 · fixed in 11.5.14
GHSA-gc95-3vw8-vg43 · CVE-2026-53752 - CVSS 7.1 High
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
- Denial of service
<1.1.0 · fixed in 1.1.0
GHSA-j659-8xh6-5pq5 · CVE-2026-91987 - CVSS 6.5 Medium
Uncontrolled resource consumption in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Denial of service
- CVSS 6.5 Medium
Reachable assertion in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Denial of service
- CVSS 6.5 Medium
Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit
- deskflow
- Denial of service
- CVSS 7.1 High
TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference
- TOTOLINK EX1200L
- Denial of service
- Memory corruption
- CVSS 7.1 High
TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference
- TOTOLINK EX1200L
- Denial of service
- Memory corruption
- CVSS 6.9 Medium
Certain HP Smart Tank All in One – Potential Denial of Service
- HP Inc HP Smart Tank 5101 All-in-One Printer
- HP Inc HP Smart Tank 5001 All-in-One Printer
- Denial of service
- CVSS 7.5 High
Netty: Memory Exhaustion in SctpMessageCompletionHandler
- Denial of service
>=4.2.0.Final, <4.2.17.Final || <4.1.137.Final · fixed in 4.2.17.Final, 4.1.137.Final
GHSA-2qj4-mmr9-4v2f · CVE-2026-59902 - CVSS 7.5 High
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
- Denial of service
<0.6.0 · fixed in 0.6.0
GHSA-prg7-hcfm-mfcr · CVE-2026-59893 - CVSS 8.7 High
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
- Denial of service
<0.6.0 · fixed in 0.6.0
GHSA-pwgv-4x5q-6m9f · CVE-2026-54284 - CVSS 8.7 High
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
- Denial of service
<3.11.6 · fixed in 3.11.6
GHSA-v836-6xw4-9cx3 · CVE-2026-92961 - CVSS 8.7 High
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
- Denial of service
<3.11.6 · fixed in 3.11.6
GHSA-gmc2-2x9w-cgh9 · CVE-2026-47683 - CVSS 8.7 High
sqlparse: Quadratic O(n²) DoS in group_comments
- Denial of service
<0.6.0 · fixed in 0.6.0
GHSA-f2ff-p2ww-7p4p · CVE-2026-71491 - CVSS 7.5 High
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging
- Denial of service
<1.0.0-rc.11 · fixed in 1.0.0-rc.11
GHSA-v828-m3pf-vq9q · CVE-2026-64868 - CVSS 4.6 Medium
PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service
- zephyr
- Denial of service
- CVSS 7.1 High
Resource allocation without limits in JetBrains YouTrack
- JetBrains YouTrack
- Denial of service
- CVSS 5.9 Medium
Infinite loop in JetBrains Ktor
- JetBrains Ktor
- Denial of service
- CVSS 8.2 High
DeepmergeTS has stack exhaustion when merging recursive object graphs
- Denial of service
<8.0.0 · fixed in 8.0.0
GHSA-ggr8-5vv4-36mx · CVE-2026-40345 - CVSS 7.5 High
An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function
- Denial of service
- CVSS 6.5 Medium
Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require
- Denial of service
- CVSS 8.7 High
Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply
- scriban
- Denial of service
- CVSS 8.7 High
stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service
- stoatchat
- Denial of service
- CVSS 7.5 High
@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload
- @fastify/multipart
- Denial of service
- CWE-459
- CVSS 7.5 High
@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit
- @fastify/multipart
- Denial of service
- CWE-664
- CVSS 7.5 High
Apache Struts: Unbounded growth of localized-text caches driven by the request locale
- Apache Software Foundation Apache Struts
- Denial of service
- CVSS 7.5 High
Apache Struts: Unbounded read of a Content Security Policy violation report
- Apache Software Foundation Apache Struts
- Denial of service
- CVSS 7.8 High
wifi: rt2x00: avoid full teardown before work setup in probe
- Linux kernel
- Denial of service
- CVSS 6.9 Medium
s2n-quic has excessive memory allocation
- Denial of service
<1.82.0 · fixed in 1.82.0
GHSA-9q54-f358-3fqf · CVE-2026-10740 - CVSS 8.7 High
Grav: Unauthenticated denial of service via unbounded image derivative dimensions
- Denial of service
<1.7.53 || >=2.0.0-beta.1, <2.0.0-rc.8 · fixed in 1.7.53, 2.0.0-rc.8
GHSA-4x9g-vw65-vvf9 · CVE-2026-53653 - CVSS 7.5 High
IBM Db2 Mirror for i is affected by multiple vulnerabilities
- IBM Db2 Mirror for i
- Denial of service
- CVSS 7.5 High
Excessive memory allocation during VP8L decoding in golang.org/x/image
- Denial of service
<0.45.0 · fixed in 0.45.0
GO-2026-6222 · CVE-2026-46603 - CVSS 6.9 Medium
TRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources
- TRENDnet TEW-816DRM
- Denial of service
- CVSS 7.5 High
Apache Struts: Unbounded read of a JSON request body
- Apache Software Foundation Apache Struts
- Denial of service
- CVSS 7.1 High
FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
- filebrowser
- Denial of service
- CVSS 5.5 Medium
Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- Denial of service
- CVSS 5.9 Medium
Avoid quadratic complexity in resolvePath in net/url
- Denial of service
<1.25.13 || >=1.26.0-0, <1.26.6 || >=1.27.0-0, <1.27.0-rc.3 · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
GO-2026-6218 · CVE-2026-56860 - CVSS 7.5 High
Limit handshake messages we are willing to accept post-handshake in crypto/tls
- Denial of service
<1.25.13 || >=1.26.0-0, <1.26.6 || >=1.27.0-0, <1.27.0-rc.3 · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
GO-2026-6090 · CVE-2026-56862 - CVSS 7.5 High
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
- Denial of service
<1.25.13 || >=1.26.0-0, <1.26.6 || >=1.27.0-0, <1.27.0-rc.3 · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
GO-2026-6089 · CVE-2026-56853 - CVSS 7.5 High
Add recursion depth guard during decode in encoding/xml
- Denial of service
<1.25.13 || >=1.26.0-0, <1.26.6 || >=1.27.0-0, <1.27.0-rc.3 · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
GO-2026-6088 · CVE-2026-56859 - CVSS 7.5 High
Enforce maximum recursion depth in encoding/asn1
- Denial of service
<1.25.13 || >=1.26.0-0, <1.26.6 || >=1.27.0-0, <1.27.0-rc.3 · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
GO-2026-5972 · CVE-2026-33818 - CVSS 5.3 Medium
IBM i is Affected By A Denial of Service Vulnerability in DRDA / DDM []
- i
- Denial of service
- CVSS 5.3 Medium
IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
- i
- Denial of service
- CVSS 5.3 Medium
Calix GigaSpire traceroute.cmd denial of service
- Calix GigaSpire
- Denial of service
- CVSS 6.5 Medium
Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- Elastic Kibana
- Denial of service
- CVSS 6.5 Medium
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- Elastic Kibana
- Denial of service
- CVSS 6.5 Medium
Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service
- Elastic Kibana
- Denial of service
- CVSS 6.5 Medium
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- Elastic Kibana
- Denial of service