Monthly
DTLS memory exhaustion in OpenSSL allows unauthenticated remote peers to consume disproportionate server memory during handshake processing. Sending small forged records that claim a future epoch triggers OpenSSL to buffer the entire ~16 KB read buffer rather than just the actual record bytes, yielding an amplification factor of approximately 1,200× per record; up to 100 such records may be queued per connection, exposing roughly 1.7 MB of server memory per association from a negligible volume of transmitted data. No public exploit has been identified at time of analysis and SSVC rates exploitation status as none, but the attack is rated automatable and can be multiplied across many concurrent DTLS connections.
Zabbix Frontend's validate.api.exists action can be exploited by authenticated, adjacent-network users to trigger disproportionate CPU consumption on the webserver, resulting in potential denial of service. All Zabbix versions are indicated as affected per vendor-supplied CPE data (cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*), and the vulnerability is rooted in CWE-405 asymmetric resource amplification. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.1 reflects the constrained blast radius imposed by the authentication and adjacent-network prerequisites.
Zabbix Frontend's popup.testtriggerexpr action can be abused by unauthenticated adjacent-network attackers to cause disproportionate CPU load on the webserver, resulting in potential denial of service for monitoring operations. All Zabbix versions appear affected based on the wildcard CPE string. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.3 reflects moderate, realistic availability risk constrained to adjacent-network attackers with no confidentiality or integrity exposure.
Unauthenticated denial-of-service in Mastodon's admin statistics API allows any remote caller to exhaust server database resources by submitting crafted requests to the measures and retention endpoints before authorization is enforced. Mastodon instances on versions prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 are exposed; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, authentication-free exploitation at network range. No public exploit code or CISA KEV listing has been identified, but the low attack complexity and broad API exposure make unpatched public-facing instances an easy target for service disruption.
Database-resource exhaustion in UBB.threads forum software (confirmed in version 7.7.5) allows an authenticated low-privileged user to deny service to the entire application by issuing concurrent profile-view requests. The flaw, reported by CERT-PL and tracked as CWE-405 (Asymmetric Resource Consumption), produces high availability impact (CVSS 4.0 VA:H, 7.1) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the vulnerability is not on the CISA KEV list.
Denial of service in Envoy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 allows unauthenticated remote clients to trigger excessive memory consumption via crafted HTTP/2 requests, potentially causing OOM termination of the Envoy process. The flaw stems from cookie header bytes bypassing request header size validation combined with HPACK limits being enforced only on encoded bytes. No public exploit identified at time of analysis, but the network-reachable, no-auth attack profile makes it a credible availability threat for edge proxies.
Resource amplification in Text::LineFold (Unicode-LineBreak Perl distribution, versions through 2019.001) causes output to be duplicated proportionally to the number of Unicode special line break characters present in the input string. The fold() method incorrectly passes the entire input string to the break() function on each segment iteration, rather than passing only the current segment, producing amplified output that grows with each VT, FF, or similar line break character encountered. No public exploit has been identified at time of analysis and EPSS sits at the 0th percentile, but any application accepting untrusted input and passing it through fold() is exposed to potential denial of service.
Technitium DNS Server performs amplified outbound DNS traffic when processing domains with missing RRSIG records or mismatched DNSKEY records - an attacker who controls any domain can exploit this behavior to force the resolver into generating excessive network queries against third-party infrastructure. All versions prior to 15.0 are affected per the vendor CPE listing (cpe:2.3:a:technitium:dns_server:*:*:*:*:*:*:*:*). The CVSS Changed Scope (S:C) confirms that impact extends beyond the vulnerable server itself, affecting downstream network resources and other systems. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
OpenClaw before version 2026.3.24 allows unauthenticated remote denial of service via the Feishu webhook handler, which accepts request bodies up to 1MB with a 30-second timeout before verifying the request signature. An attacker can exhaust server connection resources by sending concurrent slow HTTP POST requests, blocking legitimate webhook deliveries and degrading service availability. This is an incomplete remediation of the earlier CVE-2026-32011.
Unauthenticated resource exhaustion in OpenClaw before 2026.3.22 allows remote attackers to cause denial of service by sending large or malicious webhook requests to the voice call handler, which buffers request bodies before validating provider signatures. The vulnerability requires only network access (AV:N, PR:N) and can be exploited with low complexity, making it a practical attack vector for disrupting service availability.
