CWE-406
Insufficient Control of Network Message Volume (Network Amplification)
Monthly
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ICMPv6 error generation in Zephyr RTOS 1.14.0 through 4.4.1 omits two of the three RFC 4443 §2.4 suppression rules, letting an attacker on the same IPv6 link turn a single spoofed packet into link-wide traffic reflection. Because an unrecognized next-header packet sent to ff02::1 with a spoofed source causes every node on the link to answer the victim, the flaw acts as a reflector whose amplification factor equals the number of listening nodes; alternatively, a unicast packet with a multicast source address makes the node emit its ICMPv6 error straight to that multicast group, flooding the link. Impact is limited to availability degradation of the shared link and the reflection victim plus source-address obfuscation for the attacker (CVSS 4.7, AV:A/PR:N, scope-changed, availability-only), with no memory-safety or data-exposure consequence; no public exploit identified at time of analysis.
Network amplification in PocketMine-MP before 5.39.2 allows authenticated game clients to trigger server-broadcast consuming animations for all visible players by sending crafted ActorEventPacket messages. Each malicious packet causes the server to invoke ConsumingItemAnimation.broadcastAnimation() for every peer in range, multiplying network load and CPU/memory consumption proportionally to the online player count. A publicly available proof-of-concept exists via the GitHub security advisory; no active exploitation has been confirmed in CISA KEV.
Unbounded echo flow responses in Apache Qpid Broker-J (all versions through 10.0.1) allow an authenticated AMQP 1.0 client to exhaust broker resources and cause denial of service by flooding the broker with unanswered echo flow frames. The root cause is absent rate-limiting on echo flow response logic in the qpid-broker-plugins-amqp-1-0-protocol plugin. No public exploit code or CISA KEV listing has been identified; the vendor has released a fix in version 10.1.0.
Quota bypass in NLnet Labs Unbound 1.22.0 through 1.25.1 allows a remote unauthenticated client to cause the resolver to send more upstream DNS packets per query than the operator-configured 'max-global-quota' limit. A single crafted query for a deeply nested hostname under a DNSSEC-signed parent zone triggers excessive recursive DNSSEC validation traffic, effectively neutralizing a security control designed to suppress upstream amplification. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ICMPv6 error generation in Zephyr RTOS 1.14.0 through 4.4.1 omits two of the three RFC 4443 §2.4 suppression rules, letting an attacker on the same IPv6 link turn a single spoofed packet into link-wide traffic reflection. Because an unrecognized next-header packet sent to ff02::1 with a spoofed source causes every node on the link to answer the victim, the flaw acts as a reflector whose amplification factor equals the number of listening nodes; alternatively, a unicast packet with a multicast source address makes the node emit its ICMPv6 error straight to that multicast group, flooding the link. Impact is limited to availability degradation of the shared link and the reflection victim plus source-address obfuscation for the attacker (CVSS 4.7, AV:A/PR:N, scope-changed, availability-only), with no memory-safety or data-exposure consequence; no public exploit identified at time of analysis.
Network amplification in PocketMine-MP before 5.39.2 allows authenticated game clients to trigger server-broadcast consuming animations for all visible players by sending crafted ActorEventPacket messages. Each malicious packet causes the server to invoke ConsumingItemAnimation.broadcastAnimation() for every peer in range, multiplying network load and CPU/memory consumption proportionally to the online player count. A publicly available proof-of-concept exists via the GitHub security advisory; no active exploitation has been confirmed in CISA KEV.
Unbounded echo flow responses in Apache Qpid Broker-J (all versions through 10.0.1) allow an authenticated AMQP 1.0 client to exhaust broker resources and cause denial of service by flooding the broker with unanswered echo flow frames. The root cause is absent rate-limiting on echo flow response logic in the qpid-broker-plugins-amqp-1-0-protocol plugin. No public exploit code or CISA KEV listing has been identified; the vendor has released a fix in version 10.1.0.
Quota bypass in NLnet Labs Unbound 1.22.0 through 1.25.1 allows a remote unauthenticated client to cause the resolver to send more upstream DNS packets per query than the operator-configured 'max-global-quota' limit. A single crafted query for a deeply nested hostname under a DNSSEC-signed parent zone triggers excessive recursive DNSSEC validation traffic, effectively neutralizing a security control designed to suppress upstream amplification. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.