Missing null termination in the Qualcomm battery manager driver (qcom_battmgr) causes the kernel to read beyond a string buffer boundary when firmware on SC8280XP-based devices returns a string that exactly fills the BATTMGR_STRING_LEN field. The three contiguous string fields - model_number, serial_number, and oem_info - are exposed to userspace via the power supply sysfs interface using a bare "%s" format, meaning an unterminated firmware string causes the kernel to traverse into adjacent struct members and leak their contents to unprivileged local readers. No public exploit has been identified at time of analysis; patches are confirmed for stable branches 6.12.109, 6.18.50, and 7.2.4.
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.
Incorrect authorization in OpenStack Keystone before 29.0.3 allows holders of delegated authentication tokens (EC2 credentials, application credentials, OAuth1 access tokens, or trusts) to create, modify, or delete credentials via the /v3/credentials API without restriction. EC2-derived tokens can additionally read raw credential blobs, exposing TOTP MFA seeds and other secrets stored in Keystone. An additional authorization gap in PATCH /v3/credentials permits any delegated token to reassign a credential to an arbitrary project, bypassing project-isolation controls. No public exploit code or CISA KEV listing identified at time of analysis.
Out-of-bounds array indexing in the Linux kernel's rtl8192du Wi-Fi driver allows network-adjacent unauthenticated attackers to trigger kernel memory corruption or a crash. The driver's `rtl92du_tx_fill_desc()` function passes a raw 802.11 QoS TID value (range 0-15) as an index into `sta_entry->tids[]`, which is only allocated with MAX_TID_COUNT=9 entries; TID values 9-15 index past the array boundary. UBSAN confirms index-10 access on `rtl_tid_data [9]`. No public exploit exists and EPSS is 0.17%, indicating low real-world exploitation pressure at time of analysis.
Remote unauthenticated denial-of-service in AirSane scanner server (versions prior to 0.4.12) allows an attacker to crash the daemon by sending an HTTP POST request with an arbitrarily large Content-Length value, triggering memory exhaustion and a std::bad_alloc exception. The root cause is in httpserver.cpp, where the Content-Length header value is passed directly to std::string::resize() with no upper-bound validation. A secondary variant using non-numeric Content-Length values produces undefined behavior via NaN-to-integer conversion. No public exploit or active exploitation has been identified at time of analysis.
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfiltrate data from the underlying database via crafted queries. The vulnerability is scoped-changed, meaning successful exploitation reaches beyond the plugin component to the WordPress database. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis.
SQL injection in Sky Addons for Elementor (WordPress plugin by wowdevs) versions 3.8.4 and earlier allows authenticated attackers with Editor-level WordPress privileges to query the underlying database beyond the plugin's normal scope, achieving high confidentiality impact. The scope-changed CVSS vector (S:C) indicates the injection can reach data outside the plugin's own tables - including sensitive WordPress core tables - making this an information-disclosure-focused SQLi. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote denial-of-service in HPE IceWall Federation Agent and Proxy allows a network attacker to crash or render unavailable the identity federation and authentication proxy service. The root cause is improper handling of incorrect data types (CWE-241), meaning the software fails to gracefully reject or process malformed input, triggering an availability failure. No active exploitation or public exploit code has been identified at time of analysis.
Path traversal in SignalWire's libks HTTP request parser exposes consumers to arbitrary file read. The `clean_uri()` function fails to reject oversized URI paths - when the path contains more segments than the internal canonicalization buffer accommodates, embedded `..` sequences survive unfiltered into any downstream code that joins the URI with a filesystem path. Unauthenticated remote attackers can exploit this against any application built on libks prior to 2.0.11. No public exploit code has been identified at time of analysis, but the CVSS 3.1 score of 7.5 (C:H) reflects the potential for full confidentiality loss through arbitrary file traversal.
Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote attackers to extract sensitive data from the WordPress database without any credentials. The flaw exists in getWhereString() where the 'addontype' parameter, when submitted as an array, has its first element injected verbatim as the SQL comparison operator into the WHERE clause; the companion normalizeAjaxInputData() method strips WordPress's built-in magic_quotes protection, eliminating the last layer of defense. No public exploit or KEV listing has been identified at time of analysis, but the unauthenticated network attack path and confirmed Wordfence disclosure make this a credible priority for sites running the affected plugin.
