Denial of service.

cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths

• PelionIoT cbor-sync
• Denial of service

IBM Power Systems Firmware Denial of Service

• IBM Virtualization Management Interface
• Denial of service

Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)

• Red Hat OpenStack Platform 18.0
• Denial of service

IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions

• IBM Db2
• Denial of service

Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction

• ZcashFoundation zebra
• Denial of service

Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count

• GitoxideLabs gix-pack
• Denial of service

Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

• GitoxideLabs gix-pack
• Denial of service

gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header

• GitoxideLabs gix-pack
• Denial of service

Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

• GitoxideLabs gix-mailmap
• Denial of service

SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering

• surrealdb
• surrealdb surrealism-runtime
• Denial of service

SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

• siyuan
• Denial of service

Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation

• open-webui
• Denial of service

Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex

• open-webui
• Denial of service

Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules

• open-webui
• Denial of service
• CWE-436

Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop

• open-webui
• Denial of service

Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

• open-webui
• Denial of service
• CWE-409

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation

• ImageMagick
• Denial of service

ImageMagick before 7.1.2-32 Policy Bypass via -script Operation

• ImageMagick
• Denial of service

ImageMagick before 7.1.2-32 Memory Leak via -process Option

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder

• ImageMagick
• Denial of service

FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer

• FreeRDP
• Denial of service

Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

• hex
• Denial of service
• CWE-409

SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters

• sgl-project sglang
• Denial of service

SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing

• sgl-project sglang
• Denial of service

SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload

• sgl-project sglang
• Denial of service

LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet

• LogicalDOC Community Edition
• Denial of service

zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service

• zhayujie CowAgent
• Denial of service

zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources

• zhayujie CowAgent
• Denial of service

Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure

• zephyr
• Denial of service
• CWE-459

Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update

• zephyr
• Denial of service
• CWE-459

Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures

• zephyr
• Denial of service

zhayujie CowAgent Media Download memory allocation

• zhayujie CowAgent
• Denial of service

zhayujie CowAgent Web Console upload read denial of service

• zhayujie CowAgent
• Denial of service

mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering

• mark3labs mcp-go
• Denial of service

zhayujie CowAgent Web Console web_channel.py denial of service

• zhayujie CowAgent
• Denial of service

Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption

• Konstanty Bialkowski libmodplug
• Denial of service

Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint

• hatchet
• Denial of service

Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

• quarkiverse quarkus-langchain4j
• Denial of service

MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket

• modelcontextprotocol kotlin-sdk
• Denial of service

WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service

• WooCommerce Bookings
• Denial of service

Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS

• Denial of service

>=0.1.0, <3.1.2 · fixed in 3.1.2

SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing

• SillyTavern
• Denial of service

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

• Denial of service

>=1.9.10-0.20260729084040-acb59fdd81db, <1.9.10-0.20260901043436-8c9b9a1aff21 · fixed in 1.9.10-0.20260901043436-8c9b9a1aff21

Contao: The registration module re-sends activation mails

• Denial of service
• CWE-204

>=4.1.0, <5.3.50 || >=5.4.0-RC1, <5.7.12 · fixed in 5.3.50, 5.7.12

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

• Denial of service

>=2.5.0, <2.6.0 · fixed in 2.6.0

Vikunja: Unbounded CSV row cardinality permits API process termination

• Denial of service

>=2.5.0, <2.6.0 · fixed in 2.6.0

Vikunja: Unbounded nested task-filter recursion permits API process termination

• Denial of service

>=2.5.0, <2.6.0 · fixed in 2.6.0

Vikunja: Denial of service via decompression bomb in the data import

• Denial of service
• CWE-409

<2.6.0 · fixed in 2.6.0

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

• Denial of service

<2.6.0 · fixed in 2.6.0

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

• Denial of service

<1.8.2-0.20260809203301-1dd40166a593 · fixed in 1.8.2-0.20260809203301-1dd40166a593

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

• Denial of service

<0.0.0-20260727191436-61e31ead04a4 · fixed in 0.0.0-20260727191436-61e31ead04a4

RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

• RIOT
• Denial of service
• CWE-252

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

• Denial of service
• CWE-20

<0.5.0b3.dev101 · fixed in 0.5.0b3.dev101

Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

• Denial of service

* · no fixed version yet

Red Lion Controls N-Tron 700 Series Reachable Assertion

• Red Lion Controls 700 Series
• Denial of service