DTLS memory exhaustion in OpenSSL allows unauthenticated remote peers to consume disproportionate server memory during handshake processing. Sending small forged records that claim a future epoch triggers OpenSSL to buffer the entire ~16 KB read buffer rather than just the actual record bytes, yielding an amplification factor of approximately 1,200× per record; up to 100 such records may be queued per connection, exposing roughly 1.7 MB of server memory per association from a negligible volume of transmitted data. No public exploit has been identified at time of analysis and SSVC rates exploitation status as none, but the attack is rated automatable and can be multiplied across many concurrent DTLS connections.
Zabbix Frontend's validate.api.exists action can be exploited by authenticated, adjacent-network users to trigger disproportionate CPU consumption on the webserver, resulting in potential denial of service. All Zabbix versions are indicated as affected per vendor-supplied CPE data (cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*), and the vulnerability is rooted in CWE-405 asymmetric resource amplification. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.1 reflects the constrained blast radius imposed by the authentication and adjacent-network prerequisites.
Zabbix Frontend's popup.testtriggerexpr action can be abused by unauthenticated adjacent-network attackers to cause disproportionate CPU load on the webserver, resulting in potential denial of service for monitoring operations. All Zabbix versions appear affected based on the wildcard CPE string. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.3 reflects moderate, realistic availability risk constrained to adjacent-network attackers with no confidentiality or integrity exposure.
Unauthenticated denial-of-service in Mastodon's admin statistics API allows any remote caller to exhaust server database resources by submitting crafted requests to the measures and retention endpoints before authorization is enforced. Mastodon instances on versions prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 are exposed; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, authentication-free exploitation at network range. No public exploit code or CISA KEV listing has been identified, but the low attack complexity and broad API exposure make unpatched public-facing instances an easy target for service disruption.
Database-resource exhaustion in UBB.threads forum software (confirmed in version 7.7.5) allows an authenticated low-privileged user to deny service to the entire application by issuing concurrent profile-view requests. The flaw, reported by CERT-PL and tracked as CWE-405 (Asymmetric Resource Consumption), produces high availability impact (CVSS 4.0 VA:H, 7.1) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the vulnerability is not on the CISA KEV list.
Denial of service in Envoy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 allows unauthenticated remote clients to trigger excessive memory consumption via crafted HTTP/2 requests, potentially causing OOM termination of the Envoy process. The flaw stems from cookie header bytes bypassing request header size validation combined with HPACK limits being enforced only on encoded bytes. No public exploit identified at time of analysis, but the network-reachable, no-auth attack profile makes it a credible availability threat for edge proxies.
Resource amplification in Text::LineFold (Unicode-LineBreak Perl distribution, versions through 2019.001) causes output to be duplicated proportionally to the number of Unicode special line break characters present in the input string. The fold() method incorrectly passes the entire input string to the break() function on each segment iteration, rather than passing only the current segment, producing amplified output that grows with each VT, FF, or similar line break character encountered. No public exploit has been identified at time of analysis and EPSS sits at the 0th percentile, but any application accepting untrusted input and passing it through fold() is exposed to potential denial of service.
Technitium DNS Server performs amplified outbound DNS traffic when processing domains with missing RRSIG records or mismatched DNSKEY records - an attacker who controls any domain can exploit this behavior to force the resolver into generating excessive network queries against third-party infrastructure. All versions prior to 15.0 are affected per the vendor CPE listing (cpe:2.3:a:technitium:dns_server:*:*:*:*:*:*:*:*). The CVSS Changed Scope (S:C) confirms that impact extends beyond the vulnerable server itself, affecting downstream network resources and other systems. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
OpenClaw before version 2026.3.24 allows unauthenticated remote denial of service via the Feishu webhook handler, which accepts request bodies up to 1MB with a 30-second timeout before verifying the request signature. An attacker can exhaust server connection resources by sending concurrent slow HTTP POST requests, blocking legitimate webhook deliveries and degrading service availability. This is an incomplete remediation of the earlier CVE-2026-32011.
Unauthenticated resource exhaustion in OpenClaw before 2026.3.22 allows remote attackers to cause denial of service by sending large or malicious webhook requests to the voice call handler, which buffers request bodies before validating provider signatures. The vulnerability requires only network access (AV:N, PR:N) and can be exploited with low complexity, making it a practical attack vector for disrupting service availability.