SQL injection in the Sticky Chat Widget WordPress plugin (versions ≤1.4.2) allows unauthenticated remote attackers to extract sensitive data from the underlying WordPress database via the scw_save_form_data AJAX action. Three compounding weaknesses enable exploitation: $wpdb->insert() wraps column identifiers in unescaped backticks, PHP's filter_input() retrieves raw POST data bypassing WordPress's wp_magic_quotes() sanitization, and a widget_id validation loop that is never executed when no valid widget_id is supplied leaves the $isValid flag at its initialized true value. No public exploit has been confirmed at time of analysis, but the publicly accessible unauthenticated AJAX endpoint makes this mechanically straightforward to exploit against any site running the affected plugin.
Memory exhaustion in multiparty Node.js library (versions 2.1.0 through <4.3.1) allows any unauthenticated network attacker to crash the host process with a single crafted HTTP request. The parser accumulates multipart part headers into an unbounded in-memory buffer with no size cap, consuming available process memory until the Node.js server is killed. The vulnerability carries no confidentiality or integrity impact - this is a pure availability issue addressed in multiparty 4.3.1, which enforces a maximum on the bytes buffered per part header block.
Remote kernel crash in the Linux kernel NFSv4 server (nfsd) allows any unauthenticated network client to trigger a NULL pointer dereference and kernel oops by sending a crafted SETATTR compound request. The flaw resides in nfsd4_setattr() when delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY) are included alongside the NFSv4 'one stateid' (all-0xFF bytes): the special-stateid handling path in nfs4_preprocess_stateid_op() exits without populating the nfs4_stid output pointer, leaving the local variable NULL, after which the unconditional dereference of st->sc_type at offset 4 from NULL panics the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.24% (15th percentile), though the zero-prerequisite attack surface makes this straightforward to trigger against any exposed NFSv4 server running an affected kernel.
Xiongmai XM530-based IP cameras running firmware HMT.CM2005-v220608.1837 and earlier ship the embedded Happytime RTSP server inside the Sofia IPC daemon with authentication disabled by default, so anyone who can reach the RTSP port can pull the live H.264 video and G.711 audio streams. The media leaves the device in cleartext over RTP/UDP, meaning the feed is also recoverable by an on-path observer on the same network segment. There is no CISA KEV entry and EPSS is very low at 0.22% (13th percentile), so this is currently an exposure-driven rather than campaign-driven risk, though exploitation requires no credentials, no user interaction, and only a standard RTSP client.
NULL pointer dereference in Linux kernel NFSD's NFSv4.2 compound dispatch loop allows remote clients to crash NFS servers built with CONFIG_NFSD_V4_2_INTER_SSC. By inserting an operation such as SETATTR between a foreign PUTFH and SAVEFH within a crafted COMPOUND request, an attacker causes fh_want_write() to dereference a NULL fh_export pointer - killing the nfsd kthread and denying NFS service to all clients. No public exploit has been identified and EPSS stands at 0.22%, reflecting low current exploitation interest.
Resource exhaustion in the Linux kernel NFSv4.2 inter-server copy (COPY offload) path allows an authenticated NFS client to leak nfsd_file objects on the server. Each inter-server COPY request that triggers a failed nfsd4_setup_inter_ssc() call bypasses the cleanup path where release_copy_files() drops the nf_dst reference, permanently pinning a file, inode, dentry, and vfsmount. Over time, repeated failed COPY requests exhaust kernel memory resources, producing a denial-of-service condition. No public exploit exists and EPSS is 0.21%, reflecting the niche NFSv4.2 inter-server copy configuration required.
NULL pointer dereference in the Linux kernel svcrdma subsystem (NFS over RDMA) allows unauthenticated remote clients to crash the kernel by sending a crafted RDMA Read list whose cumulative segment lengths overflow the rq_pages page array. The vulnerability bypasses per-segment length validation by exploiting an edge case where a single segment fills the page array exactly, causing the loop guard to exit prematurely; a subsequent segment then dereferences the NULL sentinel slot at rq_pages[rq_maxpages] during DMA mapping, triggering a kernel panic. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS is low at 0.21%, but the network-exposed crash vector warrants patching on any host running NFS-over-RDMA.
