Monthly
Unauthenticated remote denial of service against Microsoft .NET Framework and the System.Security.Cryptography.Xml library, caused by asymmetric resource consumption (CWE-405) during processing of attacker-supplied XML. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): any service that exposes XML signature parsing/verification to untrusted input, on affected builds of .NET Framework 3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8 below 4.8.4811.0 and 4.8.1 below 4.8.9363.0, or System.Security.Cryptography.Xml below 10.0.13, can be driven into resource exhaustion that degrades or halts the service. No public exploit code has been identified at time of analysis and it is not listed in CISA KEV; SSVC records Exploitation: none with Automatable: yes, indicating a technically reproducible, wormable-class DoS pattern rather than a currently observed campaign. Impact is limited to availability - no confidentiality or integrity loss and no code execution path.
Unauthenticated resource exhaustion and outbound request amplification in Misskey's fetch-rss API affect versions 12.112.1 through releases prior to 2026.7.0. Any remote attacker can repeatedly call the publicly reachable endpoint, which in affected versions had no rate limiting, no response-size cap, and no concurrency bound, forcing the instance to open unbounded outbound HTTP connections and perform synchronous XML parsing; this drains instance CPU, memory, and socket resources, can be used as an amplification vector against third-party servers, and can probe network-reachable services even when federation is disabled. CVSS 4.0 scores the flaw 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N, high availability impact with limited scope change), no public exploit code or CISA KEV entry was identified at time of analysis, and the issue is fully remediated by upgrading to 2026.7.0.
Memory exhaustion in Go's standard-library net/http HTTP/2 server lets a remote attacker send a single crafted request whose "Trailer" header declares an excessive number of fields, causing the server to allocate a disproportionately large Request.Trailer map for the handler. The issue is availability-only (C:N/I:N/A:H), requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and crucially bypasses the Server.MaxHeaderValueCount and Server.MaxHeaderBytes defenses; HTTP/1 servers are not affected because they do not multiplex many requests over one connection and account for MaxHeaderBytes differently. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.23% (12th percentile), and vendor patches are available, so this is a genuine but moderate-priority availability bug rather than an emergency.
Denial of service through CPU exhaustion in Go's HTTP/2 implementation (net/http and golang.org/x/net) lets an unauthenticated remote HTTP/2 peer open many streams and then repeatedly send small SETTINGS frames carrying SETTINGS_INITIAL_WINDOW_SIZE, forcing the victim to recompute per-stream flow-control window state at O(number of streams) for each frame (assessed CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no confidentiality or integrity loss - and exposure is limited to Go programs with HTTP/2 active: servers over TLS (the Go default) and Go HTTP/2 clients connecting to an attacker-controlled peer, in versions predating the O(1) initial-window-size fix tracked in Go issue 81742. No public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); HTTP/1-only deployments are unaffected.
Remote memory exhaustion in the Go standard library's crypto/tls package lets a client that sends a crafted ClientHello containing multiple ECH outer extension references - a construction prohibited by RFC 9849 - force disproportionate memory allocation in TLS servers with Encrypted Client Hello enabled. Only Go releases before 1.27.2 and before 1.26.9 are affected, and the flaw is fixed in those two releases; no public exploit code exists and there is no CISA KEV listing at time of analysis. The practical attack surface is narrow because ECH is opt-in and not active in a default Go TLS server configuration, but where enabled the attacker needs no authentication or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5).
Unauthenticated remote attackers can drive IBM DataPower Gateway into resource exhaustion and denial of service by sending crafted GraphQL queries that abuse improper memoization of fragment spreads. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, and per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector no authentication or user interaction is required once a reachable GraphQL-processing endpoint exists. Impact is confined to availability (no confidentiality or integrity loss), and there is no public exploit identified at time of analysis; exposure depends entirely on whether the gateway has been configured to accept and process GraphQL requests.
Resource exhaustion in Apache Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 allows an unauthenticated remote attacker to amplify a small request into a far larger response, consuming server CPU and outbound network capacity. The issue is conditional: the target application must bind a request parameter to a java.math.BigDecimal property and then render that property through the Struts tag library; applications missing either behavior are not affected per the advisory and independent assessment. No public exploit has been identified at time of analysis, EPSS is low at 0.28% (19th percentile), and the impact is availability-only (CVSS 7.5 with C:N/I:N/A:H).
