Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
- Denial of service
>=1.8.0, <1.30.0 || >=2.0.0, <2.2.0 · fixed in 1.30.0, 2.2.0
GHSA-84m7-p3x7-pcfv · CVE-2026-59951 - CVSS 7.5 High
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
- Denial of service
>=1.0.0, <1.11.1 · fixed in 1.11.1
GHSA-g4f2-2pf3-2pwj · CVE-2026-104827 - CVSS 8.7 High
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
- Denial of service
<8.2.2 || >=9.0.0, <9.1.1 · fixed in 8.2.2, 9.1.1
GHSA-524c-h47v-m3h8 · CVE-2026-104150 - CVSS 7.5 High
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction
- Denial of service
<7.6.1 · fixed in 7.6.1
GHSA-h9h9-2rmf-rvhp · CVE-2026-97370 - CVSS 8.2 High
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
- Denial of service
<1.7.6 · fixed in 1.7.6
GHSA-663m-7x7m-g4fw · CVE-2026-77622 - CVSS 6.5 Medium
OpenNMS denial of service via XML entity expansion
- The OpenNMS Group Meridian
- The OpenNMS Group Horizon
- Denial of service
- CVSS 6.9 Medium
Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api
- Lychee
- Denial of service
- CVSS 7.1 High
Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path
- Lychee
- Denial of service
- CVSS 6.5 Medium
Resource allocation without limits in Eclipse Foundation Eclipse Connected Services Platform
- Eclipse Foundation Eclipse Connected Services Platform
- Denial of service
- CWE-348
- CVSS 8.2 High
Resource allocation without limits in Eclipse Foundation Eclipse Vert.x
- Eclipse Foundation Eclipse Vert.x
- Denial of service
- CVSS 8.7 High
Inefficient algorithmic complexity in Eclipse Foundation Eclipse Vert.x
- Eclipse Foundation Eclipse Vert.x
- Denial of service
- CVSS 8.2 High
Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0…
- Eclipse Foundation Eclipse Vert.x
- Denial of service
- CVSS 8.2 High
Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0…
- Eclipse Foundation Eclipse Vert.x
- Denial of service
- CVSS 8.2 High
Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0…
- Eclipse Foundation Eclipse Vert.x
- Denial of service
- CVSS 8.2 High
Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0…
- Eclipse Foundation Eclipse Vert.x
- Denial of service
- CVSS 8.2 High
Uncontrolled resource consumption in Eclipse Foundation Eclipse Vert.x
- Eclipse Foundation Eclipse Vert.x
- Denial of service
- CVSS 8.2 High
Resource allocation without limits in Eclipse Foundation Eclipse Vert.x
- Eclipse Foundation Eclipse Vert.x
- Denial of service
- CVSS 8.7 High
Resource allocation without limits in Eclipse Foundation Eclipse Vert.x
- Eclipse Foundation Eclipse Vert.x
- Denial of service
- CVSS 8.7 High
Resource allocation without limits in Eclipse Foundation Eclipse Vert.x
- Eclipse Foundation Eclipse Vert.x
- Denial of service
- CVSS 8.7 High
Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
- Denial of service
Published by the maintainers · not yet reviewed by GitHub
<5.4.54 || >=6, <6.4.48 || >=7, <7.4.21 || >=8, <8.1.9 · fixed in 5.4.54, 6.4.48, 7.4.21, 8.1.9
GHSA-7rpj-w9pf-39rr · CVE-2026-109449 - CVSS 6.5 Medium
Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
- Denial of service
>=3.0.0, <=10.0.9 · no fixed version yet
GHSA-wxxx-r42m-9rp8 - CVSS 7.5 High
An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph…
- Denial of service
- CVSS 7.5 High
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an app…
- Denial of service
- CVSS 7.5 High
A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS)…
- Denial of service
- CVSS 5.3 Medium
sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service
- sgl-project SGLang
- Denial of service
- CVSS 5.3 Medium
sgl-project SGLang generate Endpoint io_struct.py denial of service
- sgl-project SGLang
- Denial of service
- CVSS 8.2 High
n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
- n8n
- Denial of service
- CVSS 7.1 High
FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type
- FreeRDP
- Denial of service
- CVSS 8.2 High
FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy
- FreeRDP
- Denial of service
- CVSS 7.1 High
FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST
- FreeRDP
- Denial of service
- CVSS 8.2 High
FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE
- FreeRDP
- Denial of service
- CVSS 7.5 High
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
- Denial of service
<1.6.30 · fixed in 1.6.30
GHSA-7pxr-59rr-hqj2 · CVE-2026-72923 - CVSS 7.5 High
Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
- modelcontextprotocol python-sdk
- Denial of service
- CVSS 7.5 High
Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies
- io.modelcontextprotocol.sdk:mcp
- io.modelcontextprotocol.sdk:mcp-core
- Denial of service
- CVSS 7.5 High
Infinite loop on empty option name in startup options parameter in PgBouncer
- PgBouncer
- Denial of service
- CVSS 5.9 Medium
Integer overflow causes an infinite loop in message buffer growth in PgBouncer
- PgBouncer
- Memory corruption
- Denial of service
- CVSS 6.5 Medium
F´: SendPartial Integer Overflow Leading to Assertion DoS
- nasa fprime
- Memory corruption
- Denial of service
- CVSS 7.1 High
Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 7.5 High
F´: FileUplink Unknown Packet Type Assertion DoS
- nasa fprime
- Denial of service
- CVSS 7.5 High
F´: GenericHub Malformed Buffer Assertion DoS
- nasa fprime
- Denial of service
- CVSS 7.1 High
Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd crash when prefix-SID best-route installation is used
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 6.5 Medium
F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge
- nasa fprime
- Memory corruption
- Denial of service
- CVSS 6.5 Medium
F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion
- nasa fprime
- Memory corruption
- Denial of service
- CVSS 8.7 High
Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 5.9 Medium
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
- Denial of service
>=0.14.0, <0.20.1 · fixed in 0.20.1
GHSA-phm5-m6cj-5382 · CVE-2026-96596 - CVSS 7.1 High
Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabled
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 8.7 High
HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
- Denial of service
>=1.4.0, <1.13.0 · fixed in 1.13.0
GHSA-69m6-wcv4-rwcf · CVE-2026-105659 - CVSS 6.9 Medium
Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 7.1 High
Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 7.1 High
Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled
- Juniper Networks Junos OS
- Denial of service
- CVSS 8.7 High
Junos OS: MX Series: An attacker causes a Routing Engine denial of service when SCTP service is used
- Juniper Networks Junos OS
- Denial of service
- CVSS 8.7 High
Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 7.1 High
Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 7.1 High
Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 7.1 High
Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 7.1 High
Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 7.1 High
Junos OS and Junos OS Evolved: Unintended l2ald memory allocation causes a denial of service when static MAC IP configurations are present
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 8.7 High
Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 8.7 High
Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service
- CVSS 8.7 High
Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Denial of service