Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.9 Medium
Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
- Denial of service
>=0.10.0, <3.32.2 · fixed in 3.32.2
GHSA-mq7g-pffw-m8xh · CVE-2026-82735 - CVSS 8.7 High
Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter
- Denial of service
>=0.1.0, <0.18.0 · fixed in 0.18.0
GHSA-mhxc-mhqx-3v28 · CVE-2026-74837 - CVSS 8.2 High
Unbounded atom creation from typed struct field names in AshTypescript field selector
- Denial of service
>=0.11.0, <0.18.0 · fixed in 0.18.0
GHSA-rj47-h936-4cxw · CVE-2026-77856 - CVSS 7.5 High
llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) via a negative top_n value in a POST reque…
- Denial of service
- CVSS 7.5 High
llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.
- Denial of service
- CVSS 7.5 High
llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.
- Denial of service
- CVSS 7.5 High
An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components
- Denial of service
- CVSS 7.5 High
An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verification function and the accounts/models.py component
- Denial of service
- CVSS 6.6 Medium
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
- Denial of service
- CWE-405
<0.5.0 · fixed in 0.5.0
GHSA-vcc3-ghjq-m6fr · CVE-2026-45822 - CVSS 5.9 Medium
Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
- Denial of service
<=3.10.2 · no fixed version yet
GHSA-vf76-f5cp-9846 - CVSS 6.5 Medium
IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service
- zephyr
- Denial of service
- CVSS 6.5 Medium
Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion
- zephyr
- Denial of service
- CVSS 5.3 Medium
FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference
- FLVMeta
- Denial of service
- Memory corruption
- CVSS 6.9 Medium
armink struct2json JSON Deserialization s2jdef.h S2J_STRUCT_GET_string_ELEMENT null pointer dereference
- armink struct2json
- Denial of service
- Memory corruption
- CVSS 7.5 High
Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed
- Apache Software Foundation Apache Wicket
- Denial of service
- CVSS 5.5 Medium
Uncontrolled recursion in Samsung Open Source rlottie
- Samsung Open Source rlottie
- Denial of service
- CVSS 7.5 High
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements
- Denial of service
- CWE-1284
- CVSS 6.9 Medium
klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service
- klaussilveira GitList
- Denial of service
- CVSS 7.5 High
Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Enterprise Linux 10
- Denial of service
- CVSS 8.3 High
AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
- Denial of service
>=0.1.0, <1.3.1 · fixed in 1.3.1
GHSA-wcr6-9rrw-5jhv · CVE-2026-82722 - CVSS 5.3 Medium
BareBones BBEdit Lasso Language Tokenizer infinite loop
- BareBones BBEdit
- Denial of service
- CVSS 5.3 Medium
BareBones BBEdit Java Language recursion
- BareBones BBEdit
- Denial of service
- CVSS 6.0 Medium
AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service
- Denial of service
>=0.6.0, <1.0.0 · fixed in 1.0.0
GHSA-rcx7-x2w5-mmc2 · CVE-2026-82579 - CVSS 5.3 Medium
Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS Transfer Endpoint namf-handler.c null pointer dereference
- Open5GS
- Denial of service
- Memory corruption
- CVSS 8.7 High
Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
- Denial of service
>=0.16.23, <1.11.0 · fixed in 1.11.0
GHSA-mwc4-r9fc-h6mg · CVE-2026-81636 - CVSS 5.3 Medium
Linux Foundation Magma gNB Termination ngap_amf.c denial of service
- Linux Foundation Magma
- Denial of service
- CVSS 5.9 Medium
Unbounded handle_error recursion enables denial of service in AshOban triggers
- Denial of service
>=0.8.0-rc.1, <0.8.14 · fixed in 0.8.14
GHSA-94p7-498r-mrhp · CVE-2026-78228 - CVSS 2.1 Low
Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking
- Denial of service
>=0.1.1, <0.7.0 · fixed in 0.7.0
GHSA-7c66-59m8-723c · CVE-2026-77831 - CVSS 6.2 Medium
Vulnerabilities exists in IBM Cloud Pak for Data System
- IBM Cloud Pak for Data System
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
plone.app.event vulnerable to denial of service via iCalendar import
- Denial of service
<5.2.4 || >=6.0.0a1, <6.0.1 · fixed in 5.2.4, 6.0.1
GHSA-r82h-mqw3-fc56 · CVE-2026-55247 - CVSS 7.1 High
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
- Denial of service
<0.6.2 · fixed in 0.6.2
GHSA-wjmf-p669-5m5p · CVE-2026-55520 - CVSS 9.1 CriticalCritical · CVSS 9+
plone.app.portlets vulnerable to denial of service via RSS feed portlet
- Denial of service
<5.0.8 || >=6.0.0, <6.0.4 || >=7.0.0, <7.0.2 · fixed in 5.0.8, 6.0.4, 7.0.2
GHSA-x5g3-w747-2h8q · CVE-2026-55248 - CVSS 6.3 Medium
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
- Denial of service
<0.8.0 · fixed in 0.8.0
GHSA-f9qc-qg88-7pq5 · CVE-2026-55407 - CVSS 6.5 Medium
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
- Denial of service
<1.3.3 · fixed in 1.3.3
GHSA-298f-872v-2rcx · CVE-2026-55588 - CVSS 7.5 High
datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS
- Denial of service
>=0.1.0, <0.3.3 · fixed in 0.3.3
GHSA-gpwf-4h98-v82q · CVE-2026-54788 - CVSS 8.5 High
KubeVela Terraform remote loader DoS via unbounded file read
- Path traversal
- Denial of service
<1.9.14 || >=1.10.0-alpha.1, <1.10.9 || >=1.11.0-alpha.1, <1.11.0-alpha.4 · fixed in 1.9.14, 1.10.9, 1.11.0-alpha.4
GHSA-fmgp-q6jx-gg3x · CVE-2026-55108 - CVSS 8.7 High
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
- Denial of service
<5.15.0 · fixed in 5.15.0
GHSA-x7rj-f32v-7jjg · CVE-2026-57584 - CVSS 7.5 High
WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability
- WPMU DEV Smush Image Compression and Optimization
- Denial of service
- CVSS 5.5 Medium
Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun
- Ericsson CodeChecker
- Denial of service
- CWE-409
- CVSS 5.9 Medium
Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir
- elixir
- Denial of service
- CVSS 8.2 High
filebrowser through 2.63.23 Denial of Service via named pipes
- filebrowser
- Denial of service
- CVSS 6.5 Medium
Uncontrolled recursion in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
- CVSS 6.5 Medium
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
- CVSS 4.3 Medium
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
- CVSS 7.5 High
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
- CVSS 5.9 Medium
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot CE
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
- CVSS 6.5 Medium
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
- CVSS 6.5 Medium
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
- CVSS 4.3 Medium
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
- CVSS 7.5 High
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
- CVSS 7.5 High
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
- CVSS 5.3 Medium
Memory leak in openNDS
- openNDS
- Denial of service
- CVSS 7.5 High
An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Denial of service
- CVSS 7.5 High
An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Denial of service
- CVSS 7.5 High
An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Denial of service
- CVSS 7.5 High
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion.
- Denial of service
- CVSS 8.7 High
Dimension Denial-of-Service
- WatchGuard Dimension
- Denial of service
- CVSS 6.0 Medium
RAIL 802.15.4 Mux missing ACK can lead to DoS
- Silicon Labs SiSDK
- Denial of service