Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.5 Medium
Inefficient Algorithmic Complexity in hMailServer
- Progressive Robot Ltd hMailServer
- Denial of service
- CVSS 6.5 Medium
Inefficient Algorithmic Complexity in hMailServer
- Progressive Robot Ltd hMailServer
- Denial of service
- CVSS 6.5 Medium
Inefficient Algorithmic Complexity in hMailServer
- Progressive Robot Ltd hMailServer
- Denial of service
- CVSS 7.5 High
Inefficient Algorithmic Complexity in hMailServer
- Progressive Robot Ltd hMailServer
- Denial of service
- CVSS 7.5 High
Inefficient Algorithmic Complexity in hMailServer
- Progressive Robot Ltd hMailServer
- Denial of service
- CVSS 7.5 High
Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer
- Progressive Robot Ltd hMailServer
- Denial of service
- CVSS 5.3 Medium
Inefficient Algorithmic Complexity in hMailServer
- Progressive Robot Ltd hMailServer
- Denial of service
- CVSS 6.5 Medium
Inefficient Regular Expression Complexity in hMailServer
- Progressive Robot Ltd hMailServer
- Denial of service
- CVSS 7.5 High
Inefficient Algorithmic Complexity in hMailServer
- Progressive Robot Ltd hMailServer
- Denial of service
- CVSS 5.9 Medium
GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the Supplier does not con…
- Denial of service
- CVSS 7.5 High
An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.
- Denial of service
- CVSS 6.5 Medium
Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise
- Splunk Enterprise
- Denial of service
- CVSS 4.9 Medium
Ghost: Regular Expression Denial of Service in External Media Inliner
- Denial of service
>=5.37.0, <6.67.0 · fixed in 6.67.0
GHSA-9m4w-fmjw-fvjq · CVE-2026-105645 - CVSS 4.9 Medium
Ghost: Regular Expression Denial of Service in Content Import
- Denial of service
>=4.0.0, <6.67.0 · fixed in 6.67.0
GHSA-fwh9-qg68-vxp4 · CVE-2026-105646 - CVSS 4.9 Medium
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
- Denial of service
<5.36.1 · fixed in 5.36.1
GHSA-cqgh-8p3p-mx4m · CVE-2026-106121 - CVSS 6.5 Medium
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
- Denial of service
>=2.0.0, <2.131.0 · fixed in 2.131.0
GHSA-cgc7-9qp3-86m3 · CVE-2026-105749 - CVSS 3.7 Low
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
- Denial of service
<1.11.4 · fixed in 1.11.4
GHSA-343h-94h5-c4wr · CVE-2026-106449 - CVSS 5.3 Medium
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs
- Denial of service
<1.11.4 · fixed in 1.11.4
GHSA-gm45-99xc-r7wv · CVE-2026-106450 - CVSS 5.3 Medium
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
- Denial of service
>=2.0.0, <3.2.0 || >=4.0.0, <4.1.2 · fixed in 3.2.0, 4.1.2
GHSA-wmxv-xphr-5c9g · CVE-2026-106116 - CVSS 5.3 Medium
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
- Denial of service
>=1.0.0-beta0001, <3.2.0 || >=4.0.0, <4.1.2 · fixed in 3.2.0, 4.1.2
GHSA-gwg2-r3hj-4w44 · CVE-2026-106114 - CVSS 7.5 High
Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
- Denial of service
>=2.3.1, <2.11.1-0.20260906004932-2badfcd5841d · fixed in 2.11.1-0.20260906004932-2badfcd5841d
GHSA-jrfj-fhj2-jjvm · CVE-2026-107219 - CVSS 7.1 High
Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
- Denial of service
>=2.1.0, <2.11.1 · fixed in 2.11.1
GHSA-fq3v-74gv-27gm · CVE-2026-107223 - CVSS 6.5 Medium
Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
- CVSS 6.0 Medium
Denial of Service in Absolute Secure Access
- Absolute Security Secure Access
- Denial of service
- CVSS 8.7 High
Denial of Service in Absolute Secure Access
- Absolute Security Secure Access
- Denial of service
- CVSS 7.1 High
Denial of Service in Absolute Secure Access
- Absolute Security Secure Access
- Denial of service
- CVSS 8.2 High
Denial of service vulnerability in Secure Access
