Monthly
Denial of service in ASP.NET Core's Kestrel web server allows an unauthenticated remote attacker to deadlock connection handling by sending crafted HTTP/3 reset or abort sequences, causing excessive blocked-thread creation and eventual server resource exhaustion. The flaw affects applications built on Microsoft.AspNetCore.App.Runtime 8.0.x before 8.0.32, 9.0.x before 9.0.21, and 10.0.x before 10.0.13 on Windows, Linux, and macOS, but only when Kestrel is running with HTTP/3 support enabled - servers limited to HTTP/1.1 or HTTP/2 are not exposed. Publicly available exploit code exists (a public gist demonstrates the issue), and the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact with no confidentiality or integrity loss; there is no confirmed active exploitation at time of analysis.
Unauthenticated remote attackers can force a deadlock in the Windows Routing and Remote Access Service (RRAS), causing a denial of service against the service itself (CVSS 3.1 base 7.5 HIGH; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack is remote, low-complexity, requires no credentials and no user interaction, but the practical blast radius is bounded by the deployment prerequisite: the RRAS role must be installed, enabled, and network-reachable, and RRAS is not enabled by default on standard Windows installations. Impact is limited to availability - there is no confidentiality or integrity effect, so the host is not compromised beyond the loss of routing/VPN/remote-access functionality. No public exploit code has been identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV).
Deadlock in the Linux kernel IP defragmentation subsystem occurs when processing fragmented encapsulated (tunneled) traffic, allowing a remote attacker to trigger a kernel locking deadlock by sending specially crafted fragmented tunnel packets. Any Linux system with active tunnel interfaces (GRE, IPIP, VXLAN, or similar encapsulation) and IP defragmentation enabled is potentially affected. The result is a denial-of-service condition causing the affected network path or system to hang, with no confidentiality or integrity impact identified. No public exploit or active exploitation has been identified at time of analysis.
Resource exhaustion in boringproxy through 0.10.0 allows any authenticated user to permanently consume server file descriptors, goroutines, and memory by repeatedly requesting the GET /loading endpoint with arbitrary id parameter values. The handler blindly attempts to receive from a nil channel - a Go-language primitive that blocks forever - with no map-lookup validity check, no HTTP server timeouts, no context cancellation, and no runtime reclamation, meaning each malicious request permanently holds one goroutine (~50 kB stack), one file descriptor, and associated heap memory. Once the server's file descriptor limit is exhausted, all listener Accept calls fail and tunnel traffic forwarding halts for every connected user. A public proof-of-concept writeup exists on GitHub; no CISA KEV listing has been identified at time of analysis.
Authenticated denial of service in Microsoft UFO prior to 3.0.9: a caller holding a valid API key can indefinitely block the /api/task_result/{task_name} endpoint by requesting a task name that maps to an existing session, causing the server to re-acquire the same non-reentrant lock twice (CWE-833 deadlock). In the vendor's default single-process configuration the hung request stalls the event-loop thread, taking down other HTTP endpoints, WebSocket connections, and dependent background interactions, while unknown or unmapped task names never reach the nested call and are harmless. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rates this purely as an availability impact requiring low privileges; no confirmed active exploitation and no public exploit code were identified at time of analysis, and multi-process or multi-worker deployments limit the blast radius to the affected worker.
Authenticated users of Rapid7 Velociraptor can trigger a server-side deadlock in the platform's user-management module, hanging server operations and causing a denial of service (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only a valid low-privileged account that can reach the user-management code path over the network - no user interaction, no elevated role, and no special configuration - but it offers no data read, modification, or code execution, so it cannot be used for initial access or lateral escalation. Impact is availability-only (CWE-833, lock management bug); no public exploit identified at time of analysis, no CISA KEV listing, and the vendor advisory is the authoritative source for version-specific guidance.
USB CDC-NCM network driver in Zephyr RTOS through v4.4.0 permanently deadlocks the shared network egress thread when a USB bus suspend coincides with outbound device traffic, requiring a reboot to recover. The defect in `cdc_ncm_send()` ignores the return value of `usbd_ep_enqueue()` and unconditionally blocks on a completion semaphore that only the (never-fired) bulk-IN ISR can signal - halting not just CDC-NCM traffic but all egress on other interfaces sharing the TX thread. No public exploit code or active exploitation has been identified; the trigger is routine USB host power management, making this an availability risk for any embedded Zephyr device using USB virtual Ethernet.
Kernel availability loss in Ubuntu Linux 6.8, 6.17, and 7.0 can be triggered by any unprivileged local user via a defect in Ubuntu-specific AppArmor SAUCE patches, where notification handling code incorrectly sleeps while holding a spinlock. Violating this kernel locking invariant results in kernel panic or deadlock, causing a full system crash or hang. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low-complexity, low-privilege trigger conditions make it a realistic denial-of-service risk on any multi-user Ubuntu system running the affected kernel versions.
Ella Core's AMF control plane deadlocks in the SCTP notification handler when processing malformed or stale radio entries, allowing unauthenticated attackers with N2 interface access to hang the entire Access and Mobility Function until manual process restart, completely denying service to all subscribers. The vulnerability (CVSS 6.5, CWE-833 deadlock) stems from improper synchronization in radio cleanup logic combined with stale-entry scanning, and patches are available in version 1.7.0 and later.
Scanning TCP port 80 crashes the embedded webserver on Softing smartLink HW-PN 1.02 through 1.03 and smartLink HW-DP 1.31, causing a remote unauthenticated denial of service. The CVSS 4.0 vector confirms network reachability with no privileges or user interaction, but impact is limited to availability; confidentiality and integrity are not affected. No public exploit was identified at time of analysis, and EPSS is low at 0.26% (17th percentile).
