Denial of service.

Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads

• Part-DB-server
• Denial of service

e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php.

• Denial of service

Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt

• aws-c-mqtt
• Denial of service

Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields

• unclecode crawl4ai
• Denial of service

libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay

• libexpat
• Denial of service

Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount

• NationalSecurityAgency ghidra
• Denial of service

Ghidra before 12.2 Denial of Service via Extension Archive Install

• NationalSecurityAgency ghidra
• Denial of service

Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()

• NationalSecurityAgency ghidra
• Denial of service

Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation

• NationalSecurityAgency ghidra
• Denial of service

Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization

• MongoDB C# Driver
• Denial of service

Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

• lepture mistune
• Denial of service

Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

• lepture mistune
• Denial of service

Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

• lepture mistune
• Denial of service

Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

• lepture mistune
• Denial of service

Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Denial of service

Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Denial of service

pypdf: Possible long runtimes/large memory usage when retrieving form fields

• Denial of service

<6.21.0 · fixed in 6.21.0

pypdf: Possible large memory usage when parsing arrays and dictionaries

• Denial of service

<6.21.0 · fixed in 6.21.0

pypdf: Possible large memory usage when parsing content streams

• Denial of service

<6.21.0 · fixed in 6.21.0

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

• Denial of service

<5.0.1 · fixed in 5.0.1

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

• Denial of service

<5.0.1 · fixed in 5.0.1

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

• Denial of service

<5.0.1 · fixed in 5.0.1

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

• Denial of service

>=3.2.3, <3.2.12 || >=3.3.0a3, <3.3.0rc1 · fixed in 3.2.12, 3.3.0rc1

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

• Denial of service

>=3.0.0, <3.2.12 || >=3.3.0a1, <3.3.0rc1 · fixed in 3.2.12, 3.3.0rc1

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

• Denial of service

<1.45.1 · fixed in 1.45.1

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

• Denial of service

<10.7.4 · fixed in 10.7.4

Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

• Denial of service

<3.18.2 · fixed in 3.18.2

Django REST framework: JSONParser applies an attacker-named codec to the request stream

• Denial of service
• CWE-409

>=3.6.4, <3.18.2 · fixed in 3.18.2

Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

• Denial of service

>=3.0.0, <10.0.10 · fixed in 10.0.10

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

• Denial of service

>=11.0.0, <13.0.0 · fixed in 13.0.0

Pillow: TarIO negative size field causes infinite CPU-spin loop

• Denial of service

<13.0.0 · fixed in 13.0.0

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

• Denial of service

>=5.1.0, <13.0.0 · fixed in 13.0.0

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

• Denial of service

>=9.1.0, <13.0.0 · fixed in 13.0.0

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

• Denial of service
• CWE-409

<13.0.0 · fixed in 13.0.0

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

• Denial of service
• CWE-409

<13.0.0 · fixed in 13.0.0

Next.js: Denial of Service in App Router using Server Actions

• Denial of service

>=13.0.0, <15.5.28 || >=16.0.0, <16.4.1 · fixed in 15.5.28, 16.4.1

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

• Denial of service

>=2.0.0, <3.7.0 · fixed in 3.7.0

Large tables in data apps can bring down execution services in KNIME Hub

• KNIME Business Hub
• Denial of service

Resource allocation without limits in litespeedtech lsquic

• litespeedtech lsquic
• Denial of service

Authenticated Denial-of-Service in Zigbee Publish Billing Period

• Silicon Labs EmberZNet
• Denial of service

Authenticated Denial-of-Service in Zigbee Discover Attributes Handling

• Silicon Labs EmberZNet
• Denial of service

fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents

• junegunn fzf
• Denial of service

Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

• vaadin android-json
• Denial of service

Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

• Denial of service

>=0.1.0 · no fixed version yet

Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion

• Denial of service

>=0.1.0 · no fixed version yet

Infinite loop in HAProxy and others

• HAProxy
• HAProxy Enterprise Edition
• Denial of service

Resource allocation without limits in Roundcube Webmail

• Roundcube Webmail
• Denial of service

Resource allocation without limits in Roundcube Webmail

• Roundcube Webmail
• Denial of service

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

• Drupal Webform
• Denial of service

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

• Drupal Combined image style
• Denial of service

Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise

• Splunk Enterprise
• Denial of service

Denial of Service (DoS) through the REST API in Splunk Enterprise

• Splunk Enterprise
• Denial of service

Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

• Splunk Enterprise
• Denial of service

Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

• Denial of service

>=5.1.0, <13.0.0 · fixed in 13.0.0

Pillow: APNG background disposal allocates full canvas before decompression bomb check

• Denial of service

>=8.1.0, <13.0.0 · fixed in 13.0.0

Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

• Denial of service

>=5.1.0, <13.0.0 · fixed in 13.0.0

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

• Denial of service

>=5.1.0, <13.0.0 · fixed in 13.0.0

Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search

• Denial of service

Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes

• Denial of service

<13.0.0 · fixed in 13.0.0

Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

• Denial of service

>=5.4.0, <13.0.0 · fixed in 13.0.0