Monthly
Log storage exhaustion in MongoDB Connector for BI (mongosqld) allows any unauthenticated network peer to crash the shared process by generating sufficient connection log volume to fill the configured log path's backing storage. When a subsequent log write or rotation operation fails, an uncaught exception (CWE-248) terminates the mongosqld process, immediately denying SQL service to all connected clients. The process cannot recover autonomously - it continues to fail on startup until an operator manually reclaims disk space - and the diagnostic message explaining the condition is never persisted, compounding operational triage difficulty. No active exploitation has been identified at time of analysis.
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers to crash the entire Node.js process by submitting a small, specially crafted multipart/form-data request. The attack exploits an uncaught RangeError in multer's append-field dependency: a first field with an extremely large numeric index allocates a maximum-length sparse array, and a second field pushes past that limit, throwing an exception that multer does not catch. No public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity nature of the attack makes this a realistic availability threat for any internet-facing Node.js application using multer.
Remote unauthenticated denial-of-service in alos-http, a Linux amd64 Go web framework, allows any network-reachable client to crash the entire server process with a single malformed HTTP request. The flaw exists in the request-line parser's `sanitizeRequestPath` function, which performs an unchecked index into an empty string after stripping a bare query-string path such as `GET ? HTTP/1.1`. Because the panic fires in the connection-worker goroutine before the handler chain, the framework's own `core.Recovery()` middleware cannot intercept it, making the crash total and immediate. A publicly available proof-of-concept exploit exists; the vulnerability is not currently listed in the CISA KEV catalog.
Denial-of-service in gitoxide's gix-pack crate before 0.69.0 exposes Rust Git clients to remote process crashes during clone or fetch operations via two distinct attack vectors. Unchecked array indexing in the delta application routine causes index-out-of-bounds panics on truncated pack data, while uncapped buffer allocation from attacker-controlled LEB128 size headers allows a 10-byte crafted pack entry to trigger an immediate out-of-memory process kill - both exploitable by any Git server the victim connects to. No active exploitation has been confirmed (not in CISA KEV), but the unauthenticated, network-reachable attack surface with trivial complexity makes this a high-priority patch for any environment running automated clone or fetch workflows against external remotes.
Unauthenticated denial of service in Faktory prior to 1.10.0 allows any network-reachable attacker to crash the entire job server process by sending a single bare command verb without a payload. Because Go's runtime panics on out-of-bounds slice operations and no recover() wrapper exists in the command-dispatch path, the panic terminates the whole process rather than just the offending connection, instantly dropping all workers, clients, and in-flight jobs. No public exploit code has been identified at time of analysis, but the attack vector is trivially constructable from the description alone and can be repeated indefinitely to sustain the outage.
Rclone before v1.75.0 panics in the WebDAV TUS creation handler when a transport failure returns a nil HTTP response, because `getTusLocationOrRetry` dereferences `resp.StatusCode` before checking the accompanying error - crashing the process if it runs as a long-lived VFS mount or multi-workload goroutine without a recovery boundary. An attacker who controls or compromises the configured WebDAV endpoint can trigger the crash by resetting the TCP connection before an HTTP response is returned, halting all unrelated work in the process. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Denial-of-service in Tie::Hash::Regex before 2.0.0 for Perl allows unauthenticated remote attackers to crash any application that performs hash lookups with externally supplied strings. The FETCH, EXISTS, and DELETE methods compiled caller-provided keys as bare regex patterns without an eval guard, causing the Perl process to die on any syntactically invalid pattern such as an unmatched bracket. No public exploit code has been identified, and EPSS sits at just 0.24% (15th percentile), consistent with a niche library with narrow deployment; however, the impact on any affected application is immediate process termination.
Sandbox escape in asteval allows any attacker who can supply expressions to `Interpreter.eval()` to raise `SystemExit`, `KeyboardInterrupt`, `GeneratorExit`, or `BaseException`, bypassing both `run()` and `eval()` exception handlers - which catch only `Exception` - and terminating or disrupting the calling process. All asteval versions through 1.0.6 are affected; version 1.0.9 resolves the issue. No active exploitation has been confirmed (not in CISA KEV), but a working proof-of-concept covering all four variants is included in the public advisory GHSA-89v8-rhwq-hf77, and this is a third distinct sandbox-escape class in asteval following CVE-2025-24359 and GHSA-vp47-9734-prjw.
Denial of service in Zabbix server and proxy can be triggered by an authenticated administrator who crafts malicious JavaScript scripts within preprocessing or script item configurations, causing the server or proxy process to crash. All Zabbix versions are listed as affected per the wildcard CPE entry. Exploitation requires high-privilege administrative access, and no public exploit code or CISA KEV listing exists at time of analysis.
Remote process termination in actix-files 0.6.9 and earlier allows any unauthenticated network attacker to crash a Rust web server by sending a single GET request with an empty Range header, triggering a panic in the static file handler at named.rs:534. The vulnerability is only catastrophic when the application is compiled with `panic = "abort"` - the non-default Rust build profile - because in that mode the entire process terminates rather than unwinding the panicking thread. A publicly available proof-of-concept exists in the vendor advisory, and no public exploit identification beyond a netcat one-liner is required.