Unauthenticated denial of service in Zebra (Zcash Foundation's full node implementation) before 6.0.0 allows remote peers to stall Tokio worker threads by submitting non-standard, high-sigop P2SH mempool transactions that reach synchronous FFI script verification before standardness checks, saturating the verifier buffer and rendering the node unresponsive. The vulnerability requires no authentication, user interaction, or non-default configuration; only reachable nodes running affected versions are impacted, and impact is limited to availability. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.
Zcash Foundation's Zebra full node (zebrad) before 6.2.1 can be stalled in block verification by any unauthenticated peer on the P2P network: an attacker pushes zero-fee V6 mempool transactions containing invalid, zero-filled Orchard and Ironwood Halo2 proofs, which drain the shared, unprioritized proof-verification queue and cause the node to fall behind the chain tip. Impact is confined to availability (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - there is no confidentiality or integrity loss - and exploitation requires only that the node accepts untrusted inbound peers and relays mempool transactions, i.e. its normal operating mode. No public exploit code was identified at time of analysis and the CVE is not confirmed actively exploited; the issue is a resource-amplification/denial-of-service class (CWE-405) rather than data compromise.
CPU exhaustion in Apache Directory LDAP API versions 2.1.0 through 2.1.8 allows an attacker who can cause a password to be stored as a bcrypt hash with an attacker-chosen high cost factor (for example 30) to force the LDAP server to burn hours of CPU time on a single credential verification, producing a denial of service (CWE-405, Asymmetric Resource Consumption). Because the expensive hash must first be stored, the effective precondition is write access to the credential or an operator action rather than a purely default-configuration remote trigger, which keeps the assessed vector authenticated (PR:L) despite the vendor's PR:N framing; availability is the only impacted property, with no data exposure. No public exploit code has been identified at time of analysis and EPSS is low at 0.20 percent (9th percentile), so the issue is a moderate, not urgent, priority; the fix is the vendor-released 2.1.9.
Unauthenticated remote denial of service against Microsoft .NET Framework and the System.Security.Cryptography.Xml library, caused by asymmetric resource consumption (CWE-405) during processing of attacker-supplied XML. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): any service that exposes XML signature parsing/verification to untrusted input, on affected builds of .NET Framework 3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8 below 4.8.4811.0 and 4.8.1 below 4.8.9363.0, or System.Security.Cryptography.Xml below 10.0.13, can be driven into resource exhaustion that degrades or halts the service. No public exploit code has been identified at time of analysis and it is not listed in CISA KEV; SSVC records Exploitation: none with Automatable: yes, indicating a technically reproducible, wormable-class DoS pattern rather than a currently observed campaign. Impact is limited to availability - no confidentiality or integrity loss and no code execution path.
Unauthenticated resource exhaustion and outbound request amplification in Misskey's fetch-rss API affect versions 12.112.1 through releases prior to 2026.7.0. Any remote attacker can repeatedly call the publicly reachable endpoint, which in affected versions had no rate limiting, no response-size cap, and no concurrency bound, forcing the instance to open unbounded outbound HTTP connections and perform synchronous XML parsing; this drains instance CPU, memory, and socket resources, can be used as an amplification vector against third-party servers, and can probe network-reachable services even when federation is disabled. CVSS 4.0 scores the flaw 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N, high availability impact with limited scope change), no public exploit code or CISA KEV entry was identified at time of analysis, and the issue is fully remediated by upgrading to 2026.7.0.
Memory exhaustion in Go's standard-library net/http HTTP/2 server lets a remote attacker send a single crafted request whose "Trailer" header declares an excessive number of fields, causing the server to allocate a disproportionately large Request.Trailer map for the handler. The issue is availability-only (C:N/I:N/A:H), requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and crucially bypasses the Server.MaxHeaderValueCount and Server.MaxHeaderBytes defenses; HTTP/1 servers are not affected because they do not multiplex many requests over one connection and account for MaxHeaderBytes differently. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.23% (12th percentile), and vendor patches are available, so this is a genuine but moderate-priority availability bug rather than an emergency.
