Monthly
Remote, unauthenticated attackers can exhaust dcm4chee-arc-light by submitting crafted multipart payloads to its MultipartInputStream parser, which performs inefficient boundary matching and unnecessary buffer copying, driving excessive boundary comparisons and repeated copies that consume CPU and memory until the service slows or becomes unavailable. Every version captured by cpe:2.3:a:j4care:dcm4chee-arc-light:*:*:*:*:*:*:*:* is affected, and the impact is confined to availability (VC:N/VI:N/VA:H) with no confidentiality or integrity effect. No public exploit identified at time of analysis, but exploitation requires only that a multipart-accepting endpoint such as the DICOMweb STOW-RS upload interface be network-reachable to the attacker; the vendor-classified CVSS 4.0 base of 8.7 (High) matches an independent assessment of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Denial of service in Eclipse Vert.x JSON Schema validation (io.vertx:vertx-json-schema) allows a remote unauthenticated attacker to burn disproportionate CPU by sending a single moderately sized JSON array to any endpoint whose active schema uses the uniqueItems keyword. The affected ranges are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and the defect propagates to the dependent modules vertx-web-openapi-router, vertx-web-validation and vertx-openapi. No public exploit code was identified at time of analysis, yet the issue is rated CVSS 4.0 8.7 (HIGH) entirely on availability impact (VA:H with VC:N/VI:N), and applications that do not use uniqueItems in attacker-reachable schemas or that cap request body/array size upstream are not practically exploitable.
Denial of service in Microsoft .NET Framework (versions 3.5 through 4.8.1) and the System.Security.Cryptography.Xml package allows a remote, unauthenticated attacker to exhaust server resources by submitting crafted input to an application that processes it through the vulnerable code path; the assessed vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (C:N/I:N/A:H, CVSS 7.5), meaning no data disclosure and no code execution. The affected-component list points at XML and cryptographic-XML handling - for example XML signature verification or SAML-style document parsing - so internet-facing endpoints that accept such documents are the primary exposure. Microsoft has published a vendor advisory with fixed builds, and no public exploit has been identified at time of analysis (SSVC exploitation: none); CISA KEV does not list this CVE.
Unauthenticated remote attackers can drive CPU exhaustion in .NET applications that validate untrusted signed CMS/PKCS#7 data, because SignedCms.CheckSignature in the System.Security.Cryptography.Pkcs package repeatedly reparses attacker-controlled X.509 content at quadratic cost (CWE-407, CVSS 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact, C:N/I:N/A:H). Affected build ranges are System.Security.Cryptography.Pkcs 8.0.0 through 8.0.1, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1, along with the listed .NET Framework 3.5 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 / 4.8.1 servicing baselines and Visual Studio 2022 17.14 and Visual Studio 2026 18.10. Exploitation is bounded to services that actually accept and cryptographically verify externally supplied signed CMS messages through this API; no public exploit identified at time of analysis, and CISA SSVC records exploitation as none.
Denial of service in Microsoft .NET lets an unauthenticated remote attacker force the runtime into disproportionately expensive computation, driving CPU or memory consumption high enough to degrade or halt a service. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms remote, low-complexity, unauthenticated exploitation with no user interaction and a high availability-only impact, requiring only that the vulnerable .NET code path be reachable by attacker-supplied network input - no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. Exposure is limited to reachable, .NET-based services; internal-only or non-.NET-facing deployments are not affected, and the exact affected runtime versions must be confirmed against the MSRC advisory.
CPU exhaustion during SVG rendering in CairoSVG versions prior to 2.9.1 lets an unauthenticated remote attacker deny service to any application that converts untrusted SVG input. A path element containing a large number of segments drives quadratic (O(n²)) work in cairosvg/path.py, where the tokenizer repeatedly slices and rescans the remaining path data and draw_markers drains node.vertices with pop(0); a payload well under one megabyte is sufficient to consume substantial CPU. The svg2png, svg2pdf, and svg2ps APIs all reach the vulnerable code during ordinary rendering, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H with VC:N/VI:N) confirms this is a pure availability impact requiring no authentication or user interaction; no public exploit code has been identified at time of analysis. Risk is therefore concentrated in services that render user-supplied SVGs, while deployments that only process trusted, developer-authored SVG files are not meaningfully exposed.