Log storage exhaustion in MongoDB Connector for BI (mongosqld) allows any unauthenticated network peer to crash the shared process by generating sufficient connection log volume to fill the configured log path's backing storage. When a subsequent log write or rotation operation fails, an uncaught exception (CWE-248) terminates the mongosqld process, immediately denying SQL service to all connected clients. The process cannot recover autonomously - it continues to fail on startup until an operator manually reclaims disk space - and the diagnostic message explaining the condition is never persisted, compounding operational triage difficulty. No active exploitation has been identified at time of analysis.
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers to crash the entire Node.js process by submitting a small, specially crafted multipart/form-data request. The attack exploits an uncaught RangeError in multer's append-field dependency: a first field with an extremely large numeric index allocates a maximum-length sparse array, and a second field pushes past that limit, throwing an exception that multer does not catch. No public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity nature of the attack makes this a realistic availability threat for any internet-facing Node.js application using multer.
Remote unauthenticated denial-of-service in alos-http, a Linux amd64 Go web framework, allows any network-reachable client to crash the entire server process with a single malformed HTTP request. The flaw exists in the request-line parser's `sanitizeRequestPath` function, which performs an unchecked index into an empty string after stripping a bare query-string path such as `GET ? HTTP/1.1`. Because the panic fires in the connection-worker goroutine before the handler chain, the framework's own `core.Recovery()` middleware cannot intercept it, making the crash total and immediate. A publicly available proof-of-concept exploit exists; the vulnerability is not currently listed in the CISA KEV catalog.
Denial-of-service in gitoxide's gix-pack crate before 0.69.0 exposes Rust Git clients to remote process crashes during clone or fetch operations via two distinct attack vectors. Unchecked array indexing in the delta application routine causes index-out-of-bounds panics on truncated pack data, while uncapped buffer allocation from attacker-controlled LEB128 size headers allows a 10-byte crafted pack entry to trigger an immediate out-of-memory process kill - both exploitable by any Git server the victim connects to. No active exploitation has been confirmed (not in CISA KEV), but the unauthenticated, network-reachable attack surface with trivial complexity makes this a high-priority patch for any environment running automated clone or fetch workflows against external remotes.
Unauthenticated denial of service in Faktory prior to 1.10.0 allows any network-reachable attacker to crash the entire job server process by sending a single bare command verb without a payload. Because Go's runtime panics on out-of-bounds slice operations and no recover() wrapper exists in the command-dispatch path, the panic terminates the whole process rather than just the offending connection, instantly dropping all workers, clients, and in-flight jobs. No public exploit code has been identified at time of analysis, but the attack vector is trivially constructable from the description alone and can be repeated indefinitely to sustain the outage.
Rclone before v1.75.0 panics in the WebDAV TUS creation handler when a transport failure returns a nil HTTP response, because `getTusLocationOrRetry` dereferences `resp.StatusCode` before checking the accompanying error - crashing the process if it runs as a long-lived VFS mount or multi-workload goroutine without a recovery boundary. An attacker who controls or compromises the configured WebDAV endpoint can trigger the crash by resetting the TCP connection before an HTTP response is returned, halting all unrelated work in the process. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Denial-of-service in Tie::Hash::Regex before 2.0.0 for Perl allows unauthenticated remote attackers to crash any application that performs hash lookups with externally supplied strings. The FETCH, EXISTS, and DELETE methods compiled caller-provided keys as bare regex patterns without an eval guard, causing the Perl process to die on any syntactically invalid pattern such as an unmatched bracket. No public exploit code has been identified, and EPSS sits at just 0.24% (15th percentile), consistent with a niche library with narrow deployment; however, the impact on any affected application is immediate process termination.
Sandbox escape in asteval allows any attacker who can supply expressions to `Interpreter.eval()` to raise `SystemExit`, `KeyboardInterrupt`, `GeneratorExit`, or `BaseException`, bypassing both `run()` and `eval()` exception handlers - which catch only `Exception` - and terminating or disrupting the calling process. All asteval versions through 1.0.6 are affected; version 1.0.9 resolves the issue. No active exploitation has been confirmed (not in CISA KEV), but a working proof-of-concept covering all four variants is included in the public advisory GHSA-89v8-rhwq-hf77, and this is a third distinct sandbox-escape class in asteval following CVE-2025-24359 and GHSA-vp47-9734-prjw.
Denial of service in Zabbix server and proxy can be triggered by an authenticated administrator who crafts malicious JavaScript scripts within preprocessing or script item configurations, causing the server or proxy process to crash. All Zabbix versions are listed as affected per the wildcard CPE entry. Exploitation requires high-privilege administrative access, and no public exploit code or CISA KEV listing exists at time of analysis.
Remote process termination in actix-files 0.6.9 and earlier allows any unauthenticated network attacker to crash a Rust web server by sending a single GET request with an empty Range header, triggering a panic in the static file handler at named.rs:534. The vulnerability is only catastrophic when the application is compiled with `panic = "abort"` - the non-default Rust build profile - because in that mode the entire process terminates rather than unwinding the panicking thread. A publicly available proof-of-concept exists in the vendor advisory, and no public exploit identification beyond a netcat one-liner is required.