Monthly
Memory exhaustion vulnerabilities in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to crash the portal daemon within minutes by triggering unfreed heap allocations in the authentication handler. The root cause is CWE-401 (missing memory release) in src/auth.c, where intermediate buffers allocated during gateway interface lookups in client_auth() are never freed on certain code paths. No confirmed active exploitation exists and no CISA KEV listing is present, but the attack surface is inherently broad in public hotspot deployments where any connected device can trigger the vulnerable authentication flow.
Memory exhaustion in Spring Framework's RSocket server implementation allows unauthenticated remote attackers to crash or degrade affected applications by sending malformed SETUP frames that trigger unreclaimed heap allocations. All actively maintained Spring Framework branches are affected - 5.2.x through 7.0.x - with the condition that the application must explicitly expose an RSocket endpoint. No public exploit code has been identified at time of analysis, and CISA SSVC confirms no current exploitation activity, though the attack is classified as automatable.
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against long-running Ruby applications that pass attacker-controlled input to `Nokogiri::XSLT::Stylesheet#transform` parameters containing null bytes. Each null-byte-bearing call leaks approximately 24-32 bytes of heap memory; meaningful service degradation requires sustained, high-rate malicious traffic against the specific code path. No public exploit has been identified at time of analysis, and the vulnerability is absent from CISA KEV. Notably, the VulnCheck-reported CVSS 4.0 score of 6.9 is higher than the Nokogiri maintainers' own assessment of CVSS 5.3 Moderate, reflecting scoring convention differences rather than disagreement on impact.
Heap exhaustion via unbounded memory leak in micrometer-core affects Java applications using Apache HttpAsyncClient (4.x or 5.x) instrumented with MicrometerHttpClientInterceptor. When asynchronous HTTP requests fail before receiving any server response - due to connection resets, network timeouts, or unreachable endpoints - the per-request tracking state allocated by the interceptor is never released, accumulating indefinitely on the JVM heap. Sustained failure conditions (such as a misbehaving or attacker-controlled upstream server) can drive heap exhaustion to OutOfMemoryError, crashing the instrumented application. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Permanent Wi-Fi denial-of-service in the Infineon AIROC driver shipped with Zephyr RTOS 3.6.0 through 4.4.1 allows a Wi-Fi-adjacent attacker to exhaust a fixed 20-buffer transmit/receive pool by inducing repeated synchronous WHD send failures, each of which leaks one buffer from airoc_pool without releasing it. Once the pool is fully exhausted, both transmit and WHD-driven receive paths fail, severing all Wi-Fi connectivity until the device is physically rebooted. No active exploitation is recorded in CISA KEV and no public exploit code has been identified, but the defect can also manifest organically over a device's operational lifetime through ordinary transient failures.
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Memory leak in Open5GS v2.7.0's AMF component allows remote unauthenticated attackers to exhaust process memory and crash the Access and Mobility Management Function via crafted NGAP messages. The vulnerable function ngap_send_to_nas() in src/amf/ngap-path.c fails to release allocated memory (CWE-401), enabling a sustained DoS against the 5G core network's connection management plane. No public exploit confirmation as CISA KEV, but a proof-of-concept gist has been published by the reporter, and the CVSS score of 7.5 with network vector and no authentication requirement reflects meaningful real-world risk for exposed deployments.
Unbounded memory growth in @hono/node-server 2.0.0-2.0.9 allows unauthenticated remote attackers to exhaust server memory and cause denial of service by flooding any public WebSocket upgrade route with requests bearing a missing or malformed Sec-WebSocket-Key header. The root cause is a missing cleanup path in src/websocket.ts: when ws.handleUpgrade rejects the handshake, no connection event fires, leaving the IncomingMessage permanently retained in waiterMap and the waitForWebSocket promise perpetually pending. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the fix is available in v2.0.10.
Memory leak exploitation in Almico Speedfan 4.52 is constrained to local, high-privilege access and produces limited availability degradation via the speedfan.sys kernel driver's MSR Index Handler. The vulnerability resides in the KiSystemCall64 handler path within speedfan.sys, where kernel pool memory is allocated but never released during MSR index processing, enabling gradual resource exhaustion on affected Windows hosts. A publicly available proof-of-concept exists, no vendor patch has been issued, and the vendor has not responded to coordinated disclosure.
Netty's RedisArrayAggregator codec fails to release retained partial aggregate state when the maxElements limit is exceeded, unlike the symmetric maxNestedArrayDepth branch which correctly calls releaseAndClearDepths() before throwing. In applications that keep the channel alive after a codec exception - a common resilience pattern - an unauthenticated peer can exploit this inconsistency to keep attacker-controlled ByteBuf references pinned in Netty's pooled buffer allocator and cause subsequent messages to be consumed into the stale pre-error aggregate. A public proof-of-concept test is included in the GHSA advisory; fixed in Netty 4.1.136.Final and 4.2.16.Final with no KEV listing at time of analysis.
