Denial of service.

authentik: Denial of Service via Document Type Declarations in SAML Messages

• authentik
• Denial of service

HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread

• rejetto hfs2
• Denial of service

Velociraptor Authenticated Denial of Service

• Rapid7 Velociraptor
• Denial of service

`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification

• Denial of service

Published by the maintainers · not yet reviewed by GitHub

>=47.0.0, <48.0.3 || >=49.0.0, <49.0.1 · fixed in 48.0.3, 49.0.1

Dynamic record lifting can allocate beyond the hostcall fuel limit

• Denial of service

Published by the maintainers · not yet reviewed by GitHub

>=0.0.0-0, <36.0.16 || >=37.0.0, <48.0.3 || >=49.0.0, <49.0.1 · fixed in 36.0.16, 48.0.3, 49.0.1

Outgoing HTTP body write allows guest-driven host memory exhaustion

• Denial of service

Published by the maintainers · not yet reviewed by GitHub

>=0.0.0-0, <36.0.16 || >=37.0.0, <48.0.3 || >=49.0.0, <49.0.1 · fixed in 36.0.16, 48.0.3, 49.0.1

kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources

• kvcache-ai mooncake
• Denial of service

Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing.

• Denial of service

hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.

• Denial of service

libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format().

• Denial of service

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

• Denial of service
• CWE-436

<1.4.29 · fixed in 1.4.29

plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length

• Denial of service

<3.0.12 || >=4.0.0, <4.0.10 || >=5.0.0, <5.0.1 · fixed in 3.0.12, 4.0.10, 5.0.1

plone.app.dexterity has a Denial of Service due to excessive title or description length

• Denial of service

<3.2.3 || >=4.0.0, <4.1.3 || >=5.0.0, <5.0.1 · fixed in 3.2.3, 4.1.3, 5.0.1

Jawn: Quadratic parsing effort in AsyncParser

• Denial of service

<1.7.0 · fixed in 1.7.0

Jawn: Uncontrolled nesting depth in JSON parser

• Denial of service

<1.7.0 · fixed in 1.7.0

RabbitMQ: ReDoS via management API ?name= filter

• rabbitmq-server
• Denial of service

RabbitMQ: Consistent-hash exchange unbounded weight

• rabbitmq-server
• Denial of service

RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component

• rabbitmq-server
• Denial of service

RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size

• rabbitmq-server
• Denial of service

RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata

• rabbitmq-server
• Denial of service

RabbitMQ: Super-stream partitions unbounded allocation

• rabbitmq-server
• Denial of service

RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

• rabbitmq-server
• Denial of service

RabbitMQ: Atom table exhaustion via stream `chunk_selector`

• rabbitmq-server
• Denial of service

RabbitMQ: Stream protocol skips per vhost per user connection limits

• rabbitmq-server
• Denial of service

RabbitMQ: JMS topic exchange erl_scan atom exhaustion

• rabbitmq-server
• Denial of service

RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS

• rabbitmq-server
• Denial of service

RabbitMQ: Atom-table exhaustion via reply-to queue name decoding

• rabbitmq-server
• Denial of service

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

• Denial of service

<1.7.20 · fixed in 1.7.20

JLine: ReDoS in Built-in Less Viewer Search

• jline3
• Denial of service

JLine: ReDoS in Nano Editor Regex Search Mode

• Denial of service

>=4.0.0, <4.3.1 || >=3.0.0, <3.30.15 · fixed in 4.3.1, 3.30.15

JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

• Denial of service

>=4.0.0, <4.3.1 || >=3.0.0, <3.30.15 · fixed in 4.3.1, 3.30.15

JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

• Denial of service

>=4.0.0, <4.3.1 || >=3.0.0, <3.30.15 · fixed in 4.3.1, 3.30.15

Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.2 Extended Update Support
• Denial of service

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

• Denial of service
• Broken access control

<0.18.1 · fixed in 0.18.1

Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer

• PgBouncer
• Denial of service

Integer overflow causes an infinite loop in packet buffer growth in PgBouncer

• PgBouncer
• Memory corruption
• Denial of service

Resource allocation without limits in Robur Albatross

• Robur Albatross
• Denial of service

Plug: quadratic-time decoding of nested query/body parameters enables denial of service

• Denial of service

>=1.15.0, <1.15.5 || >=1.16.0, <1.16.4 || >=1.17.0, <1.17.2 || >=1.18.0, <1.18.3 || >=1.19.0, <1.19.3 · fixed in 1.15.5, 1.16.4, 1.17.2, 1.18.3, 1.19.3

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

• Denial of service

<0.14.0 · fixed in 0.14.0

Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

• Denial of service

<0.14.0 · fixed in 0.14.0

Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt

• qt
• Denial of service

Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout

• Apache Software Foundation Apache Tomcat
• Denial of service
• CWE-1025

Apache Tomcat: AJP DoS via missing request body

• Apache Software Foundation Apache Tomcat
• Denial of service

Apache Tomcat: DoS via busy wait during WebSocket close

• Apache Software Foundation Apache Tomcat
• Denial of service

Apache Sling XSS: Missing parser resource limits

• Apache Software Foundation Apache Sling XSS
• Denial of service

WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion

• WP Recipe Maker
• Denial of service

Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

• divi-dash
• Denial of service

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Denial of service

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• Denial of service

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• Denial of service

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

• Race condition
• Denial of service

<4.0.0-20260715025621-7329602751c0 · fixed in 4.0.0-20260715025621-7329602751c0

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

• Denial of service
• CWE-409

<26.7.1 · fixed in 26.7.1

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

• Denial of service

>=1.0.0, <1.21.2 || >=1.22.0, <1.22.2 || >=1.23.0, <1.23.1 · fixed in 1.21.2, 1.22.2, 1.23.1

Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

• Mattermost
• Denial of service

SIPGO: DoS via unvalidated WebSocket frame length

• Denial of service

<1.4.3 · fixed in 1.4.3

Potential denial of service when configured to send Retry packets in s2n-quic

• AWS s2n-quic
• Denial of service
• CWE-1284

SIPGO: DoS via unvalidated Content-Length in the stream parser

• Denial of service

<1.4.1 · fixed in 1.4.1

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

• Denial of service

>=3.0.0, <3.11.1 · fixed in 3.11.1

psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

• Denial of service

<1.17.4 · fixed in 1.17.4

Unauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

• Hewlett Packard Enterprise (HPE) ALE
• Denial of service