Denial of service.

Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

• Apache Software Foundation Apache Kafka
• Denial of service
• CWE-409

Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection

• Juniper Networks Session Smart Router
• Memory corruption
• Denial of service

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

• Denial of service

>=0.3.1, <1.14.1 · fixed in 1.14.1

SAIL: WebP decoder division by zero through malformed animated canvas metadata

• HappySeaFox sail
• Denial of service

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing

• Progress Software Telerik Document Processing Libraries
• Denial of service
• CWE-606

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering

• Progress Software Telerik Document Processing Libraries
• Denial of service

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing

• Progress Software Telerik Document Processing Libraries
• Denial of service

Resource allocation without limits in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Denial of service

a2ui-project a2ui Parser expression_parser.ts formatString resource consumption

• a2ui
• Denial of service

a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption

• a2ui
• Denial of service

a2ui-project a2ui Binder generic-binder.ts resource consumption

• a2ui
• Denial of service

a2ui-project a2ui data-model.ts DataModel.set resource consumption

• a2ui
• Denial of service

LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response

• OpenBSD LibreSSL
• Denial of service

a2ui-project a2ui data-context Resolver data-context.ts resource consumption

• a2ui
• Denial of service

jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

• FasterXML jackson-dataformat-smile
• Denial of service

Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application…

• Denial of service

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the applic…

• Memory corruption
• Denial of service

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

• Denial of service

<0.62.0 · fixed in 0.62.0

dd-trace: ReDOS in URL query string obfuscation

• Denial of service

>=2.0.0, <5.131.1 || >=6.0.0, <6.20.1 · fixed in 5.131.1, 6.20.1

OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

• Denial of service

<1.45.0 · fixed in 1.45.0

undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

• Denial of service
• CWE-248

>=4.2.1, <6.29.1 || >=7.0.0, <7.30.1 || >=8.0.0, <8.12.2 · fixed in 6.29.1, 7.30.1, 8.12.2

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

• Denial of service
• CWE-405

>=5.15.0, <6.29.1 || >=7.0.0, <7.30.1 || >=8.0.0, <8.12.2 · fixed in 6.29.1, 7.30.1, 8.12.2

MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

• Denial of service

>=2.0.0, <2.0.1 · fixed in 2.0.1

Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

• Denial of service

>=2.0.0, <5.4.54 || >=6.0.0, <6.4.45 || >=7.0.0, <7.4.18 || >=8.0.0, <8.1.6 · fixed in 5.4.54, 6.4.45, 7.4.18, 8.1.6

Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

• Denial of service

>=4.1.0, <5.4.54 || >=6.0.1, <6.4.46 || >=7.0.0, <7.4.19 || >=8.0.0, <8.1.7 · fixed in 5.4.54, 6.4.46, 7.4.19, 8.1.7

Go JOSE: DoS when parsing JWKs that contain RSA keys

• Denial of service

<=3.0.5 · no fixed version yet

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

• Tanium Enforce
• Denial of service

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

• Tanium Enforce
• Denial of service

Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.

• Tanium Endpoint Configuration Toolset Solution
• Tanium performance-cx
• Denial of service

Tanium addressed a denial of service vulnerability in Enforce.

• Tanium Enforce
• Denial of service

Tanium addressed a denial of service vulnerability in Tanium Server.

• Tanium Server
• Denial of service

Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.

• Tanium Endpoint Configuration Toolset Solution
• Tanium threat-response-cx
• Denial of service

libXtst RECORD EnableContext Reply Endless Loop

• X.org libXtst
• Denial of service

Uncontrolled resource consumption in Nextcloud server

• Nextcloud server
• Denial of service

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

• Denial of service

<0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2 · fixed in 0.23.46, 0.24.0-dev.2

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

• Denial of service

<1.30.7 || >=2.0.0, <2.1.19 || >=2.2.0, <2.4.8 || >=3.3.0, <3.10.8 || >=4.0.0, <5.10.0 · fixed in 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

• XML external entities (XXE)
• Denial of service

<1.30.7 || >=2.0.0, <2.1.19 || >=2.2.0, <2.4.8 || >=3.3.0, <3.10.8 || >=4.0.0, <5.10.0 · fixed in 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

• XML external entities (XXE)
• Denial of service

>=3.3.0, <3.10.8 || >=4.0.0, <5.10.0 · fixed in 3.10.8, 5.10.0

dnspython dns.name.from_wire_parser() excessive CPU use

• Denial of service

<2.9.0 · fixed in 2.9.0

Datadog dd-trace-py: ReDoS in URL query string obfuscation

• Denial of service

>=1.5.0, <3.19.9 || >=4.0.0, <4.15.6 · fixed in 3.19.9, 4.15.6

snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

• Denial of service

<1.1.10.9 · fixed in 1.1.10.9

GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines

• Denial of service

<3.2.0 · fixed in 3.2.0

Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service

• Denial of service

>=3.0.0, <10.0.13 · fixed in 10.0.13

Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service

• Denial of service

>=3.0.0, <10.0.10 · fixed in 10.0.10

MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

• Denial of service
• Memory corruption

<1.2.3 · fixed in 1.2.3

vllm p2p never connected zmq_exhaustion

• Denial of service

<0.32.0 · fixed in 0.32.0

a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption

• a2aproject a2a-java
• Denial of service

fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'

• Denial of service

>=2.5.0, <2.8.8 · fixed in 2.8.8

a2aproject a2a-java ChildQueue queue.offer resource consumption

• a2aproject a2a-java
• Denial of service

Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

• Denial of service
• Insecure deserialization

>=4.0, <33.7.2 · fixed in 33.7.2

Frame poisoning in the CSS Parsing and Computation component

• Mozilla Firefox
• Mozilla Thunderbird
• Denial of service

a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service

• a2aproject a2a-go
• Denial of service

a2aproject a2a-go REST SSE handler rest.go resource consumption

• a2aproject a2a-go
• Denial of service

svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop

• darylldoyle svg-sanitizer
• Denial of service

Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity

• SemanticMediaWiki
• Denial of service

Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event

• SemanticMediaWiki
• Denial of service

Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters

• SemanticMediaWiki
• Denial of service

Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask

• SemanticMediaWiki
• Denial of service

Resource allocation without limits in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Denial of service

Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder

• Xpdf
• Denial of service
• CWE-20