CPU exhaustion DoS in the Linux kernel's Ceph filesystem client affects systems with mounted Ceph volumes: `ceph_cap_reclaim_work()` enters a busy loop by unconditionally re-queuing itself whenever `ceph_trim_dentries()` returns `-EAGAIN`, which occurs even when no leases are eligible for reclaim. The underlying cause is `__dir_lease_check()` returning `TOUCH` for every valid lease when `expire_dir_lease=false`, churning the dentry list, resetting timestamps (preventing natural aging), and always exhausting the `nr_to_scan` budget - guaranteeing the `-EAGAIN` re-queue cycle. Vendor-confirmed data shows this produced 500 `ceph_trim_dentries()` calls per second and 128,000+ lock contentions on `dentry_list_lock` in a 5-minute window. No public exploit code exists and the CISA KEV does not list this vulnerability.
NFS server availability in the Linux kernel SUNRPC subsystem can be disrupted when svc_pool_for_cpu() routes incoming transports to CPU-affine service pools that contain no active threads. Affected deployments running nfsd in pernode or percpu pool mode with fewer configured threads than NUMA nodes (or CPUs) will silently enqueue inbound NFS transports on threadless pools, where they are never picked up - causing NFS connections to hang indefinitely. Patches are available in stable kernel series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit exists and EPSS is 0.21% (11th percentile).
Kernel panic via NULL pointer dereference in the Linux kernel qede Ethernet driver (used by QLogic/Marvell FastLinQ NICs) can be triggered under memory pressure conditions during TPA (Transparent Packet Aggregation) fragment processing. A regression introduced by commit 8a8633978b84 omitted the assignment of tpa_info->buffer.data in qede_tpa_start(), causing a 'ghost' buffer descriptor with a NULL data pointer to be reinserted into the active Rx ring upon SKB allocation failure. When hardware subsequently uses the poisoned ring slot, qede_fill_frag_skb() dereferences the NULL pointer, panicking the kernel. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile).
Uncontrolled resource consumption in the Linux kernel Ceph client's ceph_parse_deleg_inos() function allows a malicious or compromised Ceph MDS (Metadata Server) to trigger denial of service against any connected client. The 64-bit interval length field in MDS create-with-delegation replies is decoded without value validation, enabling a crafted reply to spin the client's insert loop indefinitely or grow the per-session delegated-inode xarray without bound, exhausting CPU or kernel memory. No public exploit code exists and no CISA KEV listing is present, consistent with the EPSS score of 0.21%.
Reference leak in Linux kernel NFSD's nfsd_cross_mnt() allows any authenticated NFS client to incrementally exhaust VFS mount and dentry reference counts, ultimately blocking umount operations and degrading dentry cache reclaim. The err < 0 arm of follow_down() uniquely omits the path_put() call present in every other exit path of the function, making the leak reachable via nfsd_lookup_dentry and NFSv4 READDIR encoding. No public exploit is identified at time of analysis; EPSS is 0.20% at the 10th percentile, and no KEV listing exists.
Silent data loss in Linux kernel NFSD's NFSv4.2 async COPY implementation causes the server to omit a write-verifier rotation when asynchronous copy writeback fails: the server correctly encodes NFS_UNSTABLE in the CB_OFFLOAD callback, but leaves nn->writeverf unchanged, so the client's subsequent COMMIT handshake returns the same verifier the client already holds and the client concludes copied data is durable - silently discarding data whose writeback actually failed. This violates the UNSTABLE+COMMIT durability contract specified in RFC 7862 §15.1 and RFC 8881 §18.32, matching a protocol-state class of bug already remediated in nfsd_vfs_write() and nfsd_commit(). No public exploit or active exploitation is identified; EPSS is 0.20%, consistent with the narrow preconditions required.
Silent data loss in the Linux kernel NFSD NFSv4.2 async COPY offload path allows writeback errors to go undetected, causing clients to treat unwritten data as durably committed. The vulnerability stems from a TOCTOU race in `_nfsd_copy_file_range()`: the writeback-error cursor 'since' is sampled after the copy loop rather than before it, so a concurrent COMMIT or stable WRITE on the same destination inode can advance the error cursor before the COPY worker reads it, masking any writeback failure. CB_OFFLOAD then signals `wr_stable_how = FILE_SYNC4` to the NFS client, which confidently discards its copy of the data under the false belief it is durably stored on the server. No public exploit has been identified at time of analysis, and EPSS stands at 0.20%.
