Monthly
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be crashed by a remote, unauthenticated attacker through a null pointer dereference (CWE-476) while proxying chunked origin responses. The race requires a client POST request to be torn down via TCP half-close at the moment ATS reparses a chunked origin response from a reentrant write-ready callback, so it is timing-dependent and typically needs repeated attempts; impact is limited to denial of service (crash), with no code execution, data disclosure, or integrity loss. No public exploit was identified at time of analysis, and vendor-released fixed versions are 9.2.16, 10.1.5, and 10.2.1.
A stale-state flaw in Zephyr's experimental MCTP-over-I2C+GPIO target binding lets any device that can act as an I2C controller on the shared management bus crash the target with two ordinary transactions, because the selected pseudo-register and data-phase flag are never reset at STOP. The resulting NULL pointer dereference occurs inside the I2C target interrupt handler, so on parts that trap address-0 accesses it produces a fatal exception and device reset or halt; on other parts it degrades to a malformed packet buffer reaching the MCTP stack and silently dropped transmit packets. Only builds with CONFIG_MCTP and CONFIG_MCTP_I2C_GPIO_TARGET=y are exposed, exploitation requires a pre-existing foothold on the same physical bus (compromised peer endpoint or BMC), and no public exploit code was identified at time of analysis; the authoritative assessment scores this as availability-only impact (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the C:L/I:N variant in the published vector.
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering a null pointer dereference (CWE-476). The issue is network-reachable, low complexity, and requires no user interaction, with impact limited to availability; exact affected and fixed releases must be confirmed in Cisco's advisory. No public exploit code was identified at time of analysis, and exposure is greatest for internet-facing or externally reachable Expressway deployments.
Assertion failure and null-pointer abort in ISC BIND 9 recursive resolvers terminate the named process, denying DNS resolution to every downstream client until the service is restarted. Only resolvers configured with BOTH a 'redirect' zone AND 'qname-minimization strict' are affected - a non-default, operator-chosen combination that sharply narrows the realistically exposed population, so despite the 7.5 CVSS base score all qualitative signals point to a low real-world priority. The trigger is unauthenticated and remote (PR:N/AV:N, no user interaction), but no public exploit identified at time of analysis and no active exploitation has been reported; vendor fixes are published as 9.20.30 and 9.21.27.
Apache bRPC through 1.17.0 can be remotely aborted by an unauthenticated attacker who sends a crafted HTTP/2 HEADERS block that exhausts the HPACK dynamic-table ring buffer while staying under the byte-based eviction threshold. The h2 parser is enabled by default on bRPC server ports and processes headers before Authenticator checks, so any exposed h2/gRPC listener is sufficient; the assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit identified at time of analysis, and no KEV listing or EPSS score was present in the supplied data.
Remote unauthenticated denial of service in Apache bRPC through 1.17.0 allows any peer that can reach an HTTP/2 or gRPC (h2) listener to abort the server process with a single crafted HEADERS frame. The HPACK dynamic table's ring buffer is sized by byte capacity rather than slot count, so a peer can insert 121 minimal 33-byte entries (3,993 bytes, still under the default 4,096-byte budget) without triggering eviction and then hit a CHECK(!_header_queue.full()) assertion that terminates the process. The h2 parser is enabled by default on every bRPC server port and decodes headers before any Authenticator check, so no credentials, user interaction, or non-default configuration are required; no public exploit code was identified at time of analysis, but a vendor fix exists and the flaw was addressed together with a large batch of other HTTP/2 parsing issues in bRPC 1.18.0.
Client-side denial of service in FreeRDP 3.0.0 through 3.31.x occurs when the smartcard emulation backend processes a server-supplied SCardGetStatusChange reader-state entry with a null szReader name, causing a null-pointer dereference in strcmp/_wcscmp that crashes the RDP client process. Exploitation is server-to-client: an attacker-controlled or compromised RDP server can trigger the crash against a victim who connects using a FreeRDP client with the smartcard channel/emulation enabled, requiring the user to initiate or accept the session. Impact is limited to availability (client crash) with no code execution or data disclosure, and no public exploit has been identified at time of analysis.
Unauthenticated remote attackers can crash the logs management service on Advantech ADAM-3600 industrial RTUs/controllers by sending crafted input that triggers a NULL pointer dereference, denying access to that service until it is restarted. The CVSS:3.1 vector indicates network-reachable, low-complexity exploitation with no privileges or user interaction required, but impact is confined to availability - no code execution, data disclosure, or integrity loss is implied by the flaw itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and practical risk is primarily gated by whether the device's logs management interface is exposed beyond a segmented OT/SCADA network.
Denial of service in Pillow 12.0.0 through 12.x lets unauthenticated remote attackers crash a Python process by supplying a crafted IPTC image that reaches Image.merge(), or by calling Image.merge() with an I/F first band backed by image32 storage. The flaw is a null-pointer dereference (CWE-476) with high availability impact but no confidentiality or integrity impact; it is fixed in 13.0.0 and no public exploit was identified at time of analysis.
Denial of service in Pillow prior to 13.0.0 occurs when ImageFilter.RankFilter, MedianFilter, MinFilter, or MaxFilter is applied to a zero-width or zero-height image, triggering a native null pointer dereference during edge expansion and crashing the process. Remote, unauthenticated attackers who can supply or cause creation of such a zero-dimension image to an application that uses these rank filters can cause high availability impact only (C:N/I:N/A:H per the assessed CVSS 3.1 vector; official CVSS 4.0 score 8.2 with AT:P). No public exploit code or confirmed active exploitation is identified at time of analysis, and no EPSS data was provided.
