Denial of service.

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

• Denial of service

<5.5.0 · fixed in 5.5.0

icalendar has Algorithmic Complexity in Equality

• Denial of service

>=7.1.0, <7.1.3 · fixed in 7.1.3

Duplicate Advisory: Nokogiri XSLT transform has a memory leak

• Denial of service

* · no fixed version yet

Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking

• Denial of service

* · no fixed version yet

eml_parser vulnerable to DoS via deeply nested parens in Received headers

• Denial of service
• CWE-1124

<3.0.2 · fixed in 3.0.2

eml_parser has parser DoS via deeply nested parentheses in e-mail headers

• Denial of service
• CWE-1124

<3.0.2 · fixed in 3.0.2

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

• Adobe C2PA Tool
• Adobe Content Credentials Rust SDK
• Denial of service

zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

• Python Software Foundation CPython
• Denial of service

PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

• Denial of service

<4.6.58 · fixed in 4.6.58

QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

• OpenSSL
• Denial of service

CMP Indefinite Cache Growth of ExtraCerts

• OpenSSL
• Denial of service

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to ...

• Denial of service

<0.27.0 · fixed in 0.27.0

Ech0 before 5.0.1 Denial of Service via Accept-Language

• lin-snow Ech0
• Denial of service

Uncontrolled memory usage in Innodata Labs’ Poppler JPX decoder

• Poppler Innodata Labs
• Denial of service

Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)

• Denial of service
• CWE-204

>=4.1.0, <5.3.50 || >=5.4.0, <5.7.12 · fixed in 5.3.50, 5.7.12

Duplicate Advisory: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses (CWE-776)

• Denial of service

<=3.10.2 · no fixed version yet

Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)

• SAP_SE SAP S/4HANA (Manage Supply Protection)
• Denial of service

OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts

• AcademySoftwareFoundation openexr
• Memory corruption
• Denial of service

OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)

• AcademySoftwareFoundation openexr
• Denial of service

vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths

• Denial of service

<0.3.2 · fixed in 0.3.2

CakePHP: Potential Authentication bypass with CookieAuthenticator

• cakephp authentication
• Authentication bypass
• Denial of service

libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

• js-libp2p
• Denial of service

SVG File Parsing Stack Exhaustion Vulnerability in Autodesk 3ds Max

• Autodesk 3ds Max
• Denial of service

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

• Denial of service

<5.0.8 · fixed in 5.0.8

postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

• Denial of service

>=0.3.0, <0.6.12 · fixed in 0.6.12

RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts

• ransomlook
• Authentication bypass
• Denial of service

bytebot-ai bytebot Agent Execution Workflow infinite loop

• bytebot
• Denial of service

DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

• DJI Neo
• DJI Neo 2
• Denial of service

Open5GS HSS hss-cx-path.c assertion

• Open5GS
• Denial of service

An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers with UART access to cause a Denial of Service (DoS) via a c…

• Denial of service

Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to cause a Denial of Service

• Denial of service

ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference

• ggml-org llama.cpp
• Denial of service
• Memory corruption

Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

• Denial of service

<=1.9.1 · no fixed version yet

Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion

• zephyr
• Denial of service

Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

• Denial of service

<=3.9.3 · no fixed version yet

picotls has infinite recursion in the minicrypto ASN.1 decoder

• h2o picotls
• Denial of service

kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

• Denial of service

>=0.124.0, <0.142.0 · fixed in 0.142.0

Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

• Denial of service

<7.5.2 || >=7.6.0, <7.6.5 || >=8.0.0, <8.0.2 · fixed in 7.5.2, 7.6.5, 8.0.2

Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching

• bluewave-labs Checkmate
• Denial of service

Checkmate: Pre-auth Denial of Service via File Upload on Registration

• bluewave-labs Checkmate
• Denial of service

Apache CloudStack: DoS caused by database connections leak

• Apache Software Foundation Apache CloudStack
• Denial of service

Unbounded persistent session allocation via repeated initialize requests

• Spring AI
• Denial of service

Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability

• Spring Micrometer Tracing
• Denial of service

Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library

• misp-stix
• Denial of service

NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

• Denial of service

<3.10.1 · fixed in 3.10.1

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Denial of service

Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb

• NationalSecurityAgency ghidra
• Denial of service

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Denial of service

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Denial of service

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Denial of service

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Denial of service

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Denial of service

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

• Denial of service

>=1.30.0, <1.30.5 · fixed in 1.30.5

Resource allocation without limits in Apple container

• Apple container
• Denial of service

HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

• Denial of service

>=0.3.4, <1.12.5 · fixed in 1.12.5

Improper input validation in Apple swift-nio

• Apple swift-nio
• Denial of service
• CWE-20

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

• Denial of service

<0.0.23.Final · fixed in 0.0.23.Final

netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

• Denial of service

<0.0.23.Final · fixed in 0.0.23.Final

netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

• Denial of service

<0.0.23.Final · fixed in 0.0.23.Final

Wagtail: Denial of service via unbounded filter specs in the image preview

• Denial of service

<7.0.8 || >=7.1, <7.3.3 || >=7.4, <7.4.2 · fixed in 7.0.8, 7.3.3, 7.4.2