Monthly
CPU-exhaustion denial of service in ISC BIND 9 recursive resolvers (9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, plus the 9.18.11-S1-9.18.50-S1 and 9.20.9-S1-9.20.27-S1 preview builds) can be triggered by a single remote, unauthenticated query for the root of an already-cached tree of SVCB/HTTPS AliasMode records. Once such an AliasMode chain is resident in the resolver cache, the triggering query causes the resolver to spend disproportionate CPU time constructing the response, degrading or stalling name resolution for all clients of that resolver; impact is availability-only with no confidentiality or integrity effect. The assessed CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well calibrated, but exploitation is conditional on the attacker first causing the SVCB/HTTPS AliasMode tree to be resolved and cached (for example from an attacker-controlled zone) before issuing the trigger query; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by submitting specially crafted POST requests with excessively long scope parameters to the OpenID Connect token endpoint. No public exploit identified at time of analysis, but CVSS 7.5 (High) with network attack vector and low complexity indicates straightforward exploitation. Authentication requirements: unauthenticated (CVSS PR:N). The vulnerability stems from improper resource management (CWE-1050), enabling attackers to cause prolonged processing times and service disruption without any authentication or user interaction.
Unbounded decoding of PMAPPROC_DUMP replies in libtirpc lets a malicious or already-compromised RPC portmapper exhaust the memory and CPU of a client application that calls pmap_getmaps(), crashing or stalling the client process and causing a denial of service. The exposure is conditional and client-side: a remote attacker cannot initiate the exchange, so the victim must direct libtirpc-based tooling (NFS/RPC mount helpers, discovery or inventory scanners) at the attacker-controlled rpcbind, which is why the assessed vector is AV:N/AC:H/PR:N/UI:R with availability-only impact and no confidentiality, integrity, or code-execution consequences. Affected packages are those shipped in Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. At CVSS 5.3 this is a moderate-severity, low-priority issue in practice, and no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
An unsigned integer underflow in libXpm's XPM write/save path (libXpm before 3.5.19) causes unbounded CPU consumption and memory exhaustion, resulting in denial of service. The flaw is reachable only when an application linked against the library is made to write or convert attacker-influenced data to the XPM format, so exploitation is local (AV:L) and requires the victim to actively process the crafted input (UI:R); no privileges are required (PR:N) and there is no path to data disclosure or code execution. No public exploit has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; the upstream fix is present in a libXpm merge-request commit, with libXpm 3.5.19 indicated as the corrected version. Given the local, interaction-dependent trigger and DoS-only impact (CVSS 5.5), this is a genuine but low-priority issue.
Authenticated Sieve script manipulation in OX Dovecot Pro and CE allows low-privileged mail users to bypass configured per-user CPU resource limits and accumulate orphaned compiled script files on disk. By repeatedly switching the active Sieve script, an attacker resets the CPU accounting stored in each compiled artifact, circumventing the server-enforced cap indefinitely; separately, deleted or renamed scripts leave compiled files behind, causing unbounded disk growth. Sustained exploitation degrades mail delivery service across shared infrastructure. No public exploits are known, no CISA KEV listing exists, and the vendor-reported CVSS severity is Low (3.1).
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to slowdown over multiple packets (CVSS 5.3).
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to severe slowdowns (CVSS 3.7).
Evershop contains a vulnerability that allows attackers to exhaust the application server's resources via the "GET /images" API (CVSS 7.5).
ModSecurity versions prior to 2.9.10 contain a denial of service vulnerability in the `sanitiseArg` and `sanitizeArg` actions that allows unauthenticated remote attackers to cause service disruption by submitting requests with an excessive number of arguments. This is a network-accessible DoS vulnerability with high impact on availability that affects widely-deployed WAF deployments across Apache, IIS, and Nginx platforms.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
CPU-exhaustion denial of service in ISC BIND 9 recursive resolvers (9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, plus the 9.18.11-S1-9.18.50-S1 and 9.20.9-S1-9.20.27-S1 preview builds) can be triggered by a single remote, unauthenticated query for the root of an already-cached tree of SVCB/HTTPS AliasMode records. Once such an AliasMode chain is resident in the resolver cache, the triggering query causes the resolver to spend disproportionate CPU time constructing the response, degrading or stalling name resolution for all clients of that resolver; impact is availability-only with no confidentiality or integrity effect. The assessed CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well calibrated, but exploitation is conditional on the attacker first causing the SVCB/HTTPS AliasMode tree to be resolved and cached (for example from an attacker-controlled zone) before issuing the trigger query; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by submitting specially crafted POST requests with excessively long scope parameters to the OpenID Connect token endpoint. No public exploit identified at time of analysis, but CVSS 7.5 (High) with network attack vector and low complexity indicates straightforward exploitation. Authentication requirements: unauthenticated (CVSS PR:N). The vulnerability stems from improper resource management (CWE-1050), enabling attackers to cause prolonged processing times and service disruption without any authentication or user interaction.
Unbounded decoding of PMAPPROC_DUMP replies in libtirpc lets a malicious or already-compromised RPC portmapper exhaust the memory and CPU of a client application that calls pmap_getmaps(), crashing or stalling the client process and causing a denial of service. The exposure is conditional and client-side: a remote attacker cannot initiate the exchange, so the victim must direct libtirpc-based tooling (NFS/RPC mount helpers, discovery or inventory scanners) at the attacker-controlled rpcbind, which is why the assessed vector is AV:N/AC:H/PR:N/UI:R with availability-only impact and no confidentiality, integrity, or code-execution consequences. Affected packages are those shipped in Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. At CVSS 5.3 this is a moderate-severity, low-priority issue in practice, and no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
An unsigned integer underflow in libXpm's XPM write/save path (libXpm before 3.5.19) causes unbounded CPU consumption and memory exhaustion, resulting in denial of service. The flaw is reachable only when an application linked against the library is made to write or convert attacker-influenced data to the XPM format, so exploitation is local (AV:L) and requires the victim to actively process the crafted input (UI:R); no privileges are required (PR:N) and there is no path to data disclosure or code execution. No public exploit has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; the upstream fix is present in a libXpm merge-request commit, with libXpm 3.5.19 indicated as the corrected version. Given the local, interaction-dependent trigger and DoS-only impact (CVSS 5.5), this is a genuine but low-priority issue.
Authenticated Sieve script manipulation in OX Dovecot Pro and CE allows low-privileged mail users to bypass configured per-user CPU resource limits and accumulate orphaned compiled script files on disk. By repeatedly switching the active Sieve script, an attacker resets the CPU accounting stored in each compiled artifact, circumventing the server-enforced cap indefinitely; separately, deleted or renamed scripts leave compiled files behind, causing unbounded disk growth. Sustained exploitation degrades mail delivery service across shared infrastructure. No public exploits are known, no CISA KEV listing exists, and the vendor-reported CVSS severity is Low (3.1).
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to slowdown over multiple packets (CVSS 5.3).
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to severe slowdowns (CVSS 3.7).
Evershop contains a vulnerability that allows attackers to exhaust the application server's resources via the "GET /images" API (CVSS 7.5).
ModSecurity versions prior to 2.9.10 contain a denial of service vulnerability in the `sanitiseArg` and `sanitizeArg` actions that allows unauthenticated remote attackers to cause service disruption by submitting requests with an excessive number of arguments. This is a network-accessible DoS vulnerability with high impact on availability that affects widely-deployed WAF deployments across Apache, IIS, and Nginx platforms.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.