Advisories · Weakness
Denial of service.
Crashes, hangs and resource exhaustion, ReDoS included. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.2 High
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
- Denial of service
>=7.2.0, <13.0.0 · fixed in 13.0.0
GHSA-22hg-r758-rrw9 · CVE-2026-112390 - CVSS 6.9 Medium
Pillow: Quadratic GIF comment copying during save
- Denial of service
>=9.2.0, <13.0.0 · fixed in 13.0.0
GHSA-fc9g-5qg7-mf45 · CVE-2026-112891 - CVSS 6.9 Medium
Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout
- Apache Software Foundation Apache Traffic Server
- Denial of service
- CVSS 8.7 High
Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service
- Apache Software Foundation Apache Traffic Server
- Denial of service
- CVSS 7.7 High
Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
- Apache Software Foundation Apache Traffic Server
- Denial of service
- CVSS 8.7 High
Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8
- vaadin framework
- Denial of service
- CWE-667
- CVSS 5.3 Medium
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
- Denial of service
>=2.18.0, <2.18.1 · fixed in 2.18.1
GHSA-c9rx-x947-fp3h · CVE-2026-113650 - CVSS 6.5 Medium
ApostropheCMS: Import archives can exhaust server storage and deny service
- Denial of service
<3.7.1 · fixed in 3.7.1
GHSA-9g7p-m758-rp72 · CVE-2026-112955 - CVSS 6.0 Medium
pypdf: Possible infinite loop in PdfWriter.find_outline_item
- Denial of service
<6.20.1 · fixed in 6.20.1
GHSA-qfv9-64jg-mh7p · CVE-2026-113792 - CVSS 6.0 Medium
pypdf: Possible infinite loop when removing tree items
- Denial of service
<6.20.1 · fixed in 6.20.1
GHSA-9mx8-4j7g-633p · CVE-2026-113793 - CVSS 6.0 Medium
pypdf: Possible infinite loop when hitting EOF in standard xref table
- Denial of service
<6.20.0 · fixed in 6.20.0
GHSA-39mj-jf6j-2qj3 · CVE-2026-113794 - CVSS 6.0 Medium
pypdf: Possible large memory usage for streams with multiple filters
- Denial of service
<6.20.0 · fixed in 6.20.0
GHSA-7mh2-4gg2-979f · CVE-2026-113795 - CVSS 7.5 High
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
- Denial of service
<1.4.1 · fixed in 1.4.1
GHSA-5588-rp99-5fjh · CVE-2026-113729 - CVSS 5.8 Medium
Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability
- Cisco Open Source Snort3
- Cisco Secure Firewall Threat Defense (FTD) Software
- Denial of service
- CVSS 7.5 High
Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilities
- Cisco TelePresence Video Communication Server (VCS) Expressway
- Denial of service
- CVSS 5.3 Medium
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
- Cisco Open Source Snort3
- Cisco Secure Firewall Threat Defense (FTD) Software
- Denial of service
- CVSS 7.5 High
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
- Cisco Cyber Vision
- Cisco Open Source Snort3
- Denial of service
- CVSS 5.8 Medium
Multiple Cisco Products Snort 3 Netflow Denial of Service Vulnerabilities
- Cisco Open Source Snort3
- Cisco Secure Firewall Threat Defense (FTD) Software
- Denial of service
- CVSS 6.3 Medium
Pydantic AI Harness tool-call limit bypass in nested CodeMode calls
- Denial of service
<0.59.0 · fixed in 0.59.0
GHSA-3589-pxp7-3gj8 · CVE-2026-114386 - CVSS 7.5 High
Reachable Assertion in ntpsec
- ntpsec
- Denial of service
- CVSS 7.5 High
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
- Denial of service
<4.33.0 · fixed in 4.33.0
GHSA-86wm-68pq-5jwq · CVE-2026-113711 - CVSS 7.5 High
Specific RPZ configurations and query patterns may result in an unexpected exit
- ISC BIND 9
- Denial of service
- CVSS 7.5 High
Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
- ISC BIND 9
- Memory corruption
- Denial of service
- CVSS 7.5 High
Amplified resource exhaustion in inbound message processing
- ISC BIND 9
- Denial of service
- CVSS 7.5 High
Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
- Apache Software Foundation Apache bRPC
- Path traversal
- Denial of service
- CVSS 7.5 High
Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
- Apache Software Foundation Apache bRPC
- Denial of service
- Memory corruption
- CVSS 7.5 High
Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache bRPC: Out-of-Bounds Write in Redis Command Parser
- Apache Software Foundation Apache bRPC
- Denial of service
- Memory corruption
- CVSS 7.5 High
Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
- Apache Software Foundation Apache bRPC
- Denial of service
- CVSS 7.5 High
Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver
- Apache Software Foundation Apache IoTDB JDBC driver
- Denial of service
- CVSS 5.3 Medium
Aggregate DNS name chained pointer decompression work leads to degradation of service.
- NLnet Labs Unbound
- Denial of service
- CVSS 3.3 Low
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
- Red Hat Confidential Compute Attestation
- Red Hat DPU kit for NVIDIA
- Denial of service
- CVSS 8.7 High
JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()
- Eclipse Foundation Eclipse OpenJ9
- Memory corruption
- Denial of service
- CVSS 7.5 High
Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS
- Formidable Forms
- Denial of service
- CVSS 7.5 High
Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
- Denial of service
>=0.7.3 · no fixed version yet
GHSA-3cgq-c484-rx5j - CVSS 6.2 Medium
Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Denial of service
- CVSS 8.7 High
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in...
- Denial of service
>=0.24.0, <0.31.0 · fixed in 0.31.0
GHSA-823j-m4cj-hmjf · CVE-2026-114052 - CVSS 3.7 Low
IBM Cyber Fraud Reachable Assertion
- IBM CyberFraud
- Denial of service
- CVSS 8.6 High
IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service
- IBM QRadar Security Information and Event Management
- Denial of service
- CVSS 7.5 High
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key
- Denial of service
- CWE-405
- CVSS 7.5 High
Uncontrolled resource consumption in Oracle Corporation Oracle Essbase
- Oracle Corporation Oracle Essbase
- Denial of service
- CVSS 4.3 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle Essbase
- Oracle Corporation Oracle Essbase
- Denial of service
- CVSS 3.7 Low
Uncontrolled resource consumption in Oracle Corporation Oracle Business Intelligence Enterprise Edition
- Oracle Corporation Oracle Business Intelligence Enterprise Edition
- Denial of service
- CVSS 4.3 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle Business Intelligence Enterprise Edition
- Oracle Corporation Oracle Business Intelligence Enterprise Edition
- Denial of service
- CVSS 6.5 Medium
Uncontrolled resource consumption in Oracle Corporation Oracle Database Server
- Oracle Corporation Oracle Database Server
- Denial of service
- CVSS 6.5 Medium
Uncontrolled resource consumption in Oracle Corporation Siebel CRM Deployment
- Oracle Corporation Siebel CRM Deployment
- Denial of service
- CVSS 2.3 Low
Improper resource shutdown in Oracle Corporation Siebel CRM Deployment
- Oracle Corporation Siebel CRM Deployment
- Denial of service
- CVSS 5.9 Medium
Uncontrolled resource consumption in Oracle Corporation Siebel CRM Deployment
- Oracle Corporation Siebel CRM Deployment
- Denial of service