Denial of service.

js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input

• sunnyadn js-toml
• Denial of service

icalendar: Denial of service via unbounded VALARM REPEAT expansion

• collective icalendar
• Denial of service

Bridge | Uncontrolled Recursion (CWE-674)

• Adobe Bridge
• Denial of service

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

• Adobe Content Credentials Rust SDK
• Adobe Content Credentials Command-Line Tool
• Denial of service

Uncontrolled recursion in Ubiquiti Inc Dream Machines and others

• Ubiquiti Inc Dream Machines
• Ubiquiti Inc Enterprise Firewalls
• Denial of service

Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent

• netdata
• Denial of service
• CWE-193

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

• GitroomHQ postiz-app
• Authentication bypass
• Denial of service

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

• vector
• Denial of service
• CWE-130

radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser

• radareorg radare2
• Denial of service

radare2: Uncontrolled memory allocation in radare2 dmp64 parser

• radareorg radare2
• Denial of service

radare2: Uncontrolled resource consumption in radare2 PEF loader

• radareorg radare2
• Denial of service

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

• Denial of service

<2.4.0 · fixed in 2.4.0

Uncontrolled resource consumption in NVIDIA Infrastructure Controller

• NVIDIA Infrastructure Controller
• Denial of service

Uncontrolled resource consumption in NVIDIA Infrastructure Controller

• NVIDIA Infrastructure Controller
• Denial of service

Unbounded post ID array in the bulk reactions endpoint allows denial of service

• Mattermost
• Denial of service

Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder

• Erlang OTP
• Denial of service

SSH daemon allocates unbounded idle session channels, bypassing max_channels

• Erlang OTP
• Denial of service

Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode

• Denial of service
• CWE-1286

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii

• Denial of service

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode

• Denial of service

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode

• Denial of service

Duplicate Advisory: vllm p2p never connected zmq_exhaustion

• Denial of service

<0.30.0 · fixed in 0.30.0

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files.

• Denial of service

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply ar...

• Denial of service

<0.30.0 · fixed in 0.30.0

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can ...

• Denial of service

<0.30.0 · fixed in 0.30.0

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requ...

• Denial of service

<0.30.0 · fixed in 0.30.0

vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision

• vllm
• Denial of service

nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

• Denial of service

>=0.0.0-20260126024607-cbaf0fc16ed8, <0.0.0-20260526022344-0c988fc1277c · fixed in 0.0.0-20260526022344-0c988fc1277c

Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

• envoy
• Denial of service

Denial-of-Service in the OpenCanary Redis service

• Thinkst Applied Research OpenCanary
• Denial of service

Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service

• Red Hat Build of Apache Camel 3.33.4.redhat
• Red Hat build of Quarkus 3.27.6.redhat
• Denial of service

Denial-of-Service in the Thinkst Canary Redis service

• Thinkst Applied Research Canary
• Denial of service

temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip

• Temporal Technologies, Inc. temporalio/ringpop-go
• Denial of service

temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal

• Temporal Technologies, Inc. temporalio/sqlparser
• Temporal Technologies, Inc. Temporal Server
• Denial of service

Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

• Apache Software Foundation Apache Neethi
• Denial of service

Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

• Apache Software Foundation Apache Neethi
• Denial of service

Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

• Apache Software Foundation Apache Neethi
• Denial of service

Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

• Apache Software Foundation Apache Neethi
• Denial of service

Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

• Apache Software Foundation Apache Neethi
• Denial of service

Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

• Apache Software Foundation Apache MINA
• Denial of service
• CWE-409

Hangzhou Shunwang Technology shzh IRP_MJ_DEVICE_CONTROL shdrv_x64.sys sub_180004AC0 denial of service

• Hangzhou Shunwang Technology shzh
• Denial of service

OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service

• OpenClaw
• Denial of service

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width

• Denial of service

Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption

• OISF suricata
• Denial of service

Suricata app-layer: passed flows can retain transactions, causing resource exhaustion

• OISF suricata
• Denial of service

Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption

• OISF suricata
• Denial of service

Suricata smb: some SMB flows can cause resource exhaustion

• OISF suricata
• Denial of service

Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption

• OISF suricata
• Denial of service
• CWE-409

Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages

• OISF suricata
• Denial of service

Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion

• OISF suricata
• Denial of service

SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx

• sgl-project sglang
• Denial of service

Reachable assertion at ranap_handle_co_dt()

• Osmocom osmo-iuh
• Denial of service

Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

• Denial of service

<=3.0.3 · no fixed version yet

c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

• c-ares
• Denial of service

c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

• c-ares
• Denial of service

Icinga 2: Stack overflow via deeply nested JSON objects

• icinga2
• Denial of service

Denial of service via unbounded regex matching in Mongoid's in-memory query matcher

• MongoDB Inc. Mongoid
• Denial of service

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

• Denial of service

<0.6.1 · fixed in 0.6.1

AnyIO process-pool workers can block indefinitely on undrained stderr

• Denial of service

<4.14.2 · fixed in 4.14.2