Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.7 High
Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-130
- CVSS 8.2 High
Apache Thrift: c_glib `read_all` spins when the underlying read returns 0
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 5.1 Medium
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
- Denial of service
Published by the maintainers · not yet reviewed by GitHub
>=0.0.0-0, <36.0.17 || >=37.0.0, <48.0.4 || >=49.0.0, <49.0.2 · fixed in 36.0.17, 48.0.4, 49.0.2
GHSA-j366-h8gg-77pm · CVE-2026-115380 - CVSS 5.9 Medium
Excessive allocated memory on the host when guests don't have stdio
- Denial of service
Published by the maintainers · not yet reviewed by GitHub
>=0.0.0-0, <36.0.17 || >=37.0.0, <48.0.4 || >=49.0.0, <49.0.2 · fixed in 36.0.17, 48.0.4, 49.0.2
GHSA-gqmc-89g8-p25r · CVE-2026-115381 - CVSS 8.2 High
Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 6.3 Medium
Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 6.3 Medium
Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-248
- CVSS 8.7 High
Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service
- Apache Software Foundation Apache Thrift
- Memory corruption
- Denial of service
- CVSS 6.9 Medium
YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint
- yeswiki
- Denial of service
- CVSS 8.7 High
Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely
- Apache Software Foundation Apache Thrift
- Denial of service
- Prototype pollution
- CVSS 6.9 Medium
Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages
- ZcashFoundation zebra
- Denial of service
- CVSS 6.9 Medium
Zebra before 11.0.0 Denial of Service via getblock Verbosity 2
- ZcashFoundation zebra
- Denial of service
- CVSS 8.2 High
Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check
- ZcashFoundation zebra
- Denial of service
- CVSS 8.7 High
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes…
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-1284
- CVSS 8.2 High
Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-755
- CVSS 8.7 High
Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-248
- CVSS 8.7 High
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pe…
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-130
- CVSS 8.7 High
Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-1284
- CVSS 8.7 High
Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id
- Apache Software Foundation Apache Thrift
- Memory corruption
- Denial of service
- CVSS 8.7 High
Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-130
- CVSS 8.2 High
Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-1188
- CVSS 7.5 High
Apache Directory LDAP API: Denial of service via crafted telephone number values
- Apache Software Foundation Apache Directory LDAP API
- Denial of service
- CVSS 8.2 High
Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-248
- CVSS 7.5 High
Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode
- Apache Software Foundation Apache Directory LDAP API
- Denial of service
- CVSS 8.7 High
Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-130
- CVSS 5.5 Medium
Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader
- Red Hat Hardened Images
- Red Hat build of OpenJDK 11 ELS
- Denial of service
- CVSS 5.3 Medium
Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points
- Legion of the Bouncy Castle Inc. BC-JAVA
- Legion of the Bouncy Castle Inc. BC-LTS-JAVA
- Denial of service
- CVSS 8.7 High
Quadratic-time escaping when converting X.509 distinguished names to strings
- Legion of the Bouncy Castle Inc. bc-csharp
- Denial of service
- CVSS 8.7 High
Unbounded HSS public key level count allows huge array allocation during signature verification
- Legion of the Bouncy Castle Inc. bc-csharp
- Denial of service
- CVSS 8.7 High
Unbounded ASN.1 nesting depth causes process-terminating stack overflow
- Legion of the Bouncy Castle Inc. bc-csharp
- Denial of service
- CVSS 7.1 High
Unbounded PBE iteration count when decrypting PKCS#8 private keys
- Legion of the Bouncy Castle Inc. bc-csharp
- Denial of service
- CVSS 7.1 High
PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count
- Legion of the Bouncy Castle Inc. bc-csharp
- Denial of service
- CVSS 8.7 High
Unbounded allocation from OpenPGP signature and user attribute subpacket lengths
- Legion of the Bouncy Castle Inc. bc-csharp
- Denial of service
- CVSS 7.1 High
Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files
- Legion of the Bouncy Castle Inc. bc-csharp
- Denial of service
- CVSS 7.1 High
Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links
- Legion of the Bouncy Castle Inc. bc-csharp
- Denial of service
- CVSS 8.7 High
Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion
- Legion of the Bouncy Castle Inc. bc-csharp
- Denial of service
- CVSS 8.7 High
DTLS handshake reassembler allocates buffer from unchecked 24-bit length
- Legion of the Bouncy Castle Inc. bc-csharp
- Denial of service
- CVSS 7.5 High
OMGF < 6.3.11 - Unauthenticated DoS via do_optimize
- OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
- Denial of service
- CVSS 7.5 High
crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x
- Denial of service
- CVSS 8.7 High
Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue
- kvcache-ai Mooncake
- Denial of service
- CVSS 8.2 High
Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write
- kvcache-ai Mooncake
- Denial of service
- CVSS 7.5 High
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue
- Red Hat Directory Server 11
- Red Hat Directory Server 12
- Denial of service