- Absolute Security Secure Access
- Denial of service
- CVSS 7.3 High
Infinite Loop in Telerik Document Processing XLS Import
- Progress Software Telerik Document Processing Libraries
- Denial of service
- CVSS 4.3 Medium
Twisted: IMAP wildcardToRegexp() ReDoS
- Denial of service
<=26.4.0 · no fixed version yet
GHSA-8pqf-f4m5-798g · CVE-2026-106454 - CVSS 5.3 Medium
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header
- Denial of service
<1.11.2 · fixed in 1.11.2
GHSA-4v53-57pg-c464 · CVE-2026-106452 - CVSS 5.3 Medium
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError
- Denial of service
<1.11.2 · fixed in 1.11.2
GHSA-6cx8-rjf8-pr8g · CVE-2026-106453 - CVSS 8.7 High
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
- Denial of service
<2.23.3 · fixed in 2.23.3
GHSA-68jq-fhch-4xq4 · CVE-2026-106104 - CVSS 5.8 Medium
Cisco NX-OS Software Denial of Service Vulnerability
- Cisco NX-OS Software
- Denial of service
- CVSS 6.9 Medium
Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources
- Open5GS
- Denial of service
- CVSS 5.3 Medium
ImageMagick: Denial of service with crafted XMP profile
- ImageMagick
- Denial of service
- CVSS 4.0 Medium
ImageMagick: Policy Bypass in CUT encoder
- ImageMagick
- Broken access control
- Denial of service
- CVSS 5.3 Medium
ImageMagick: Denial of service possible when parsing an XMP profile.
- ImageMagick
- Denial of service
- CVSS 5.3 Medium
ImageMagick: Denial of service in MVG decoder
- ImageMagick
- Denial of service
- CVSS 5.3 Medium
ImageMagick: Stack Overflown CALS decoder due to missing depth check.
- ImageMagick
- Denial of service
- CVSS 4.3 Medium
ImageMagick: Denial of service in distributed pixel cache server
- ImageMagick
- Denial of service
- CVSS 5.3 Medium
ImageMagick: Denial of service in ASE decoder because of missing security checks
- ImageMagick
- Denial of service
- CVSS 5.3 Medium
ImageMagick: Infinite Loop when reading a crafted XMP profile
- ImageMagick
- Denial of service
- CVSS 5.9 Medium
ImageMagick: Infinite Loop in PSD decoder on 32-bit builds
- ImageMagick
- Denial of service
- CWE-196
- CVSS 5.9 Medium
ImageMagick: Infinite Loop in bzip2 compressed images.
- ImageMagick
- Denial of service
- CVSS 6.2 Medium
M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Denial of service
- CVSS 7.1 High
MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
- miniupnp project miniupnpd
- Denial of service
- CVSS 6.9 Medium
wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion
- wolfSSL Inc. wolfSSH
- Denial of service
- CWE-372
- CVSS 4.3 Medium
Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Denial of service
- CVSS 5.5 Medium
Sssd: sssd-kcm: local denial of service via excessive memory preallocation
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Denial of service
- CVSS 6.5 Medium
Gitea migration memory exhaustion from zero page size
- Gitea
- Denial of service
- CVSS 7.2 High
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
- Denial of service
- CWE-693
>=3.0.0, <3.8.1 · fixed in 3.8.1
GHSA-6r3q-mjv7-xr8m · CVE-2026-41510 - CVSS 4.7 Medium
Sssd: sssd: denial of service via race condition in autofs responder
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Denial of service
- CVSS 7.5 High
CVE-2026-106550
- Mozilla Node-convict
- Denial of service
- Broken access control
- CVSS 6.2 Medium
Sssd: sssd: denial of service via incomplete identity provider authentication requests
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Denial of service
- CVSS 6.5 Medium
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 6.5 Medium
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service
- CVSS 4.3 Medium
Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service
- Elasticsearch
- Denial of service