Kernel crash in the Linux libceph client allows a malicious or compromised authenticated Ceph OSD to trigger a BUG_ON assertion in ceph_msg_data_next() by sending a crafted sparse-read reply. The flaw in net/ceph/osd_client.c:osd_sparse_read() validates total data length against summed extents but omits per-extent monotonicity, overlap, and bounds checks, enabling a far-forward extent offset to advance the message-data cursor past the request buffer. Impact is limited to availability - a targeted kernel panic on any Linux client mounting a RADOS-backed filesystem or block device (RBD/CephFS). No public exploit code has been identified at time of analysis, and EPSS is low at 0.20%.
Uninitialized kernel memory disclosure in the Linux kernel NVMe subsystem affects all kernels from commit 530436c45ef2 through fixed releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. When a discard (TRIM/DSM) operation is issued and the GFP_ATOMIC allocation for the 4096-byte DSM payload fails under memory pressure, the kernel falls back to the per-controller ctrl->discard_page, which was allocated with alloc_page(GFP_KERNEL) in nvme_init_ctrl() but never zeroed - causing up to 4080 bytes of stale kernel data (vmemmap struct page pointers and other heap residue) to be transmitted to the NVMe controller. No public exploit exists and EPSS is 0.20%; the input CVSS vector AV:N/AC:L/PR:N significantly overstates exploitability for what requires local privileged access under specific memory pressure conditions.
Integer underflow in the Linux kernel's SCTP stream reconfiguration (RECONF) handler allows a remote SCTP peer to crash the kernel by sending duplicate RECONF response chunks. When a cached RECONF chunk contains an ADD_OUT request alongside other parameters, a duplicate response causes the kernel to roll back `stream->outcnt` twice - the second decrement underflows the unsigned counter and can trigger a kernel panic. EPSS exploitation probability is 0.20% (10th percentile), no public exploit exists, and no CISA KEV listing has been issued, indicating no known active exploitation at time of analysis.
Race condition in the Linux kernel's IPA (IP Accelerator) network driver permanently stalls the cellular modem TX queue on Qualcomm Snapdragon-based devices after a runtime power management resume cycle. The flaw occurs because the queue-wake work is dispatched during RPM_RESUMING state before RPM_ACTIVE is reached; the wake is consumed prematurely by a racing transmit, pm_runtime_get() returns -EINPROGRESS with no future wake scheduled, and the TX queue never recovers - blocking both outbound packets queued in qdisc and, through suspended endpoints, inbound RX as well. No public exploit exists and EPSS is 0.20%, but the failure manifests under normal cellular data usage without any adversarial trigger.
Unbounded O(n²) CPU consumption in the Linux kernel NFS server (nfsd) POSIX ACL decoder allows any NFS client reachable on port 2049 to cause server-side denial of service by supplying an oversized ACL entry count in a SETACL compound. The root cause is an asymmetry introduced in commit 5fc51dfc2eb1: the encoder already caps count at NFS_ACL_MAX_ENTRIES, but the decoder added in that commit omits the symmetric bound check, passing the raw wire u32 directly into an O(n²) bubble sort. Patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit or active exploitation has been identified.
POSIX ACL reference-count leaks in Linux kernel NFSD allow a remote attacker to exhaust kernel memory via malformed NFSv4 OPEN compound requests. When the NFS server decodes an OPEN compound carrying valid POSIX ACL createhow4 attributes but encounters a non-seqid-mutating error from claim4 decoding, the compound dispatcher short-circuits before nfsd4_open() executes, permanently leaking both op_pacl and op_dpacl references because OP_OPEN lacked an op_release handler; a secondary leak exists on the NFSv4.0 replay path where op_release was never called from nfsd4_encode_replay(). No public exploit code has been identified and EPSS is 0.20%, but repeated malformed requests against a network-reachable NFSv4 server could drive the kernel toward OOM-induced service failure.