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail delivery by sending messages crafted to look like RFC 3464 delivery status notifications or RFC 5965 abuse feedback reports whose returned-headers part begins with a very large number of blank lines. The DSN and ARF readers strip leading blank lines two bytes at a time, copying the remainder of the part on each iteration, so processing cost grows with the square of the blank-line count; a single report-shaped message within the reader's 2 MB limit can occupy a delivery thread for over a minute, and a few such messages per minute can saturate every delivery thread. Exploitation is conditional: the server must have bounce processing or complaint processing enabled, or must manage a mailing list, and the vendor states none of these is enabled by default, so a stock 6.3.4/6.3.5 installation is not exposed. There is no public exploit identified at time of analysis, no CISA KEV listing, and the impact is limited to availability of mail delivery (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no data exposure or code execution; the vendor-released fix is hMailServer 6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail delivery and SMTP service by sending a single crafted message. The root cause is inefficient algorithmic complexity (CWE-407) in inbound DKIM and ARC signature verification: assembling the canonical header and resolving the header names listed in a signature's h= tag grows quadratically with header size, so a message with very many header fields - or one field folded over very many continuation lines - holds a worker thread busy for tens of seconds per signature, and up to ten signatures are evaluated per message by both the DKIM and DMARC tests on the threads that serve delivery and SMTP. CVSS 3.1 rates this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity impact; no confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis, and the vendor has published a fixed release, v6.3.6.
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first instance of each duplicated member name by rescanning the members already read, so an object with N distinct names costs O(N²) - roughly 8.9 seconds for a 1 MB payload and 300 seconds for 4 MB against the affected code. An unauthenticated remote attacker can reach this reader by mailing a crafted TLS-RPT report (compressed, expanding to as much as 16 MB after decompression) to a hosted domain's published report mailbox, where it is parsed on a delivery thread; with only ten delivery threads by default, a few such reports stall all mail delivery, both local and outbound, for over an hour per report. A signed-in webmail user can deliver the same 16 MB body through the webmail's own REST routes, holding the REST API worker threads instead. There is no confirmation of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; note that unauthenticated exploitation is confined to deployments that publish a TLS-RPT report mailbox, because where none is configured the unauthenticated REST sign-in routes that read JSON are capped at 64 KB and are not affected.
Denial of service in the Apache Thrift Perl bindings affects all releases before 0.25.0, allowing unauthenticated remote attackers to exhaust CPU or memory resources on services that deserialize attacker-controlled Thrift messages through the Perl language runtime. Only deployments using the Perl bindings are exposed; services built on the Java, Python, C++, or Go bindings are not affected by this specific flaw, and no public exploit code was identified at time of analysis, nor is there any CISA KEV confirmation of active exploitation. Impact is availability-only (no confidentiality or integrity loss), the vendor-released fix is Apache Thrift 0.25.0, and exploitation depends on the malicious input actually reaching the vulnerable parsing routine (the CVSS 4.0 AT:P / assessed AC:H condition).
Remote, unauthenticated attackers can exhaust dcm4chee-arc-light by submitting crafted multipart payloads to its MultipartInputStream parser, which performs inefficient boundary matching and unnecessary buffer copying, driving excessive boundary comparisons and repeated copies that consume CPU and memory until the service slows or becomes unavailable. Every version captured by cpe:2.3:a:j4care:dcm4chee-arc-light:*:*:*:*:*:*:*:* is affected, and the impact is confined to availability (VC:N/VI:N/VA:H) with no confidentiality or integrity effect. No public exploit identified at time of analysis, but exploitation requires only that a multipart-accepting endpoint such as the DICOMweb STOW-RS upload interface be network-reachable to the attacker; the vendor-classified CVSS 4.0 base of 8.7 (High) matches an independent assessment of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Denial of service in Eclipse Vert.x JSON Schema validation (io.vertx:vertx-json-schema) allows a remote unauthenticated attacker to burn disproportionate CPU by sending a single moderately sized JSON array to any endpoint whose active schema uses the uniqueItems keyword. The affected ranges are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and the defect propagates to the dependent modules vertx-web-openapi-router, vertx-web-validation and vertx-openapi. No public exploit code was identified at time of analysis, yet the issue is rated CVSS 4.0 8.7 (HIGH) entirely on availability impact (VA:H with VC:N/VI:N), and applications that do not use uniqueItems in attacker-reachable schemas or that cap request body/array size upstream are not practically exploitable.
Denial of service in Microsoft .NET Framework (versions 3.5 through 4.8.1) and the System.Security.Cryptography.Xml package allows a remote, unauthenticated attacker to exhaust server resources by submitting crafted input to an application that processes it through the vulnerable code path; the assessed vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (C:N/I:N/A:H, CVSS 7.5), meaning no data disclosure and no code execution. The affected-component list points at XML and cryptographic-XML handling - for example XML signature verification or SAML-style document parsing - so internet-facing endpoints that accept such documents are the primary exposure. Microsoft has published a vendor advisory with fixed builds, and no public exploit has been identified at time of analysis (SSVC exploitation: none); CISA KEV does not list this CVE.
