Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.9 Medium
Jwcrypto: jwcrypto: denial of service via malformed jwe tokens
- Red Hat Enterprise Linux 10
- Red Hat Ansible Automation Platform 2
- Denial of service
- CVSS 8.1 High
Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
- Trilium
- Path traversal
- Denial of service
- CVSS 5.3 Medium
Duplicate Advisory: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
- Denial of service
<=3.10.2 · no fixed version yet
GHSA-pf76-q698-37v8 - CVSS 3.7 Low
Duplicate Advisory: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks
- Denial of service
<=3.10.2 · no fixed version yet
GHSA-3m7f-6hxv-6796 - CVSS 3.7 Low
Duplicate Advisory: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
- Denial of service
<=3.10.2 · no fixed version yet
GHSA-hqv3-xm29-p9hq - CVSS 7.5 High
Duplicate Advisory: Quadratic-time DoS in PorterStemmer via long runs of 'y'
- Denial of service
<=3.10.2 · no fixed version yet
GHSA-8x48-8g7j-rqxp - CVSS 6.5 Medium
In Spring AMQP the link credit never replenished on listener exception path
- Spring AMQP
- Denial of service
- CVSS 5.3 Medium
Spring Cloud Config Monitor Denial of Service
- Spring Cloud Config
- Denial of service
- CVSS 3.1 Low
Dynamic destination cache size is not properly bound in Spring Cloud Stream
- Spring Cloud Stream
- Denial of service
- CVSS 7.5 High
Spring for GraphQL Denial of Service via pagination support
- Spring for GraphQL
- Denial of service
- CVSS 5.9 Medium
Spring for GraphQL WebSocket Client Denial of Service
- Spring for GraphQL
- Denial of service
- CVSS 7.5 High
Spring Framework Denial of Service via Unbounded List Growth in Data Binding
- Spring Framework
- Denial of service
- CVSS 8.7 High
openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft ma...
- Denial of service
<1.4.9 · fixed in 1.4.9
GHSA-7894-5gw8-69hr · CVE-2026-81721 - CVSS 6.9 Medium
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attacker...
- Denial of service
<1.4.9 · fixed in 1.4.9
GHSA-783h-8q2f-f762 · CVE-2026-81720 - CVSS 8.7 High
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authenti...
- Denial of service
<1.4.9 · fixed in 1.4.9
GHSA-phmr-p567-q5g6 · CVE-2026-81699 - CVSS 8.7 High
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger...
- Denial of service
<1.4.9 · fixed in 1.4.9
GHSA-r23m-gf2m-8www · CVE-2026-81693 - CVSS 7.5 High
Undertow-core: undertow: denial of service via websocket permessage-deflate processing
- Red Hat JBoss Enterprise Application Platform 8.1.8.GA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
- Denial of service
- CVSS 8.7 High
openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO
- jahlives openssl_encrypt
- Denial of service
- CVSS 8.7 High
openssl_encrypt before 1.4.9 Denial of Service via KDF
- jahlives openssl_encrypt
- Denial of service
- CVSS 7.5 High
Resource allocation without limits in Ruby resolv
- Ruby resolv
- Denial of service
- CVSS 8.7 High
Apache APISIX: Unauthenticated CPU-exhaustion DoS
- Apache Software Foundation Apache APISIX
- Denial of service
- CVSS 9.8 CriticalCritical · CVSS 9+
Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
- Spring Framework
- Denial of service
- CVSS 7.5 High
Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
- Spring Framework
- Denial of service
- CVSS 7.5 High
Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
- Spring Framework
- Denial of service
- CVSS 7.5 High
Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
- Spring Framework
- Denial of service
- CVSS 5.9 Medium
Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
- Spring Batch
- Denial of service
- CVSS 6.5 Medium
A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted inpu…
- Denial of service
- CVSS 7.5 High
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Denial of service
- CVSS 7.5 High
An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Denial of service
- CVSS 7.5 High
An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Denial of service
- CVSS 7.5 High
An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Denial of service
- CVSS 7.5 High
An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query.
- Denial of service
- CVSS 7.5 High
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.
- Denial of service
- CVSS 7.5 High
An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration.
- Denial of service
- CVSS 7.5 High
An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Request message.
- Denial of service
- CVSS 7.5 High
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
- Denial of service
- CVSS 7.5 High
An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PUT request.
- Denial of service
- CVSS 7.5 High
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.
- Denial of service
- CVSS 7.5 High
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
- Denial of service
- CVSS 7.5 High
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
- Denial of service
- CVSS 5.3 Medium
Reactor Netty HTTP Server Denial of Service With Pipelined Requests
- Spring Reactor Netty
- Denial of service
- CVSS 5.9 Medium
Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush
- Spring Reactor Core
- Denial of service
- CVSS 5.4 Medium
Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
- Spring Integration
- Denial of service
- CVSS 7.5 High
Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
- Spring AI
- Denial of service
- CVSS 7.7 High
Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion
- pterodactyl wings
- Denial of service
- CVSS 6.5 Medium
Weblate Has Uncontrolled Resource Consumption via
- weblate
- Denial of service
- CVSS 6.5 Medium
Resource allocation without limits in Oracle Corporation Oracle Java SE
- Oracle Corporation Oracle Java SE
- Denial of service
- CVSS 7.5 High
Duplicate Advisory: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
- Denial of service
<=3.9.4 · no fixed version yet
GHSA-2rrw-hpqm-36pv - CVSS 6.5 Medium
Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
- GitLab
- Denial of service
- CVSS 6.5 Medium
Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
- CVSS 8.7 High
RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec
- rustdesk
- Denial of service
- CVSS 8.2 High
Remote UDP DoS by sending multiple DNS Cookie options
- NLnet Labs NSD
- Denial of service
- CVSS 6.5 Medium
libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader.
- Denial of service
- CVSS 9.3 CriticalCritical · CVSS 9+
An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component
- Denial of service
- Insecure deserialization
- CVSS 7.5 High
stomper 5e2741e is vulnerable to Denial of Service.
- Denial of service
- CVSS 7.5 High
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the…
- Authentication bypass
- Race condition
- CVSS 7.5 High
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via Spoofed SYN packets.
- Denial of service
- CWE-830
- CVSS 7.5 High
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
- Apache Software Foundation Apache Tomcat
- Denial of service
- CVSS 8.7 High
Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server
- mesop
- Denial of service
- CVSS 5.3 Medium
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
- Red Hat Enterprise Linux 10
- Denial of service