Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header
- libgit2
- Denial of service
- CVSS 2.6 Low
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers
- Denial of service
<1.11.9 || >=1.12.0-beta1, <1.12.2 · fixed in 1.11.9, 1.12.2
GHSA-22w5-2fxg-vrwx - CVSS 7.5 High
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
- Denial of service
<2.166.0 · fixed in 2.166.0
GHSA-6wvw-vrw4-363w · CVE-2026-54156 - CVSS 4.0, no score published
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
- Denial of service
<0.3.129 · fixed in 0.3.129
GHSA-jgvr-6x5w-hx5w - CVSS 8.7 High
jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations
- Denial of service
<1.23.2 · fixed in 1.23.2
GHSA-65r4-943x-97jj · CVE-2026-75140 - CVSS 7.5 High
Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames
- libevent
- Denial of service
- CVSS 8.4 High
Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept
- libevent
- Denial of service
- Memory corruption
- CVSS 7.5 High
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS
- Denial of service
<0.48.0 · fixed in 0.48.0
GHSA-qqff-5854-px68 · CVE-2026-55149 - CVSS 5.3 Medium
Apache InLong: Ordinary users can create new packages
- Apache Software Foundation Apache InLong
- Denial of service
- CVSS 4.3 Medium
Apache InLong: Non-template responsible persons can view template information
- Apache Software Foundation Apache InLong
- Denial of service
- CVSS 6.9 Medium
Guest controlled-size host heap allocation through WASIp3 streams
- Denial of service
Published by the maintainers · not yet reviewed by GitHub
>=46.0.0, <46.0.3 || >=47.0.0, <47.0.4 · fixed in 46.0.3, 47.0.4
GHSA-x84v-gj2h-g759 · CVE-2026-115391 - CVSS 5.3 Medium
n8n before 1.123.69 ReDoS via Filter and Switch Node
- n8n
- Denial of service
- CVSS 7.5 High
Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Denial of service
- CVSS 4.3 Medium
Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Denial of service
- CVSS 7.5 High
Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Denial of service
- CVSS 3.1 Low
Reachable Assertion in Wireshark
- Wireshark
- Denial of service
- CVSS 5.9 Medium
Regular Expression Denial of Service (DoS) through the REST API in Splunk Connect for Kafka
- Splunk Connect for Kafka
- Denial of service
- CVSS 5.9 Medium
Denial of Service (DoS) through the REST API in Splunk Connect for Kafka
- Splunk Connect for Kafka
- Denial of service
- CVSS 6.5 Medium
Reliable Scalable Cluster Technology Denial-of-Service
- IBM Reliable Scalable Cluster Technology (RSCT)
- Denial of service
- CVSS 6.5 Medium
coturn: Chained mobility resumes allow authenticated remote memory exhaustion
- coturn
- Denial of service
- CVSS 2.3 Low
BuildKit has a possible runtime DoS via unbounded group parsing
- Denial of service
<0.31.1 · fixed in 0.31.1
GHSA-72x6-4j93-7w86 · CVE-2026-61712 - CVSS 4.4 Medium
Vulnerabilities in IBM AIX and PowerVM VIOS
- IBM AIX
- IBM PowerVM VIOS
- Denial of service
- CVSS 7.5 High
Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)
- logto
- Denial of service
- CVSS 7.5 High
Vulnerabilities in IBM AIX and PowerVM VIOS
- IBM AIX
- IBM PowerVM VIOS
- Denial of service
- CVSS 7.5 High
Vulnerabilities in IBM AIX and PowerVM VIOS
- IBM AIX
- IBM PowerVM VIOS
- Denial of service
- CVSS 7.5 High
Vulnerabilities in IBM AIX and PowerVM VIOS
- IBM AIX
- IBM PowerVM VIOS
- Denial of service
- CVSS 7.5 High
RDK WebUI uncontrolled resource consumption
- RDK-B WebUI
- Denial of service
- CVSS 7.5 High
Vulnerabilities in IBM AIX and PowerVM VIOS
- IBM AIX
- IBM PowerVM VIOS
- Denial of service
-
GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
- Other injection
- Information disclosure
<1.2.4 · fixed in 1.2.4
GHSA-p77j-g7h5-r2vw - CVSS 6.9 Medium
MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
- Denial of service
>=0.5.0, <0.7.1 · fixed in 0.7.1
GHSA-7m52-jw36-44r3 · CVE-2026-53965 - CVSS 6.9 Medium
Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS
- Denial of service