Denial of service in ASP.NET Core's Kestrel web server allows an unauthenticated remote attacker to deadlock connection handling by sending crafted HTTP/3 reset or abort sequences, causing excessive blocked-thread creation and eventual server resource exhaustion. The flaw affects applications built on Microsoft.AspNetCore.App.Runtime 8.0.x before 8.0.32, 9.0.x before 9.0.21, and 10.0.x before 10.0.13 on Windows, Linux, and macOS, but only when Kestrel is running with HTTP/3 support enabled - servers limited to HTTP/1.1 or HTTP/2 are not exposed. Publicly available exploit code exists (a public gist demonstrates the issue), and the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact with no confidentiality or integrity loss; there is no confirmed active exploitation at time of analysis.
Unauthenticated remote attackers can force a deadlock in the Windows Routing and Remote Access Service (RRAS), causing a denial of service against the service itself (CVSS 3.1 base 7.5 HIGH; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack is remote, low-complexity, requires no credentials and no user interaction, but the practical blast radius is bounded by the deployment prerequisite: the RRAS role must be installed, enabled, and network-reachable, and RRAS is not enabled by default on standard Windows installations. Impact is limited to availability - there is no confidentiality or integrity effect, so the host is not compromised beyond the loss of routing/VPN/remote-access functionality. No public exploit code has been identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV).
Deadlock in the Linux kernel IP defragmentation subsystem occurs when processing fragmented encapsulated (tunneled) traffic, allowing a remote attacker to trigger a kernel locking deadlock by sending specially crafted fragmented tunnel packets. Any Linux system with active tunnel interfaces (GRE, IPIP, VXLAN, or similar encapsulation) and IP defragmentation enabled is potentially affected. The result is a denial-of-service condition causing the affected network path or system to hang, with no confidentiality or integrity impact identified. No public exploit or active exploitation has been identified at time of analysis.
Resource exhaustion in boringproxy through 0.10.0 allows any authenticated user to permanently consume server file descriptors, goroutines, and memory by repeatedly requesting the GET /loading endpoint with arbitrary id parameter values. The handler blindly attempts to receive from a nil channel - a Go-language primitive that blocks forever - with no map-lookup validity check, no HTTP server timeouts, no context cancellation, and no runtime reclamation, meaning each malicious request permanently holds one goroutine (~50 kB stack), one file descriptor, and associated heap memory. Once the server's file descriptor limit is exhausted, all listener Accept calls fail and tunnel traffic forwarding halts for every connected user. A public proof-of-concept writeup exists on GitHub; no CISA KEV listing has been identified at time of analysis.
Authenticated denial of service in Microsoft UFO prior to 3.0.9: a caller holding a valid API key can indefinitely block the /api/task_result/{task_name} endpoint by requesting a task name that maps to an existing session, causing the server to re-acquire the same non-reentrant lock twice (CWE-833 deadlock). In the vendor's default single-process configuration the hung request stalls the event-loop thread, taking down other HTTP endpoints, WebSocket connections, and dependent background interactions, while unknown or unmapped task names never reach the nested call and are harmless. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rates this purely as an availability impact requiring low privileges; no confirmed active exploitation and no public exploit code were identified at time of analysis, and multi-process or multi-worker deployments limit the blast radius to the affected worker.
Authenticated users of Rapid7 Velociraptor can trigger a server-side deadlock in the platform's user-management module, hanging server operations and causing a denial of service (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only a valid low-privileged account that can reach the user-management code path over the network - no user interaction, no elevated role, and no special configuration - but it offers no data read, modification, or code execution, so it cannot be used for initial access or lateral escalation. Impact is availability-only (CWE-833, lock management bug); no public exploit identified at time of analysis, no CISA KEV listing, and the vendor advisory is the authoritative source for version-specific guidance.
USB CDC-NCM network driver in Zephyr RTOS through v4.4.0 permanently deadlocks the shared network egress thread when a USB bus suspend coincides with outbound device traffic, requiring a reboot to recover. The defect in `cdc_ncm_send()` ignores the return value of `usbd_ep_enqueue()` and unconditionally blocks on a completion semaphore that only the (never-fired) bulk-IN ISR can signal - halting not just CDC-NCM traffic but all egress on other interfaces sharing the TX thread. No public exploit code or active exploitation has been identified; the trigger is routine USB host power management, making this an availability risk for any embedded Zephyr device using USB virtual Ethernet.
Kernel availability loss in Ubuntu Linux 6.8, 6.17, and 7.0 can be triggered by any unprivileged local user via a defect in Ubuntu-specific AppArmor SAUCE patches, where notification handling code incorrectly sleeps while holding a spinlock. Violating this kernel locking invariant results in kernel panic or deadlock, causing a full system crash or hang. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low-complexity, low-privilege trigger conditions make it a realistic denial-of-service risk on any multi-user Ubuntu system running the affected kernel versions.
Ella Core's AMF control plane deadlocks in the SCTP notification handler when processing malformed or stale radio entries, allowing unauthenticated attackers with N2 interface access to hang the entire Access and Mobility Function until manual process restart, completely denying service to all subscribers. The vulnerability (CVSS 6.5, CWE-833 deadlock) stems from improper synchronization in radio cleanup logic combined with stale-entry scanning, and patches are available in version 1.7.0 and later.
Scanning TCP port 80 crashes the embedded webserver on Softing smartLink HW-PN 1.02 through 1.03 and smartLink HW-DP 1.31, causing a remote unauthenticated denial of service. The CVSS 4.0 vector confirms network reachability with no privileges or user interaction, but impact is limited to availability; confidentiality and integrity are not affected. No public exploit was identified at time of analysis, and EPSS is low at 0.26% (17th percentile).