Four coupled error-path defects in the Linux kernel's SUNRPC RPCSEC_GSS option-array XDR decoder (`gssx_dec_option_array`) enable kernel NULL-pointer dereference, a `group_info` refcount leak, and a latent use-after-free during GSS security-context acceptance. Systems acting as NFS servers or clients with Kerberos authentication (sec=krb5/krb5i/krb5p) are in the affected code path; triggering the NULL deref via a failed allocation or malformed GSS response causes a kernel crash (denial-of-service). No public exploit code exists and EPSS sits at the 10th percentile, indicating low current exploitation probability.
Defensive hardening in the Linux kernel NFSD subsystem closes an edge case where nfsd_file_do_acquire() could use a file returned by dentry_create() that was never actually opened. The POSIX VFS interface permits ->atomic_open handlers to return success while delegating the open to a retry path via finish_no_open(); if that path is reached during an NFSv4 file creation, the resulting struct file lacks FMODE_OPENED and is in an invalid state for server I/O. Using such a handle can lead to a kernel crash or panic on the NFS server, causing a denial-of-service. No public exploit exists and exploitation is described as extremely unlikely by the kernel developers themselves; no public exploit has been identified at time of analysis.
Silent data corruption in the Linux kernel NFS server daemon (nfsd) allows authorized NFS write clients to induce incorrect file-offset placement whenever a partial write completes between 50% and 99% of a segment boundary. Affecting kernel revisions from commit 06c5c97293e3fca99ce15da157068edf45a7c6e4 up to the fix commits included in 7.2.4 and 7.3-rc1, the logic error in nfsd_direct_write() causes subsequent write segments to land at wrong file offsets while the byte-count returned to the NFS client is over-reported, masking the corruption. No public exploit has been identified at time of analysis and EPSS stands at 0.19%, but the impact is undetected, silent filesystem data corruption on any NFS-exported volume.
TX queue stall in the Linux kernel's Broadcom bnxt network driver causes network transmission to halt on systems running software UDP Segmentation Offload (SW USO). Under burst traffic conditions, the `bnxt_sw_udp_gso_xmit` function can return early with NETDEV_TX_BUSY while leaving `txr->kick_pending` set to 1, meaning the driver has written Buffer Descriptors (BDs) but never rings the device doorbell - so the NIC never processes the queued packets and the completion event that would wake the TX queue never arrives. The stall was confirmed on a production system where a netdev TX watchdog triggered; no public exploit exists and no active exploitation has been identified.
Memory exhaustion DoS in Linux kernel NFSv4 server (nfsd) allows any network-reachable client to force multi-MiB kernel heap allocations per COMPOUND operation. The flaw lies in nfsd4_decode_create(), which accepted an unbounded cr_datalen wire value for NF4LNK symlink targets without validation - allocating up to the full RPC payload size (several MiB) per request before the VFS eventually rejected the target with ENAMETOOLONG. By flooding the server with malformed NFSv4 CREATE operations, an attacker can exhaust kernel memory and cause a denial of service. No public exploit is identified at time of analysis, and EPSS is 0.17% (6th percentile).
Race condition in the Linux kernel NFSD NFSv4.2 server-side copy state management allows any authenticated NFSv4.2 client to crash the NFS server kernel. The cpntf entry is inserted into the IDR (making it immediately addressable by stateid) before its cp_list is initialized in a separate lock section; a concurrent OFFLOAD_CANCEL - using the cnr_stateid echoed to the client - reaches _free_cpntf_state_locked() and calls list_del() on a zeroed list_head, triggering a kernel oops. No public exploit code is known and the issue is not in CISA KEV; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Kernel memory disclosure in the Linux ntfs3 driver's ni_read_frame() function exposes uninitialized kernel heap content to userspace via a plain read(2) call on a crafted NTFS compressed file. The LZNT decompressor returns early when it encounters a zero chunk header, writing fewer bytes than frame_size, but the residual gap in the vmapped pages is never zeroed before being marked uptodate and copied to userspace - leaking whatever kernel memory previously occupied those pages. A crafted NTFS image containing a short-decompressing compressed stream is sufficient to recover kernel pointers and defeat KASLR, making this a viable first-stage primitive for a chained kernel privilege-escalation attack. No public exploit has been identified at time of analysis and EPSS stands at 0.17%.