>=0.27.0, <0.53.1 · fixed in 0.53.1
GHSA-vjhx-2cqw-3q6q · CVE-2026-53941 - CVSS 6.5 Medium
FreeRDP: Denial of service through ADPCM frame size calculation
- FreeRDP
- Denial of service
- CVSS 6.5 Medium
Vulnerabilities in IBM AIX and PowerVM VIOS
- IBM AIX
- IBM PowerVM VIOS
- Denial of service
- CVSS 8.3 High
Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain
- Denial of service
>=0.2.0, <0.12.0 · fixed in 0.12.0
GHSA-j4j7-7xpr-c7cr · CVE-2026-73541 - CVSS 5.3 Medium
Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability
- Cisco Industrial Ethernet Switches
- Denial of service
- CVSS 4.9 Medium
Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation
- wazuh
- Denial of service
- CVSS 7.5 High
Vulnerabilities in IBM AIX and PowerVM VIOS
- IBM AIX
- IBM PowerVM VIOS
- Denial of service
- CVSS 7.5 High
Vulnerabilities in IBM AIX and PowerVM VIOS
- IBM AIX
- IBM PowerVM VIOS
- Denial of service
- CVSS 8.7 High
Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3
- cmsjunkie.com J-BusinessDirectory extension for Joomla
- Denial of service
- CVSS 7.5 High
Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Denial of service
- CVSS 5.7 Medium
Uncontrolled recursion in Eclipse Foundation Eclipse OpenJ9
- Eclipse Foundation Eclipse OpenJ9
- Denial of service
- CVSS 4.8 Medium
BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference
- BusyBox
- Denial of service
- Memory corruption
- CVSS 4.3 Medium
libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)
- strukturag libheif
- Denial of service
- Memory corruption
- CVSS 4.3 Medium
libheif: Integer underflow in Fraction constructor via double clap transform application
- strukturag libheif
- Memory corruption
- Denial of service
- CVSS 7.5 High
libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)
- strukturag libheif
- Memory corruption
- Denial of service
- CVSS 7.5 High
Uncontrolled resource consumption in Oracle Corporation Helidon
- Oracle Corporation Helidon
- Denial of service
- CVSS 4.4 Medium
Resource allocation without limits in Oracle Corporation Oracle VM VirtualBox
- Oracle Corporation Oracle VM VirtualBox
- Denial of service
- CVSS 6.0 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle VM VirtualBox
- Oracle Corporation Oracle VM VirtualBox
- Denial of service
- CVSS 5.5 Medium
Improper resource shutdown in Oracle Corporation MySQL Connectors
- Oracle Corporation MySQL Connectors
- Denial of service
- CVSS 7.5 High
Uncontrolled resource consumption in Oracle Corporation Oracle Workflow
- Oracle Corporation Oracle Workflow
- Denial of service
- CVSS 7.5 High
Uncontrolled resource consumption in Oracle Corporation Helidon
- Oracle Corporation Helidon
- Denial of service
- CVSS 7.5 High
Uncontrolled resource consumption in Oracle Corporation Oracle Java SE
- Oracle Corporation Oracle Java SE
- Denial of service
- CVSS 5.9 Medium
membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion
- Denial of service
<0.36.7 · fixed in 0.36.7
GHSA-43hj-fxwj-49qw · CVE-2026-53423 - CVSS 8.7 High
Memory-amplification denial of service via declared-length preallocation in Amazon ion-java
- Amazon Ion Java
- Denial of service
- CVSS 7.5 High
Resource allocation without limits in NVIDIA Triton Inference Server
- NVIDIA Triton Inference Server
- Denial of service
- CVSS 4.9 Medium
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
- Denial of service
<4.5.1 · fixed in 4.5.1
GHSA-x768-8642-mmq9 · CVE-2026-68924 - CVSS 7.1 High
Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context
- wazuh-manager
- Denial of service
- CVSS 8.7 High
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
- Denial of service
<5.33.1 · fixed in 5.33.1
GHSA-68mj-5wr7-6fgg · CVE-2026-69219 - CVSS 8.7 High
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
- Denial of service
<5.33.1 · fixed in 5.33.1
GHSA-93j5-89vc-pph4 · CVE-2026-69220 - CVSS 7.5 High
SureForms contains an uncontrolled resource consumption vulnerability
- SureForms
- Denial of service