Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.9 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle Agile Product Lifecycle Management for Process
- Oracle Corporation Oracle Agile Product Lifecycle Management for Process
- Denial of service
- CVSS 6.1 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle Product Lifecycle Analytics
- Oracle Corporation Oracle Product Lifecycle Analytics
- Denial of service
- CVSS 8.3 High
Uncontrolled resource consumption in Oracle Corporation Siebel CRM Deployment
- Oracle Corporation Siebel CRM Deployment
- Denial of service
- CVSS 6.6 Medium
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 7.6 High
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 5.3 Medium
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 8.1 High
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 6.9 Medium
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 8.1 High
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 3.1 Low
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 5.3 Medium
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 5.8 Medium
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 5.5 Medium
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 3.7 Low
Improper resource shutdown in Oracle Corporation Siebel Apps - Marketing
- Oracle Corporation Siebel Apps - Marketing
- Denial of service
- CVSS 2.9 Low
Improper resource shutdown in Oracle Corporation Siebel Apps - Marketing
- Oracle Corporation Siebel Apps - Marketing
- Denial of service
- CVSS 2.9 Low
Improper resource shutdown in Oracle Corporation Siebel Apps - Marketing
- Oracle Corporation Siebel Apps - Marketing
- Denial of service
- CVSS 5.3 Medium
Uncontrolled resource consumption in Oracle Corporation Siebel Apps - Marketing
- Oracle Corporation Siebel Apps - Marketing
- Denial of service
- CVSS 5.9 Medium
Uncontrolled resource consumption in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Denial of service
- CVSS 4.7 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle REST Data Services
- Oracle Corporation Oracle REST Data Services
- Denial of service
- CVSS 8.7 High
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
- Denial of service
>=9.2.0, <13.0.0 · fixed in 13.0.0
GHSA-65qm-jvmh-6pqg · CVE-2026-112400 - CVSS 6.3 Medium
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
- Denial of service
>=2.3.0, <13.0.0 · fixed in 13.0.0
GHSA-vx6w-vv9f-6gvg · CVE-2026-112899 - CVSS 8.7 High
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
- Denial of service
>=5.1.0, <13.0.0 · fixed in 13.0.0
GHSA-p4wg-p73j-c528 · CVE-2026-112895 - CVSS 7.5 High
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
- Denial of service
>=14.1.0, <14.3.3 || >=15.0.0, <15.0.3 · fixed in 14.3.3, 15.0.3
GHSA-gfr2-rv44-r23c · CVE-2026-111758 - CVSS 7.5 High
curl_mime_free stack overflow by recursion
- curl
- Denial of service
- CVSS 8.1 High
never-ending loop via server response omission
- curl
- Denial of service
- CVSS 3.7 Low
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
- Denial of service
<14.3.3 || >=15.0.0, <15.0.3 · fixed in 14.3.3, 15.0.3
GHSA-vfgh-jcmw-g37q · CVE-2026-111766 - CVSS 7.5 High
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
- Denial of service
>=1.3.0, <1.32.0 · fixed in 1.32.0
GHSA-46jr-4wx8-v453 · CVE-2026-111768 - CVSS 6.9 Medium
AIOHTTP: Connector pool exhaustion via Max-Age overflow
- Denial of service
<3.14.4 · fixed in 3.14.4
GHSA-6cjc-53gc-5rqm · CVE-2026-111065 - CVSS 8.2 High
AIOHTTP: File descriptor exhaustion in multipart requests
- Denial of service
>=2.0.0, <3.14.4 · fixed in 3.14.4
GHSA-9xw5-w5jj-pvcg · CVE-2026-111066 - CVSS 7.5 High
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
- Denial of service
- CWE-459
<4.33.0 · fixed in 4.33.0
GHSA-qhcq-9pm2-c9w9 · CVE-2026-113658 - CVSS 5.3 Medium
