Monthly
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 lets a remote peer stall outbound mail delivery by accepting a TCP/TLS connection and then sending nothing. Socket timeouts are applied in the form the Windows stack accepts but Linux refuses, and the server's HTTPS clients (MTA-STS, DANE TLSA, OAuth2, ACME) read without a deadline, so an attacker can pin worker threads indefinitely and stop delivery, ManageSieve, and metrics service for everyone else. The MTA-STS policy fetch is enabled by default and is performed during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound mail stops; Windows builds are not affected at all. Per the authoritative assessment the vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), i.e. unauthenticated with no user interaction, but impact is bounded to availability only; no public exploit identified at time of analysis, and the fix ships in release 6.3.6.
Unauthenticated remote denial of service in Net-SNMP through 5.9.5.2 allows any network-reachable attacker to permanently suspend all SNMP processing by connecting to the SMUX listener and withholding data. The root cause is smux_accept() issuing a blocking recv() call with no timeout on every newly accepted SMUX connection, stalling snmpd's single-threaded main loop indefinitely. Because the block is permanent and snmpd performs all SNMP agent work in that same thread, the entire agent - monitoring, traps, polling - ceases until the process is manually restarted. No public exploit identified at time of analysis, though a researcher gist documenting the behavior is publicly linked in the advisory.
Unauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentication sessions open indefinitely by initiating a SASL login exchange and then withholding further data. The absence of a wall-clock timeout on the negotiation loop and no read deadline on the client socket means each such session permanently occupies a worker thread, a connection slot, and associated backend MongoDB handles until the process is restarted. Sustained repetition of this pattern can exhaust the configured connection pool capacity entirely, denying service to all legitimate BI tool users; no public exploit has been identified at time of analysis.
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A timeout during a TLS handshake can result in the connection failing to terminate. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 lets a remote peer stall outbound mail delivery by accepting a TCP/TLS connection and then sending nothing. Socket timeouts are applied in the form the Windows stack accepts but Linux refuses, and the server's HTTPS clients (MTA-STS, DANE TLSA, OAuth2, ACME) read without a deadline, so an attacker can pin worker threads indefinitely and stop delivery, ManageSieve, and metrics service for everyone else. The MTA-STS policy fetch is enabled by default and is performed during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound mail stops; Windows builds are not affected at all. Per the authoritative assessment the vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), i.e. unauthenticated with no user interaction, but impact is bounded to availability only; no public exploit identified at time of analysis, and the fix ships in release 6.3.6.
Unauthenticated remote denial of service in Net-SNMP through 5.9.5.2 allows any network-reachable attacker to permanently suspend all SNMP processing by connecting to the SMUX listener and withholding data. The root cause is smux_accept() issuing a blocking recv() call with no timeout on every newly accepted SMUX connection, stalling snmpd's single-threaded main loop indefinitely. Because the block is permanent and snmpd performs all SNMP agent work in that same thread, the entire agent - monitoring, traps, polling - ceases until the process is manually restarted. No public exploit identified at time of analysis, though a researcher gist documenting the behavior is publicly linked in the advisory.
Unauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentication sessions open indefinitely by initiating a SASL login exchange and then withholding further data. The absence of a wall-clock timeout on the negotiation loop and no read deadline on the client socket means each such session permanently occupies a worker thread, a connection slot, and associated backend MongoDB handles until the process is restarted. Sustained repetition of this pattern can exhaust the configured connection pool capacity entirely, denying service to all legitimate BI tool users; no public exploit has been identified at time of analysis.
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A timeout during a TLS handshake can result in the connection failing to terminate. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.