Monthly
Bluetooth Object Transfer Service (OTS) servers in Zephyr (>= 3.3.0 through <= 4.4.2) mishandle failed Calculate Checksum responses: oacp_ind_send() appends a four-byte Checksum Value field based only on the requested op code, then calls net_buf_simple_pull_le32() on a zero-length stack buffer whenever validation failed. Any peer within radio range can abuse this with a nine-byte OACP write and no pairing, encryption or authentication, because the OACP characteristic and its CCC are exposed with unauthenticated write permissions. On CONFIG_ASSERT builds the zero-length pull trips the assertion in net_buf_simple_pull_mem() and panics the device (remote DoS); with assertions compiled out the same path copies four bytes of uninitialized stack memory into the indication sent to the peer, repeatable per request and bounded to four bytes with no memory corruption; the reporter's reproducer demonstrates the panic and no public exploit tooling beyond it is confirmed.
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and collaboration signaling services, allowing remote attackers to cause a denial-of-service condition without authentication or user interaction (CVSS 7.5). The vendor advisory describes multiple internally discovered CWE-617 reachable-assertion issues fixed in hardening releases; the exact affected and fixed versions are not specified in the provided data. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Denial of service in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote unauthenticated attacker to terminate the daemon by sending an NTS request that contains an excessive number of NTS Cookie Placeholder extension fields. The flaw is only reachable when Network Time Security is enabled and the daemon is accepting NTS requests; deployments without NTS configured are not exposed. No CISA KEV entry was identified, and no public exploit was identified at time of analysis; the assessed impact is availability-only with no confidentiality or integrity effect.
Remote unauthenticated denial of service in BIND 9 recursive resolvers can be triggered by a crafted query sequence when at least two RPZ zones are configured with conflicting recursive-only settings. The issue affects BIND 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and corresponding -S1 subscription releases, causing an assertion failure and server exit when an RD=1 query is followed by an RD=0 query. ISC advisories reference fixed releases 9.20.30 and 9.21.27; no public exploit code or CISA KEV entry was identified at time of analysis, and exposure is limited to recursive servers with the uncommon mixed-RPZ configuration.
Remote unauthenticated denial of service in Apache bRPC's HPACK decoder can abort the server process when a peer sends a crafted HTTP/2 header block. bRPC through 1.17.0 is affected because the default 4096-byte HPACK dynamic table allocates about 120 ring-buffer slots while eviction is tracked by bytes, allowing 121 minimal 33-byte entries to fill the queue and trip a CHECK assertion on the next AddHeader. The h2 parser is enabled by default and runs before authentication, so any exposed HTTP/2 or gRPC listener is at risk; no public exploit code was identified at time of analysis, and 1.18.0 fixes the issue.
Remote unauthenticated attackers can crash Apache bRPC 1.17.0 and earlier servers that expose HTTP/2, h2, or gRPC endpoints by sending a crafted HPACK header block that exhausts the dynamic-table ring buffer and triggers an assertion abort. The issue is reachable during HPACK decoding before any Authenticator check, and the assessed CVSS 3.1 score is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit was identified at time of analysis; the vendor released bRPC 1.18.0 and an upstream patch in PR #3462.
Denial of service in Apache bRPC through 1.17.0 lets a remote attacker abort the server process by sending a single crafted HTTP/2 header block that overruns the HPACK decoder's dynamic-table slot accounting. Because the h2 parser runs on the shared listening port before any Authenticator check, no credentials are needed whenever an h2/gRPC-enabled port is reachable from an untrusted network; 121 minimal 33-byte entries fit inside the 4096-byte byte budget but exceed the 120 available ring-buffer slots, tripping CHECK(!_header_queue.full()) and terminating the process. Impact is availability-only (no disclosure or modification), the condition is removed in bRPC 1.18.0, and no public exploit identified at time of analysis.
The Advantech ADAM-3600 industrial RTU/edge controller can be crashed by a remotely delivered crafted message that triggers an assertion fault, causing a denial of service limited to availability. No authentication or user interaction is required (PR:N/UI:N), but exploitation depends on network reachability to the affected service and on a specific precondition (AT:P) for the fault to fire. No public exploit code or CISA KEV entry was identified at time of analysis.
Adjacent attackers can crash the Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted LDP packet into an already-established LDP session, causing a denial of service on the affected router. Only devices running MPLS with LDP enabled and an active LDP peering session are exposed, and the attacker must already hold a position on the adjacent network capable of injecting packets into that session (CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact; vendor CVSS 4.0 base 7.1). There is no confidentiality or integrity impact - the outcome is loss of rpd availability, though repeated crashes can degrade routing stability; no public exploit has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Denial of service in NASA's F´ (F Prime) framework prior to 4.2.0 allows remote attackers to abort or reset the flight software process by delivering a file-uplink packet whose file-packet type byte falls outside the valid Type enum, driving Fw::FilePacket deserialization into an unvalidated FW_ASSERT (CWE-617). The impact is availability-only, matching the assessed CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss, and the practical limiting factor is reachability: the malicious packet must traverse the Svc::FileUplink file-packet path, which in spaceflight deployments is the ground-to-vehicle uplink. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in F Prime 4.2.0.
