Denial of service.

erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service

• Denial of service

>=1.7.7, <1.11.13 · fixed in 1.11.13

Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

• Denial of service

>=1.5.0, <1.11.13 · fixed in 1.11.13

Resource Exhaustion in MICE Service

• WolfVision Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
• WolfVision Cynap Pure (Next Gen)
• Denial of service

ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion

• ggml-org llama.cpp
• Denial of service

BUG-000186514 - ArcGIS Server has a security vulnerability.

• Esri ArcGIS Server
• Denial of service

Consul vulnerable to a denial of service in HTTP APIs

• HashiCorp Consul
• HashiCorp Consul Enterprise
• Denial of service

Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses

• zephyr
• Denial of service
• Memory corruption

Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity

• zephyr
• Denial of service

Apache Vysper: Unbounded allocation

• Apache Software Foundation Apache Vysper
• Denial of service

Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

• Mattermost
• Denial of service

Unbounded response body buffering and decompression in hackney

• Denial of service
• CWE-409

>=2.0.0-beta.1, <4.9.0 · fixed in 4.9.0

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

• Denial of service

>=0.3.4, <1.14.0 · fixed in 1.14.0

Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

• Denial of service

>=0.3.6, <1.14.0 · fixed in 1.14.0

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

• Denial of service

>=0.1.0, <1.14.0 · fixed in 1.14.0

Quadratic bignum parsing of Content-Length and Host port values in Bandit

• Denial of service

>=1.0.0-pre.7, <1.14.0 · fixed in 1.14.0

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

• Denial of service

>=1.11.0, <1.14.0 · fixed in 1.14.0

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

• Denial of service

>=1.4.0, <1.14.0 · fixed in 1.14.0

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

• Denial of service

>=0.3.1, <1.14.0 · fixed in 1.14.0

NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources

• NocoDB
• Denial of service

libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c.

• Denial of service

smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation

• smg
• Denial of service

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length

• Denial of service

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

• Denial of service

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

• Denial of service

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers

• Denial of service

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Im...

• Denial of service

>=0.10.2, <0.25.0 · fixed in 0.25.0

vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

• vllm
• Denial of service

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option

• ImageMagick
• Denial of service

ImageMagick before 7.1.2-33 Memory Leak in magick compare

• ImageMagick
• Denial of service

ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit

• ImageMagick
• Denial of service

ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder

• ImageMagick
• Denial of service

ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder

• ImageMagick
• Denial of service

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders

• ImageMagick
• Denial of service

ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder

• ImageMagick
• Denial of service

Travisun Opptrix preParsing handler webhook Buffer.concat denial of service

• Travisun Opptrix
• Denial of service

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters

• Denial of service

Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

• Crow
• Denial of service

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

• Denial of service

>=6.5.0, <6.29.1 || >=7.0.0, <7.30.1 || >=8.0.0, <8.12.2 · fixed in 6.29.1, 7.30.1, 8.12.2

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

• Denial of service
• CWE-248

>=2.0.0, <2.5.0 · fixed in 2.5.0

postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

• Denial of service

>=3.0.0, <4.0.8 · fixed in 4.0.8

vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

• Denial of service

>=0.7.3, <0.31.0 · fixed in 0.31.0

pypdf: Possible long runtimes for repeated references to the same missing object

• Denial of service

<6.21.2 · fixed in 6.21.2

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

• Denial of service

<6.21.2 · fixed in 6.21.2

pypdf: Possible long runtimes for large xref table header limits

• Denial of service

<6.21.2 · fixed in 6.21.2

Echo: WebSocket proxy can retain connections and handlers after client disconnect

• Denial of service

>=4.15.0, <4.16.1 · fixed in 4.16.1

Echo: Decompress permits unbounded gzip expansion in v4

• Denial of service
• CWE-409

>=4.0.0, <4.16.1 · fixed in 4.16.1

Echo: BodyDump captures request and response bodies without size limits in v4

• Denial of service

>=4.0.0, <4.16.1 · fixed in 4.16.1

Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

• Denial of service

<26.10.0rc1 · fixed in 26.10.0rc1

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

• Denial of service

<26.10.0rc1 · fixed in 26.10.0rc1

Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

• Denial of service

<26.10.0rc1 · fixed in 26.10.0rc1

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

• Denial of service

<26.10.0rc1 · fixed in 26.10.0rc1

Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt

• qt
• Denial of service

Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s

• Eclipse Foundation Eclipse KeyPont - GOSE
• Denial of service

Part-DB: Attachment Size Limit Bypass via API Base64 Upload

• Part-DB-server
• Denial of service