Kernel memory disclosure in the Linux kernel's nvme-tcp driver allows a malicious or compromised NVMe-TCP storage controller to exfiltrate arbitrary stale kernel memory pages from a connected host. The flaw in `nvme_tcp_handle_r2t()` - which fails to validate that an incoming R2T (Ready to Transfer) PDU corresponds to a WRITE command - causes the host to respond to R2T PDUs targeting READ commands by transmitting the READ destination buffer (uninitialized kernel memory) back to the controller via H2CData PDUs. Exploitation produces no error log and the READ command completes normally, making the disclosure silent. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17%, consistent with the infrastructure-level attacker positioning required.
Information disclosure in the Linux kernel's NVMe-over-TCP (nvme-tcp) transport driver allows a malicious or compromised NVMe-TCP storage controller to serve a truncated read response - for example, answering a 4 096-byte read with only 512 bytes while asserting DATA_SUCCESS - causing the kernel to complete the request without detecting the shortfall and deliver a buffer whose unfilled portion contains stale kernel page contents to userspace. Affected kernels include all releases from the introduction of nvme-tcp support (commit 3f2304f8c6d6ed97849057bd16fee99e434ca796) through Linux 6.12.108, 6.18.49, and 7.2.3. No public exploit or CISA KEV listing has been identified; EPSS is 0.17 % at the 6th percentile, reflecting low community exploitation activity at time of analysis.
NULL pointer dereference in the Linux kernel's SCTP stream reconfiguration handler causes a kernel panic (DoS) reachable from the network. Three SCTP processing functions - sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out(), and sctp_process_strreset_resp() - dereference chunk->transport to stop the reconf timer when completing a stream reset, but a chunk published in asoc->strreset_chunk before transmission has a NULL transport pointer. This yields two distinct attack paths: a local unprivileged process that removes the association's last IP address then requests a stream reset, or a remote peer that crafts a RECONF chunk carrying Incoming SSN Reset, Outgoing SSN Reset, and Response sub-elements in a single packet, triggering the deref in softirq context. No public exploit code has been identified at time of analysis, and EPSS is 0.17%, but the remote network-unauthenticated path warrants prompt patching.
Memory leak (skb leak) in the Linux kernel's NTB (Non-Transparent Bridge) transport subsystem allows an attacker reachable via the ntb_netdev virtual network interface to cause progressive kernel memory exhaustion and denial of service. The bug exists in ntb_process_tx(), which silently "handles" oversized TX buffers by invoking tx_handler() with a NULL data pointer and returning success - causing ntb_netdev to skip both its completion-callback free and its enqueue error path, permanently leaking the socket buffer. No public exploit has been identified at time of analysis; EPSS is 0.17% (6th percentile), indicating very low exploitation probability currently. Upstream patches have been released across multiple stable kernel branches.
Delegation recall permanently stalls in Linux kernel NFSD when the callback queue fails during a lease break. In nfsd_break_one_deleg(), the NFSD4_CALLBACK_RUNNING bit is set atomically to serialize recall work, but if nfsd4_run_cb() cannot queue the workitem, the refcount is decremented while the bit is left set - creating a permanent latch that causes every subsequent break_lease() on the same delegation to silently return early. The result is that the delegation is never recalled and any conflicting NFS open or lock operation stalls indefinitely, constituting a server-side denial of service. No public exploit has been identified and EPSS is 0.17%, consistent with a logic-error DoS requiring a specific failure condition to manifest.
Persistent denial-of-service in the Linux kernel's NFSv4 server grace-period logic allows any reachable NFSv4 client to hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests. The root cause is a clock-domain mismatch in clients_still_reclaiming(): the deadline is derived from nn->boot_time (CLOCK_REALTIME, ~1.7 billion seconds since epoch) but compared against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since last boot - orders of magnitude smaller), making the comparison permanently false. As long as any client continues sending CLAIM_PREVIOUS, the grace period never ends, blocking all non-reclaim NFSv4 operations for every other connected client. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.
