Monthly
BEAM atom table exhaustion in Boruta Server prior to 0.10.0 allows any authenticated end user to crash the entire OAuth 2.0/OpenID Connect umbrella application by repeatedly submitting PUT /users/settings requests with arbitrary novel body keys. The UserSettingsController calls String.to_atom/1 on all user-supplied map keys before any validation, permanently interning them in the Erlang VM's global atom table (hard cap: 1,048,576 entries). Once exhausted, the BEAM runtime aborts with 'no more index entries in atom_tab', taking down the auth, admin, and gateway components simultaneously. No public exploit identified at time of analysis, and the issue has been patched in version 0.10.0.
Uncontrolled resource consumption in ntegrals openbrowser's Browser Agent Message Construction component allows remote attackers to degrade availability by crafting malicious messages that exhaust agent resources. The affected code resides in packages/core/src/agent/agent.ts, and the flaw requires passive user interaction (UI:P) per the CVSS 4.0 vector, limiting full automation. A public proof-of-concept has been published on GitHub; the vendor was notified but did not respond, and no patch exists.
Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's `maxTotalMergeKeys` safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (`<<`) processing is enabled by default on both release lines. No confirmed active exploitation appears in CISA KEV at time of analysis, but the attack is trivially reproducible from the published advisory and pathological test case, and the library's ubiquity in the npm ecosystem makes this a high-priority availability risk.
Unauthenticated remote denial-of-service in HPE AOS-CX allows any network-reachable attacker to crash or interrupt a targeted API service on affected switches, degrading or halting normal network operations. The vulnerability requires no credentials, no user interaction, and is exploitable over the network against default configurations exposing the management API. This CVE is part of HPE Security Bulletin HPESBNW05134, which also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749) and a CVSS 7.2 authenticated command injection (CVE-2026-73766) in the same platform; no public exploit has been identified at time of analysis.
Unauthenticated denial-of-service in HPE AOS-CX allows an adjacent-network attacker to crash or disrupt affected switches by sending specially crafted packets, resulting in loss of normal network operations. The vulnerability requires no credentials and no user interaction, making it exploitable by any actor with access to the same Layer-2 or adjacent network segment. No public exploit code or active exploitation has been identified at time of analysis; this is part of a multi-CVE bundle disclosed in HPE bulletin HPESBNW05134, which also covers higher-severity RCE flaws (CVE-2026-73749, CVE-2026-73782) and an auth bypass (CVE-2026-73778) in the same product line.
Denial-of-service conditions in HPE AOS-CX's command line interface allow a low-privileged authenticated user with network access to disrupt normal system operation. Part of the broader HPE advisory hpesbnw05134 addressing multiple AOS-CX vulnerabilities, this issue targets the CLI layer - accessible over SSH - but requires high attack complexity to successfully trigger. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Heap-exhaustion denial-of-service in Hono web framework before 4.13.5 allows unauthenticated network attackers to crash the JavaScript server process by submitting form requests with deeply nested or numerous dot-separated field names when dot-notation parsing is explicitly enabled. The `parseBody()` function expands dot-separated keys into nested JavaScript objects without any bound on nesting depth or total intermediate object count, allowing a normal-sized request body to produce an object graph orders of magnitude larger and exhaust the runtime heap. Exploitation causes server process termination and service outage until manual restart; no public exploit is identified at time of analysis.
Denial-of-service in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator to interrupt service availability. The flaw requires high-complexity conditions (AV:N/AC:H/PR:L) and produces only limited availability impact, placing it at CVSS 3.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in HPE Networking Fabric Composer's web-based management interface can be triggered by an authenticated low-privilege operator, disrupting the availability of the management UI. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a low-severity, network-accessible flaw requiring valid credentials and user interaction, yielding only limited availability impact. No exploitation has been publicly demonstrated, and the vulnerability does not affect the underlying fabric infrastructure - only the management interface itself.
Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
BEAM atom table exhaustion in Boruta Server prior to 0.10.0 allows any authenticated end user to crash the entire OAuth 2.0/OpenID Connect umbrella application by repeatedly submitting PUT /users/settings requests with arbitrary novel body keys. The UserSettingsController calls String.to_atom/1 on all user-supplied map keys before any validation, permanently interning them in the Erlang VM's global atom table (hard cap: 1,048,576 entries). Once exhausted, the BEAM runtime aborts with 'no more index entries in atom_tab', taking down the auth, admin, and gateway components simultaneously. No public exploit identified at time of analysis, and the issue has been patched in version 0.10.0.
Uncontrolled resource consumption in ntegrals openbrowser's Browser Agent Message Construction component allows remote attackers to degrade availability by crafting malicious messages that exhaust agent resources. The affected code resides in packages/core/src/agent/agent.ts, and the flaw requires passive user interaction (UI:P) per the CVSS 4.0 vector, limiting full automation. A public proof-of-concept has been published on GitHub; the vendor was notified but did not respond, and no patch exists.
Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's `maxTotalMergeKeys` safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (`<<`) processing is enabled by default on both release lines. No confirmed active exploitation appears in CISA KEV at time of analysis, but the attack is trivially reproducible from the published advisory and pathological test case, and the library's ubiquity in the npm ecosystem makes this a high-priority availability risk.
Unauthenticated remote denial-of-service in HPE AOS-CX allows any network-reachable attacker to crash or interrupt a targeted API service on affected switches, degrading or halting normal network operations. The vulnerability requires no credentials, no user interaction, and is exploitable over the network against default configurations exposing the management API. This CVE is part of HPE Security Bulletin HPESBNW05134, which also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749) and a CVSS 7.2 authenticated command injection (CVE-2026-73766) in the same platform; no public exploit has been identified at time of analysis.
Unauthenticated denial-of-service in HPE AOS-CX allows an adjacent-network attacker to crash or disrupt affected switches by sending specially crafted packets, resulting in loss of normal network operations. The vulnerability requires no credentials and no user interaction, making it exploitable by any actor with access to the same Layer-2 or adjacent network segment. No public exploit code or active exploitation has been identified at time of analysis; this is part of a multi-CVE bundle disclosed in HPE bulletin HPESBNW05134, which also covers higher-severity RCE flaws (CVE-2026-73749, CVE-2026-73782) and an auth bypass (CVE-2026-73778) in the same product line.
Denial-of-service conditions in HPE AOS-CX's command line interface allow a low-privileged authenticated user with network access to disrupt normal system operation. Part of the broader HPE advisory hpesbnw05134 addressing multiple AOS-CX vulnerabilities, this issue targets the CLI layer - accessible over SSH - but requires high attack complexity to successfully trigger. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Heap-exhaustion denial-of-service in Hono web framework before 4.13.5 allows unauthenticated network attackers to crash the JavaScript server process by submitting form requests with deeply nested or numerous dot-separated field names when dot-notation parsing is explicitly enabled. The `parseBody()` function expands dot-separated keys into nested JavaScript objects without any bound on nesting depth or total intermediate object count, allowing a normal-sized request body to produce an object graph orders of magnitude larger and exhaust the runtime heap. Exploitation causes server process termination and service outage until manual restart; no public exploit is identified at time of analysis.
Denial-of-service in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator to interrupt service availability. The flaw requires high-complexity conditions (AV:N/AC:H/PR:L) and produces only limited availability impact, placing it at CVSS 3.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in HPE Networking Fabric Composer's web-based management interface can be triggered by an authenticated low-privilege operator, disrupting the availability of the management UI. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a low-severity, network-accessible flaw requiring valid credentials and user interaction, yielding only limited availability impact. No exploitation has been publicly demonstrated, and the vulnerability does not affect the underlying fabric infrastructure - only the management interface itself.
Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.