Bluetooth Object Transfer Service (OTS) servers in Zephyr (>= 3.3.0 through <= 4.4.2) mishandle failed Calculate Checksum responses: oacp_ind_send() appends a four-byte Checksum Value field based only on the requested op code, then calls net_buf_simple_pull_le32() on a zero-length stack buffer whenever validation failed. Any peer within radio range can abuse this with a nine-byte OACP write and no pairing, encryption or authentication, because the OACP characteristic and its CCC are exposed with unauthenticated write permissions. On CONFIG_ASSERT builds the zero-length pull trips the assertion in net_buf_simple_pull_mem() and panics the device (remote DoS); with assertions compiled out the same path copies four bytes of uninitialized stack memory into the indication sent to the peer, repeatable per request and bounded to four bytes with no memory corruption; the reporter's reproducer demonstrates the panic and no public exploit tooling beyond it is confirmed.
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and collaboration signaling services, allowing remote attackers to cause a denial-of-service condition without authentication or user interaction (CVSS 7.5). The vendor advisory describes multiple internally discovered CWE-617 reachable-assertion issues fixed in hardening releases; the exact affected and fixed versions are not specified in the provided data. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Denial of service in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote unauthenticated attacker to terminate the daemon by sending an NTS request that contains an excessive number of NTS Cookie Placeholder extension fields. The flaw is only reachable when Network Time Security is enabled and the daemon is accepting NTS requests; deployments without NTS configured are not exposed. No CISA KEV entry was identified, and no public exploit was identified at time of analysis; the assessed impact is availability-only with no confidentiality or integrity effect.
Remote unauthenticated denial of service in BIND 9 recursive resolvers can be triggered by a crafted query sequence when at least two RPZ zones are configured with conflicting recursive-only settings. The issue affects BIND 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and corresponding -S1 subscription releases, causing an assertion failure and server exit when an RD=1 query is followed by an RD=0 query. ISC advisories reference fixed releases 9.20.30 and 9.21.27; no public exploit code or CISA KEV entry was identified at time of analysis, and exposure is limited to recursive servers with the uncommon mixed-RPZ configuration.
Remote unauthenticated denial of service in Apache bRPC's HPACK decoder can abort the server process when a peer sends a crafted HTTP/2 header block. bRPC through 1.17.0 is affected because the default 4096-byte HPACK dynamic table allocates about 120 ring-buffer slots while eviction is tracked by bytes, allowing 121 minimal 33-byte entries to fill the queue and trip a CHECK assertion on the next AddHeader. The h2 parser is enabled by default and runs before authentication, so any exposed HTTP/2 or gRPC listener is at risk; no public exploit code was identified at time of analysis, and 1.18.0 fixes the issue.
Remote unauthenticated attackers can crash Apache bRPC 1.17.0 and earlier servers that expose HTTP/2, h2, or gRPC endpoints by sending a crafted HPACK header block that exhausts the dynamic-table ring buffer and triggers an assertion abort. The issue is reachable during HPACK decoding before any Authenticator check, and the assessed CVSS 3.1 score is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit was identified at time of analysis; the vendor released bRPC 1.18.0 and an upstream patch in PR #3462.
Denial of service in Apache bRPC through 1.17.0 lets a remote attacker abort the server process by sending a single crafted HTTP/2 header block that overruns the HPACK decoder's dynamic-table slot accounting. Because the h2 parser runs on the shared listening port before any Authenticator check, no credentials are needed whenever an h2/gRPC-enabled port is reachable from an untrusted network; 121 minimal 33-byte entries fit inside the 4096-byte byte budget but exceed the 120 available ring-buffer slots, tripping CHECK(!_header_queue.full()) and terminating the process. Impact is availability-only (no disclosure or modification), the condition is removed in bRPC 1.18.0, and no public exploit identified at time of analysis.
The Advantech ADAM-3600 industrial RTU/edge controller can be crashed by a remotely delivered crafted message that triggers an assertion fault, causing a denial of service limited to availability. No authentication or user interaction is required (PR:N/UI:N), but exploitation depends on network reachability to the affected service and on a specific precondition (AT:P) for the fault to fire. No public exploit code or CISA KEV entry was identified at time of analysis.
Adjacent attackers can crash the Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted LDP packet into an already-established LDP session, causing a denial of service on the affected router. Only devices running MPLS with LDP enabled and an active LDP peering session are exposed, and the attacker must already hold a position on the adjacent network capable of injecting packets into that session (CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact; vendor CVSS 4.0 base 7.1). There is no confidentiality or integrity impact - the outcome is loss of rpd availability, though repeated crashes can degrade routing stability; no public exploit has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Denial of service in NASA's F´ (F Prime) framework prior to 4.2.0 allows remote attackers to abort or reset the flight software process by delivering a file-uplink packet whose file-packet type byte falls outside the valid Type enum, driving Fw::FilePacket deserialization into an unvalidated FW_ASSERT (CWE-617). The impact is availability-only, matching the assessed CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss, and the practical limiting factor is reachability: the malicious packet must traverse the Svc::FileUplink file-packet path, which in spaceflight deployments is the ground-to-vehicle uplink. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in F Prime 4.2.0.