Denial of service through CPU exhaustion in Go's HTTP/2 implementation (net/http and golang.org/x/net) lets an unauthenticated remote HTTP/2 peer open many streams and then repeatedly send small SETTINGS frames carrying SETTINGS_INITIAL_WINDOW_SIZE, forcing the victim to recompute per-stream flow-control window state at O(number of streams) for each frame (assessed CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no confidentiality or integrity loss - and exposure is limited to Go programs with HTTP/2 active: servers over TLS (the Go default) and Go HTTP/2 clients connecting to an attacker-controlled peer, in versions predating the O(1) initial-window-size fix tracked in Go issue 81742. No public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); HTTP/1-only deployments are unaffected.
Remote memory exhaustion in the Go standard library's crypto/tls package lets a client that sends a crafted ClientHello containing multiple ECH outer extension references - a construction prohibited by RFC 9849 - force disproportionate memory allocation in TLS servers with Encrypted Client Hello enabled. Only Go releases before 1.27.2 and before 1.26.9 are affected, and the flaw is fixed in those two releases; no public exploit code exists and there is no CISA KEV listing at time of analysis. The practical attack surface is narrow because ECH is opt-in and not active in a default Go TLS server configuration, but where enabled the attacker needs no authentication or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5).
Unauthenticated remote attackers can drive IBM DataPower Gateway into resource exhaustion and denial of service by sending crafted GraphQL queries that abuse improper memoization of fragment spreads. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, and per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector no authentication or user interaction is required once a reachable GraphQL-processing endpoint exists. Impact is confined to availability (no confidentiality or integrity loss), and there is no public exploit identified at time of analysis; exposure depends entirely on whether the gateway has been configured to accept and process GraphQL requests.
Resource exhaustion in Apache Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 allows an unauthenticated remote attacker to amplify a small request into a far larger response, consuming server CPU and outbound network capacity. The issue is conditional: the target application must bind a request parameter to a java.math.BigDecimal property and then render that property through the Struts tag library; applications missing either behavior are not affected per the advisory and independent assessment. No public exploit has been identified at time of analysis, EPSS is low at 0.28% (19th percentile), and the impact is availability-only (CVSS 7.5 with C:N/I:N/A:H).
Unauthenticated denial of service in Zebra (Zcash Foundation's full node implementation) before 6.0.0 allows remote peers to stall Tokio worker threads by submitting non-standard, high-sigop P2SH mempool transactions that reach synchronous FFI script verification before standardness checks, saturating the verifier buffer and rendering the node unresponsive. The vulnerability requires no authentication, user interaction, or non-default configuration; only reachable nodes running affected versions are impacted, and impact is limited to availability. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.
Zcash Foundation's Zebra full node (zebrad) before 6.2.1 can be stalled in block verification by any unauthenticated peer on the P2P network: an attacker pushes zero-fee V6 mempool transactions containing invalid, zero-filled Orchard and Ironwood Halo2 proofs, which drain the shared, unprioritized proof-verification queue and cause the node to fall behind the chain tip. Impact is confined to availability (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - there is no confidentiality or integrity loss - and exploitation requires only that the node accepts untrusted inbound peers and relays mempool transactions, i.e. its normal operating mode. No public exploit code was identified at time of analysis and the CVE is not confirmed actively exploited; the issue is a resource-amplification/denial-of-service class (CWE-405) rather than data compromise.
CPU exhaustion in Apache Directory LDAP API versions 2.1.0 through 2.1.8 allows an attacker who can cause a password to be stored as a bcrypt hash with an attacker-chosen high cost factor (for example 30) to force the LDAP server to burn hours of CPU time on a single credential verification, producing a denial of service (CWE-405, Asymmetric Resource Consumption). Because the expensive hash must first be stored, the effective precondition is write access to the credential or an operator action rather than a purely default-configuration remote trigger, which keeps the assessed vector authenticated (PR:L) despite the vendor's PR:N framing; availability is the only impacted property, with no data exposure. No public exploit code has been identified at time of analysis and EPSS is low at 0.20 percent (9th percentile), so the issue is a moderate, not urgent, priority; the fix is the vendor-released 2.1.9.