Memory exhaustion vulnerabilities in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to crash the portal daemon within minutes by triggering unfreed heap allocations in the authentication handler. The root cause is CWE-401 (missing memory release) in src/auth.c, where intermediate buffers allocated during gateway interface lookups in client_auth() are never freed on certain code paths. No confirmed active exploitation exists and no CISA KEV listing is present, but the attack surface is inherently broad in public hotspot deployments where any connected device can trigger the vulnerable authentication flow.
Memory exhaustion in Spring Framework's RSocket server implementation allows unauthenticated remote attackers to crash or degrade affected applications by sending malformed SETUP frames that trigger unreclaimed heap allocations. All actively maintained Spring Framework branches are affected - 5.2.x through 7.0.x - with the condition that the application must explicitly expose an RSocket endpoint. No public exploit code has been identified at time of analysis, and CISA SSVC confirms no current exploitation activity, though the attack is classified as automatable.
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against long-running Ruby applications that pass attacker-controlled input to `Nokogiri::XSLT::Stylesheet#transform` parameters containing null bytes. Each null-byte-bearing call leaks approximately 24-32 bytes of heap memory; meaningful service degradation requires sustained, high-rate malicious traffic against the specific code path. No public exploit has been identified at time of analysis, and the vulnerability is absent from CISA KEV. Notably, the VulnCheck-reported CVSS 4.0 score of 6.9 is higher than the Nokogiri maintainers' own assessment of CVSS 5.3 Moderate, reflecting scoring convention differences rather than disagreement on impact.
Heap exhaustion via unbounded memory leak in micrometer-core affects Java applications using Apache HttpAsyncClient (4.x or 5.x) instrumented with MicrometerHttpClientInterceptor. When asynchronous HTTP requests fail before receiving any server response - due to connection resets, network timeouts, or unreachable endpoints - the per-request tracking state allocated by the interceptor is never released, accumulating indefinitely on the JVM heap. Sustained failure conditions (such as a misbehaving or attacker-controlled upstream server) can drive heap exhaustion to OutOfMemoryError, crashing the instrumented application. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Permanent Wi-Fi denial-of-service in the Infineon AIROC driver shipped with Zephyr RTOS 3.6.0 through 4.4.1 allows a Wi-Fi-adjacent attacker to exhaust a fixed 20-buffer transmit/receive pool by inducing repeated synchronous WHD send failures, each of which leaks one buffer from airoc_pool without releasing it. Once the pool is fully exhausted, both transmit and WHD-driven receive paths fail, severing all Wi-Fi connectivity until the device is physically rebooted. No active exploitation is recorded in CISA KEV and no public exploit code has been identified, but the defect can also manifest organically over a device's operational lifetime through ordinary transient failures.
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Memory leak in Open5GS v2.7.0's AMF component allows remote unauthenticated attackers to exhaust process memory and crash the Access and Mobility Management Function via crafted NGAP messages. The vulnerable function ngap_send_to_nas() in src/amf/ngap-path.c fails to release allocated memory (CWE-401), enabling a sustained DoS against the 5G core network's connection management plane. No public exploit confirmation as CISA KEV, but a proof-of-concept gist has been published by the reporter, and the CVSS score of 7.5 with network vector and no authentication requirement reflects meaningful real-world risk for exposed deployments.
Unbounded memory growth in @hono/node-server 2.0.0-2.0.9 allows unauthenticated remote attackers to exhaust server memory and cause denial of service by flooding any public WebSocket upgrade route with requests bearing a missing or malformed Sec-WebSocket-Key header. The root cause is a missing cleanup path in src/websocket.ts: when ws.handleUpgrade rejects the handshake, no connection event fires, leaving the IncomingMessage permanently retained in waiterMap and the waitForWebSocket promise perpetually pending. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the fix is available in v2.0.10.
Memory leak exploitation in Almico Speedfan 4.52 is constrained to local, high-privilege access and produces limited availability degradation via the speedfan.sys kernel driver's MSR Index Handler. The vulnerability resides in the KiSystemCall64 handler path within speedfan.sys, where kernel pool memory is allocated but never released during MSR index processing, enabling gradual resource exhaustion on affected Windows hosts. A publicly available proof-of-concept exists, no vendor patch has been issued, and the vendor has not responded to coordinated disclosure.
Netty's RedisArrayAggregator codec fails to release retained partial aggregate state when the maxElements limit is exceeded, unlike the symmetric maxNestedArrayDepth branch which correctly calls releaseAndClearDepths() before throwing. In applications that keep the channel alive after a codec exception - a common resilience pattern - an unauthenticated peer can exploit this inconsistency to keep attacker-controlled ByteBuf references pinned in Netty's pooled buffer allocator and cause subsequent messages to be consumed into the stale pre-error aggregate. A public proof-of-concept test is included in the GHSA advisory; fixed in Netty 4.1.136.Final and 4.2.16.Final with no KEV listing at time of analysis.