Monthly
Memory exhaustion DoS in the expressjs/compression Node.js middleware (versions before 1.8.2) allows remote unauthenticated attackers to crash any Express server using the package. When a client aborts an HTTP connection while a compressed response is in flight, the zlib transform stream allocated for that response is never destroyed, permanently leaking its native heap memory. An attacker can automate rapid request-then-abort cycles to exhaust all available server memory, causing process termination. The issue is fixed in 1.8.2 per the OpenJS Foundation advisory; no public exploit code or KEV listing has been identified at time of analysis.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Memory exhaustion in Windows Active Directory Domain Services enables unauthenticated remote attackers to crash or severely degrade the AD DS service by repeatedly triggering a memory leak (CWE-401), denying authentication and directory services to all domain-joined systems. Affected builds span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit has been identified at time of analysis, though the unauthenticated network vector (PR:N, AV:N) makes this a significant priority for enterprise environments where AD DS availability is business-critical.
Remote denial-of-service in the Windows TCP/IP kernel stack allows an unauthenticated network attacker to exhaust kernel memory by sending crafted packets that trigger a memory allocation without a corresponding release (CWE-401), ultimately crashing or severely degrading affected systems. Affected releases span Windows Server 2022 and 2025, as well as Windows 11 versions 23H2 through 26H1, all with fixed builds published in the Microsoft Security Response Center update guide. No public exploit has been identified at time of analysis, and this vulnerability has not appeared in the CISA KEV catalog; however, the zero-authentication, low-complexity network vector makes the affected Windows TCP/IP stack a credible target for disruptive attacks against any internet- or network-exposed Windows deployment.
Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. Exploitation is gated on a non-default configuration - Web Access must be explicitly enabled on devices registered to Cisco Unified Communications Manager - materially limiting real-world attack surface despite the network-accessible vector. No public exploit code and no CISA KEV listing were identified at time of analysis.
Memory exhaustion in Spring Framework's RSocket server implementation allows unauthenticated remote attackers to crash or degrade affected applications by sending malformed SETUP frames that trigger unreclaimed heap allocations. All actively maintained Spring Framework branches are affected - 5.2.x through 7.0.x - with the condition that the application must explicitly expose an RSocket endpoint. No public exploit code has been identified at time of analysis, and CISA SSVC confirms no current exploitation activity, though the attack is classified as automatable.
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Memory leak in Open5GS v2.7.0's AMF component allows remote unauthenticated attackers to exhaust process memory and crash the Access and Mobility Management Function via crafted NGAP messages. The vulnerable function ngap_send_to_nas() in src/amf/ngap-path.c fails to release allocated memory (CWE-401), enabling a sustained DoS against the 5G core network's connection management plane. No public exploit confirmation as CISA KEV, but a proof-of-concept gist has been published by the reporter, and the CVSS score of 7.5 with network vector and no authentication requirement reflects meaningful real-world risk for exposed deployments.
Memory exhaustion denial-of-service in OpenSSL 3.6.0-3.6.3 and 4.0.0-4.0.1 allows a malicious TLS server to leak attacker-tunable amounts of heap memory per handshake in connecting client applications that have explicitly enabled OCSP staple verification. By delivering a syntactically valid BasicOCSPResponse containing an empty SingleResponse sequence - optionally padded with bogus certificates to amplify each allocation - the server causes the internal OCSP_BASICRESP structure to be allocated but never freed, bypassing the cleanup path. No public exploit has been identified at time of analysis and no CISA KEV listing exists; risk is bounded by the non-default OCSP flag requirement.
Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the OPC UA server's off-heap direct memory pool by repeatedly sending incomplete UASC message chunks and disconnecting before message assembly completes. The UASC server-side asymmetric handler and ChunkDecoder fail to invoke ReferenceCountUtil.safeRelease() on retained Netty ByteBuf objects when the channel lifecycle ends, causing unbounded off-heap memory accumulation. No authentication is required and no special server configuration is necessary; the fix commit is publicly available on GitHub, serving as an effective blueprint for exploitation, though no standalone POC tool or CISA KEV listing has been identified at time of analysis.