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be crashed by a remote, unauthenticated attacker through a null pointer dereference (CWE-476) while proxying chunked origin responses. The race requires a client POST request to be torn down via TCP half-close at the moment ATS reparses a chunked origin response from a reentrant write-ready callback, so it is timing-dependent and typically needs repeated attempts; impact is limited to denial of service (crash), with no code execution, data disclosure, or integrity loss. No public exploit was identified at time of analysis, and vendor-released fixed versions are 9.2.16, 10.1.5, and 10.2.1.
A stale-state flaw in Zephyr's experimental MCTP-over-I2C+GPIO target binding lets any device that can act as an I2C controller on the shared management bus crash the target with two ordinary transactions, because the selected pseudo-register and data-phase flag are never reset at STOP. The resulting NULL pointer dereference occurs inside the I2C target interrupt handler, so on parts that trap address-0 accesses it produces a fatal exception and device reset or halt; on other parts it degrades to a malformed packet buffer reaching the MCTP stack and silently dropped transmit packets. Only builds with CONFIG_MCTP and CONFIG_MCTP_I2C_GPIO_TARGET=y are exposed, exploitation requires a pre-existing foothold on the same physical bus (compromised peer endpoint or BMC), and no public exploit code was identified at time of analysis; the authoritative assessment scores this as availability-only impact (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the C:L/I:N variant in the published vector.
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering a null pointer dereference (CWE-476). The issue is network-reachable, low complexity, and requires no user interaction, with impact limited to availability; exact affected and fixed releases must be confirmed in Cisco's advisory. No public exploit code was identified at time of analysis, and exposure is greatest for internet-facing or externally reachable Expressway deployments.
Assertion failure and null-pointer abort in ISC BIND 9 recursive resolvers terminate the named process, denying DNS resolution to every downstream client until the service is restarted. Only resolvers configured with BOTH a 'redirect' zone AND 'qname-minimization strict' are affected - a non-default, operator-chosen combination that sharply narrows the realistically exposed population, so despite the 7.5 CVSS base score all qualitative signals point to a low real-world priority. The trigger is unauthenticated and remote (PR:N/AV:N, no user interaction), but no public exploit identified at time of analysis and no active exploitation has been reported; vendor fixes are published as 9.20.30 and 9.21.27.
Apache bRPC through 1.17.0 can be remotely aborted by an unauthenticated attacker who sends a crafted HTTP/2 HEADERS block that exhausts the HPACK dynamic-table ring buffer while staying under the byte-based eviction threshold. The h2 parser is enabled by default on bRPC server ports and processes headers before Authenticator checks, so any exposed h2/gRPC listener is sufficient; the assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit identified at time of analysis, and no KEV listing or EPSS score was present in the supplied data.
Remote unauthenticated denial of service in Apache bRPC through 1.17.0 allows any peer that can reach an HTTP/2 or gRPC (h2) listener to abort the server process with a single crafted HEADERS frame. The HPACK dynamic table's ring buffer is sized by byte capacity rather than slot count, so a peer can insert 121 minimal 33-byte entries (3,993 bytes, still under the default 4,096-byte budget) without triggering eviction and then hit a CHECK(!_header_queue.full()) assertion that terminates the process. The h2 parser is enabled by default on every bRPC server port and decodes headers before any Authenticator check, so no credentials, user interaction, or non-default configuration are required; no public exploit code was identified at time of analysis, but a vendor fix exists and the flaw was addressed together with a large batch of other HTTP/2 parsing issues in bRPC 1.18.0.
Client-side denial of service in FreeRDP 3.0.0 through 3.31.x occurs when the smartcard emulation backend processes a server-supplied SCardGetStatusChange reader-state entry with a null szReader name, causing a null-pointer dereference in strcmp/_wcscmp that crashes the RDP client process. Exploitation is server-to-client: an attacker-controlled or compromised RDP server can trigger the crash against a victim who connects using a FreeRDP client with the smartcard channel/emulation enabled, requiring the user to initiate or accept the session. Impact is limited to availability (client crash) with no code execution or data disclosure, and no public exploit has been identified at time of analysis.
Unauthenticated remote attackers can crash the logs management service on Advantech ADAM-3600 industrial RTUs/controllers by sending crafted input that triggers a NULL pointer dereference, denying access to that service until it is restarted. The CVSS:3.1 vector indicates network-reachable, low-complexity exploitation with no privileges or user interaction required, but impact is confined to availability - no code execution, data disclosure, or integrity loss is implied by the flaw itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and practical risk is primarily gated by whether the device's logs management interface is exposed beyond a segmented OT/SCADA network.
Denial of service in Pillow 12.0.0 through 12.x lets unauthenticated remote attackers crash a Python process by supplying a crafted IPTC image that reaches Image.merge(), or by calling Image.merge() with an I/F first band backed by image32 storage. The flaw is a null-pointer dereference (CWE-476) with high availability impact but no confidentiality or integrity impact; it is fixed in 13.0.0 and no public exploit was identified at time of analysis.
Denial of service in Pillow prior to 13.0.0 occurs when ImageFilter.RankFilter, MedianFilter, MinFilter, or MaxFilter is applied to a zero-width or zero-height image, triggering a native null pointer dereference during edge expansion and crashing the process. Remote, unauthenticated attackers who can supply or cause creation of such a zero-dimension image to an application that uses these rank filters can cause high availability impact only (C:N/I:N/A:H per the assessed CVSS 3.1 vector; official CVSS 4.0 score 8.2 with AT:P). No public exploit code or confirmed active exploitation is identified at time of analysis, and no EPSS data was provided.