Unauthenticated remote attackers can drive CPU exhaustion in .NET applications that validate untrusted signed CMS/PKCS#7 data, because SignedCms.CheckSignature in the System.Security.Cryptography.Pkcs package repeatedly reparses attacker-controlled X.509 content at quadratic cost (CWE-407, CVSS 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact, C:N/I:N/A:H). Affected build ranges are System.Security.Cryptography.Pkcs 8.0.0 through 8.0.1, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1, along with the listed .NET Framework 3.5 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 / 4.8.1 servicing baselines and Visual Studio 2022 17.14 and Visual Studio 2026 18.10. Exploitation is bounded to services that actually accept and cryptographically verify externally supplied signed CMS messages through this API; no public exploit identified at time of analysis, and CISA SSVC records exploitation as none.
Denial of service in Microsoft .NET lets an unauthenticated remote attacker force the runtime into disproportionately expensive computation, driving CPU or memory consumption high enough to degrade or halt a service. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms remote, low-complexity, unauthenticated exploitation with no user interaction and a high availability-only impact, requiring only that the vulnerable .NET code path be reachable by attacker-supplied network input - no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. Exposure is limited to reachable, .NET-based services; internal-only or non-.NET-facing deployments are not affected, and the exact affected runtime versions must be confirmed against the MSRC advisory.
CPU exhaustion during SVG rendering in CairoSVG versions prior to 2.9.1 lets an unauthenticated remote attacker deny service to any application that converts untrusted SVG input. A path element containing a large number of segments drives quadratic (O(n²)) work in cairosvg/path.py, where the tokenizer repeatedly slices and rescans the remaining path data and draw_markers drains node.vertices with pop(0); a payload well under one megabyte is sufficient to consume substantial CPU. The svg2png, svg2pdf, and svg2ps APIs all reach the vulnerable code during ordinary rendering, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H with VC:N/VI:N) confirms this is a pure availability impact requiring no authentication or user interaction; no public exploit code has been identified at time of analysis. Risk is therefore concentrated in services that render user-supplied SVGs, while deployments that only process trusted, developer-authored SVG files are not meaningfully exposed.
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail delivery by sending messages crafted to look like RFC 3464 delivery status notifications or RFC 5965 abuse feedback reports whose returned-headers part begins with a very large number of blank lines. The DSN and ARF readers strip leading blank lines two bytes at a time, copying the remainder of the part on each iteration, so processing cost grows with the square of the blank-line count; a single report-shaped message within the reader's 2 MB limit can occupy a delivery thread for over a minute, and a few such messages per minute can saturate every delivery thread. Exploitation is conditional: the server must have bounce processing or complaint processing enabled, or must manage a mailing list, and the vendor states none of these is enabled by default, so a stock 6.3.4/6.3.5 installation is not exposed. There is no public exploit identified at time of analysis, no CISA KEV listing, and the impact is limited to availability of mail delivery (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no data exposure or code execution; the vendor-released fix is hMailServer 6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail delivery and SMTP service by sending a single crafted message. The root cause is inefficient algorithmic complexity (CWE-407) in inbound DKIM and ARC signature verification: assembling the canonical header and resolving the header names listed in a signature's h= tag grows quadratically with header size, so a message with very many header fields - or one field folded over very many continuation lines - holds a worker thread busy for tens of seconds per signature, and up to ten signatures are evaluated per message by both the DKIM and DMARC tests on the threads that serve delivery and SMTP. CVSS 3.1 rates this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity impact; no confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis, and the vendor has published a fixed release, v6.3.6.
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first instance of each duplicated member name by rescanning the members already read, so an object with N distinct names costs O(N²) - roughly 8.9 seconds for a 1 MB payload and 300 seconds for 4 MB against the affected code. An unauthenticated remote attacker can reach this reader by mailing a crafted TLS-RPT report (compressed, expanding to as much as 16 MB after decompression) to a hosted domain's published report mailbox, where it is parsed on a delivery thread; with only ten delivery threads by default, a few such reports stall all mail delivery, both local and outbound, for over an hour per report. A signed-in webmail user can deliver the same 16 MB body through the webmail's own REST routes, holding the REST API worker threads instead. There is no confirmation of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; note that unauthenticated exploitation is confined to deployments that publish a TLS-RPT report mailbox, because where none is configured the unauthenticated REST sign-in routes that read JSON are capped at 64 KB and are not affected.
Denial of service in the Apache Thrift Perl bindings affects all releases before 0.25.0, allowing unauthenticated remote attackers to exhaust CPU or memory resources on services that deserialize attacker-controlled Thrift messages through the Perl language runtime. Only deployments using the Perl bindings are exposed; services built on the Java, Python, C++, or Go bindings are not affected by this specific flaw, and no public exploit code was identified at time of analysis, nor is there any CISA KEV confirmation of active exploitation. Impact is availability-only (no confidentiality or integrity loss), the vendor-released fix is Apache Thrift 0.25.0, and exploitation depends on the malicious input actually reaching the vulnerable parsing routine (the CVSS 4.0 AT:P / assessed AC:H condition).