Denial of service.

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

• Denial of service

<3.14.4 · fixed in 3.14.4

russh: Unbounded memory allocation in agent protocol server via crafted constraint records

• Denial of service

<0.64.1 · fixed in 0.64.1

IBM MQ Denial of Service

• IBM MQ
• Denial of service

IBM MQ Denial of Service

• IBM MQ Operator
• IBM MQ Advanced container images
• Denial of service

Unbounded Recursion in phongo_bson_visit_document/visit_array:

• MongoDB Inc. PHP Driver
• Denial of service

MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption

• MemTensor memmy-agent
• Denial of service

Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

• micromatch picomatch
• Denial of service

libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points

• VideoLAN libbluray
• Denial of service

SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx

• sgl-project sglang
• Denial of service

SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations

• sgl-project sglang
• Denial of service

Denial-of-service vulnerability in the SVG parser and renderer impacts Qt

• qt
• Denial of service

Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Apache Kylin: Potential computed-column resource exhaustion

• Apache Software Foundation Apache Kylin
• Denial of service

sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service

• sgl-project SGLang
• Denial of service

sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service

• sgl-project SGLang
• Denial of service

Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service

• Koozali SME Server
• Code injection
• Denial of service

A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media…

• Denial of service

Gitea Actions artifact v4 API unbounded request body

• Gitea
• Denial of service

Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing

• schroedinger
• Denial of service

libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count

• libspatialite
• Denial of service

OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()

• OW2 ASM
• Denial of service

AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources

• AUTOMATIC1111 stable-diffusion-webui
• Denial of service

libtta through 2.3 Divide by Zero via tta_decoder_init_get_info

• True Audio libtta
• Denial of service

Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

• Denial of service

<=10.7.3 · no fixed version yet

Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing

• fleet
• Denial of service

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination

• thorsten phpMyFAQ
• Denial of service

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline

• Denial of service

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline

• Denial of service

Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment

• Denial of service

jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service

• FasterXML jackson-core
• Denial of service

swoosh has email-derived URL path injection in Microsoft Graph endpoint

• Denial of service
• CWE-116

>=1.12.0, <1.26.3 · fixed in 1.26.3

Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns

• recipes
• Denial of service

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge

• AmauriC tarteaucitron.js
• Denial of service

dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open

• Dicklesworthstone destructive_command_guard
• Denial of service
• CWE-693

libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU

• mz-automation libiec61850
• Memory corruption
• Denial of service

pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing

• pupnp
• Denial of service

libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered

• pupnp
• Denial of service

pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow

• pupnp
• Denial of service

libp2p-rust: Gossipsub GRAFT topics unbounded growth

• rust-libp2p
• Denial of service

J4Care dcm4che Inefficient Algorithmic Complexity

• J4Care dcm4chee-arc-light
• Denial of service

J4Care dcm4che Loop with Unreachable Exit Condition

• J4Care dcm4chee-arc-light
• Denial of service

J4Care dcm4che Loop with Unreachable Exit Condition

• J4Care dcm4chee-arc-light
• Denial of service

gocsaf/csaf: csaf_provider prone to uncontrolled resource consumption

• gocsaf Development Community csaf_provider
• Denial of service

Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

• Mattermost
• Denial of service

Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

• Mattermost
• Denial of service

Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

• nezha
• Denial of service

Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

• nezha
• Denial of service

FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser

• FreeRDP
• Denial of service

FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

• FreeRDP
• Denial of service

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c).

• Denial of service

Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER

• dragonfly
• Denial of service

ASP.NET Core Denial of Service Vulnerability

• Microsoft Visual Studio 2022 version 17.14
• Microsoft Visual Studio 2026 version 18.10
• Denial of service

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

• Denial of service
• Broken access control

>=0.0.98, <1.6.0 · fixed in 1.6.0

containerd: Unpack DoS via repeated opaque whiteouts

• Denial of service

<1.7.35 · fixed in 1.7.35

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

• Denial of service

<0.149.0 · fixed in 0.149.0

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

• Denial of service
• CWE-1050

>=0.145.0, <0.146.0 · fixed in 0.146.0

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

• Denial of service

>=2.0.0, <2.3.0 · fixed in 2.3.0