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
- Denial of service
<1.5.5 · fixed in 1.5.5
GHSA-89mh-mm8c-mv7f · CVE-2026-113656 - CVSS 7.1 High
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
- Denial of service
- Prototype pollution
<4.33.0 · fixed in 4.33.0
GHSA-j5rq-xfvr-p969 · CVE-2026-113666 - CVSS 8.2 High
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
- Denial of service
>=21.2.0, <21.2.25 || >=22.0.0, <22.2.1 · fixed in 21.2.25, 22.2.1
GHSA-57xq-rjx2-v5xh · CVE-2026-111751 - CVSS 6.8 Medium
Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts
- NationalSecurityAgency ghidra
- Denial of service
- CVSS 0.6 Low
Apache CouchDB: Replicator follows redirects indefinitely
- Apache Software Foundation Apache CouchDB
- Denial of service
- CVSS 6.8 Medium
Deleting a user-mode module thread leaks its privileged kernel stack
- Eclipse Foundation Eclipse ThreadX
- Denial of service
- CVSS 6.8 Medium
JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode
- Eclipse Foundation Eclipse ThreadX - GUIX
- Memory corruption
- Denial of service
- CVSS 8.2 High
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
- Denial of service
- CWE-405
<=19.2.25 || >=20.0.0, <20.3.33 || >=21.0.0, <21.2.25 || >=22.0.0, <22.2.1 · fixed in 20.3.33, 21.2.25, 22.2.1
GHSA-62vg-58rm-qff7 · CVE-2026-111752 - CVSS 7.5 High
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
- Denial of service
<14.3.2 || >=15.0.0, <15.0.2 · fixed in 14.3.2, 15.0.2
GHSA-r7fv-28h4-cvq7 · CVE-2026-111759 - CVSS 8.9 High
Crass : Large numeric exponents cause CPU and memory denial of service
- Denial of service
<1.0.7 · fixed in 1.0.7
GHSA-6wmf-3r64-vcwv · CVE-2026-61845 - CVSS 6.5 Medium
Denial-of-service in the PDF Viewer component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
- CVSS 7.5 High
Eclipse ioFog renders request templates before authentication
- Eclipse Foundation Eclipse ioFog
- Denial of service
- CVSS 7.5 High
Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
- Denial of service
>=0.0.0-0, <0.8.1 · fixed in 0.8.1
GHSA-7gpj-mj4q-x62x · CVE-2026-105297 - CVSS 7.5 High
Apache Cocoon: XEE could lead to SSRF and information disclosure
- Apache Software Foundation Apache Cocoon
- Denial of service
- CVSS 6.9 Medium
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
- Eclipse Foundation Eclipse CSI - PIA
- Denial of service
- CVSS 8.2 High
Reachable assertion in Advantech ADAM-3600
- Advantech ADAM-3600
- Denial of service
- CVSS 6.9 Medium
Uncontrolled resource consumption in Advantech ADAM-3600
- Advantech ADAM-3600
- Denial of service
- CVSS 6.5 Medium
TS4500 Tape Library Denial of Service
- IBM Storage TS4500 Library
- Denial of service
- CVSS 5.7 Medium
Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service
- zephyr
- Denial of service
- CVSS 6.9 Medium
DiffSK configobj __init__.py _sectionmarker redos
- DiffSK configobj
- Denial of service
- CVSS 8.7 High
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
- grav
- Denial of service
- CVSS 9.3 CriticalCritical · CVSS 9+
Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
- getgrav grav-plugin-api
- Denial of service
- CVSS 7.5 High
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag
- Denial of service
- CVSS 8.1 High
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify
- Denial of service
- CVSS 7.5 High
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse
- Denial of service
- CVSS 7.5 High
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv
- Denial of service
- CVSS 7.5 High
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag
- Denial of service
- CVSS 7.5 High
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv
- Denial of service
- CVSS 8.2 High
aiohttp server lacks an initial request/header timeout
- Denial of service
<3.14.4 · fixed in 3.14.4
GHSA-5wr8-gcqf-gqf3 · CVE-2026-111064