NULL pointer dereference in the Linux kernel's IPv6 RPL source routing header handler (`ipv6_rpl_srh_rcv()`) enables a remote unauthenticated attacker to crash the kernel by delivering IPv6 RPL-header packets during a concurrent MTU-drop event on the receiving interface. The race exists because `idev` obtained from `__in6_dev_get()` is used without a NULL guard - `addrconf_ifdown()` can clear `dev->ip6_ptr` via `RCU_INIT_POINTER()` between the time `ip6_rcv_core()` validates idev and the time `ipv6_rpl_srh_rcv()` dereferences `idev->cnf.rpl_seg_enabled`. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), consistent with low current weaponization.
SymSpellModelSerializer in Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 crashes the host JVM with an OutOfMemoryError when deserializing a crafted SymSpell binary model file whose unigramCount or bigramCount field is set to Integer.MAX_VALUE, forcing a 4-8 GB heap allocation attempt. The root cause (CWE-789: Uncontrolled Memory Allocation) is that these two 32-bit count fields are validated only for non-negativity - no upper bound prevents attacker-controlled pre-sizing of a LinkedHashMap before any dictionary entries are consumed. The attack payload is described by the advisory as under 100 bytes, requires no prior authentication if the target application accepts externally supplied model bytes, and is effective against every deserialization code path in the opennlp-spellcheck extension. No public exploit has been identified at time of analysis, and exposure is substantially limited to the small population running pre-release milestone builds.
Denial of service in the RACER swarm-exploration framework (Robotics-STAR-Lab / SYSU STAR Group) lets an attacker who can reach the exploration manager's ROS communication graph drive FastExplorationFSM::optTimerCallback() into an uncontrolled resource-consumption state, stalling or crashing the node and halting multi-robot exploration. The flaw is classified CWE-400 with a CVSS 3.1 base of 7.5 (full availability impact, no confidentiality or integrity impact). No public exploit code or CISA KEV entry was identified in the supplied intelligence, and EPSS is only 0.15% (5th percentile), consistent with the niche academic-robotics deployment of this codebase.
A denial-of-service condition in ZJU-FAST-Lab EGO-Planner-v2 (all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42) is triggered by the interaction between the traj_server and poscmd_2_odom nodes and the EGOReplanFSM emergency recovery logic, causing the planner to become unresponsive. The affected software is an open-source trajectory planner for autonomous quadrotors, so a successful denial of service can translate from a crashed planning process directly into loss of autonomous flight control. There is no confirmed evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.15% (5th percentile), indicating low predicted exploitation activity.
Uncontrolled resource consumption in jackson-databind's CoreXMLDeserializers allows unauthenticated remote attackers to trigger multi-minute CPU saturation via a single oversized HTTP request. When jackson-databind deserializes a JSON string into a javax.xml.datatype.Duration or XMLGregorianCalendar field, it passes the raw string directly to JDK's DatatypeFactory, which internally calls BigInteger(String) and BigDecimal(String) constructors that exhibit O(n²) time complexity relative to digit count. Because the malicious digits are embedded in a JSON string token rather than a JSON number token, jackson-core's existing StreamReadConstraints.maxNumberLength guard is bypassed entirely. A few megabytes of input containing millions of digits can consume tens of seconds to minutes of CPU, and a handful of concurrent such requests can exhaust a server's worker thread pool. No public exploit or CISA KEV listing has been identified at time of analysis.
Memory exhaustion DoS in the expressjs/compression Node.js middleware (versions before 1.8.2) allows remote unauthenticated attackers to crash any Express server using the package. When a client aborts an HTTP connection while a compressed response is in flight, the zlib transform stream allocated for that response is never destroyed, permanently leaking its native heap memory. An attacker can automate rapid request-then-abort cycles to exhaust all available server memory, causing process termination. The issue is fixed in 1.8.2 per the OpenJS Foundation advisory; no public exploit code or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Sofia IPC daemon's WS-Addressing Action transformation function allows remote unauthenticated attackers to crash Xiongmai XM530 IP cameras or potentially achieve arbitrary code execution by sending a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes. Affected firmware is HMT.CM2005-v220608.1837 and all earlier versions. A public vulnerability research repository exists for this CVE, suggesting exploit code or detailed PoC is available. No public exploit identified as confirmed actively exploited at time of analysis.