Memory exhaustion DoS in the expressjs/compression Node.js middleware (versions before 1.8.2) allows remote unauthenticated attackers to crash any Express server using the package. When a client aborts an HTTP connection while a compressed response is in flight, the zlib transform stream allocated for that response is never destroyed, permanently leaking its native heap memory. An attacker can automate rapid request-then-abort cycles to exhaust all available server memory, causing process termination. The issue is fixed in 1.8.2 per the OpenJS Foundation advisory; no public exploit code or KEV listing has been identified at time of analysis.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Memory exhaustion in Windows Active Directory Domain Services enables unauthenticated remote attackers to crash or severely degrade the AD DS service by repeatedly triggering a memory leak (CWE-401), denying authentication and directory services to all domain-joined systems. Affected builds span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit has been identified at time of analysis, though the unauthenticated network vector (PR:N, AV:N) makes this a significant priority for enterprise environments where AD DS availability is business-critical.
Remote denial-of-service in the Windows TCP/IP kernel stack allows an unauthenticated network attacker to exhaust kernel memory by sending crafted packets that trigger a memory allocation without a corresponding release (CWE-401), ultimately crashing or severely degrading affected systems. Affected releases span Windows Server 2022 and 2025, as well as Windows 11 versions 23H2 through 26H1, all with fixed builds published in the Microsoft Security Response Center update guide. No public exploit has been identified at time of analysis, and this vulnerability has not appeared in the CISA KEV catalog; however, the zero-authentication, low-complexity network vector makes the affected Windows TCP/IP stack a credible target for disruptive attacks against any internet- or network-exposed Windows deployment.
Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. Exploitation is gated on a non-default configuration - Web Access must be explicitly enabled on devices registered to Cisco Unified Communications Manager - materially limiting real-world attack surface despite the network-accessible vector. No public exploit code and no CISA KEV listing were identified at time of analysis.
Memory exhaustion in Spring Framework's RSocket server implementation allows unauthenticated remote attackers to crash or degrade affected applications by sending malformed SETUP frames that trigger unreclaimed heap allocations. All actively maintained Spring Framework branches are affected - 5.2.x through 7.0.x - with the condition that the application must explicitly expose an RSocket endpoint. No public exploit code has been identified at time of analysis, and CISA SSVC confirms no current exploitation activity, though the attack is classified as automatable.
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Memory leak in Open5GS v2.7.0's AMF component allows remote unauthenticated attackers to exhaust process memory and crash the Access and Mobility Management Function via crafted NGAP messages. The vulnerable function ngap_send_to_nas() in src/amf/ngap-path.c fails to release allocated memory (CWE-401), enabling a sustained DoS against the 5G core network's connection management plane. No public exploit confirmation as CISA KEV, but a proof-of-concept gist has been published by the reporter, and the CVSS score of 7.5 with network vector and no authentication requirement reflects meaningful real-world risk for exposed deployments.
Memory exhaustion denial-of-service in OpenSSL 3.6.0-3.6.3 and 4.0.0-4.0.1 allows a malicious TLS server to leak attacker-tunable amounts of heap memory per handshake in connecting client applications that have explicitly enabled OCSP staple verification. By delivering a syntactically valid BasicOCSPResponse containing an empty SingleResponse sequence - optionally padded with bogus certificates to amplify each allocation - the server causes the internal OCSP_BASICRESP structure to be allocated but never freed, bypassing the cleanup path. No public exploit has been identified at time of analysis and no CISA KEV listing exists; risk is bounded by the non-default OCSP flag requirement.
Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the OPC UA server's off-heap direct memory pool by repeatedly sending incomplete UASC message chunks and disconnecting before message assembly completes. The UASC server-side asymmetric handler and ChunkDecoder fail to invoke ReferenceCountUtil.safeRelease() on retained Netty ByteBuf objects when the channel lifecycle ends, causing unbounded off-heap memory accumulation. No authentication is required and no special server configuration is necessary; the fix commit is publicly available on GitHub, serving as an effective blueprint for exploitation, though no standalone POC tool or CISA KEV listing has been identified at time of analysis.