Monthly
Malformed MP4 box-size fields submitted to the MP4Parser component in j4care dcm4chee-arc-light drive the parser into a non-terminating loop that repeatedly reprocesses the same input, consuming CPU and hanging the affected ingestion service. The defect is classified CWE-835 (loop with unreachable exit condition) and is network-reachable and unauthenticated per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so any actor able to reach an archive endpoint that accepts and parses DICOM-encapsulated MP4 media can trigger it; impact is availability-only with no confidentiality or integrity consequence. No public exploit code was identified at time of analysis, and the issue is documented by CISA in ICS medical advisory ICSMA-26-288-02.
JPEGParser in j4care's dcm4chee-arc-light can be driven into an infinite loop by a specially crafted or truncated JPEG-encoded stream delivered to the archive's image/DICOM ingestion path, resulting in a denial-of-service condition (CWE-835). Per the supplied CVSS 4.0 vector the flaw is network-reachable and requires no authentication and no user interaction (AV:N, AC:L, PR:N, UI:N), but the impact is availability-only (VA:H with VC:N/VI:N) - no code execution, data disclosure, or integrity loss is described. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is bounded by network reachability: deployments that expose a JPEG/DICOM parsing endpoint beyond a segmented clinical network are the ones materially at risk.
Denial of service in Junrar before 7.6.1 allows unauthenticated remote attackers to exhaust CPU and archive-processing worker capacity by supplying a crafted RAR4 archive. The archive drives the built-in RAR virtual machine into an infinite loop via a VM_JMP instruction targeting an address at or beyond the prepared program's codeSize; because the VM cannot execute native code, the supported impact is availability loss rather than code execution. No public exploit code or confirmed active exploitation has been identified, and the flaw is fixed in version 7.6.1.
Denial of service in FreeRDP 3.0.0 through 3.31.x allows a malicious RDP gateway to pin a client thread at full CPU indefinitely via an infinite loop in http_response_recv(). An attacker who controls the gateway endpoint the client connects to can return an HTTP response with a nonzero Content-Length and an unrecognized, semicolon-containing Content-Type header, causing the client to consume CPU without progress. Exploitation is unauthenticated but requires the victim to initiate a gateway-mode connection (user interaction); no public exploit code has been identified at time of analysis, and the issue is a moderate-severity availability concern with no impact on confidentiality or integrity.
Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted StartupMessage whose options parameter contains an empty parameter name (for example "-c="), which makes the server's ignore_startup_parameters lookup loop indefinitely during the pre-authentication startup phase. Because PgBouncer serves every client from a single process, the loop pins a CPU core and stalls all connection pools until an administrator manually restarts the daemon, so a lone packet from any TCP-reachable source can take down the entire pooler. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the issue is network-reachable with low complexity, requires no credentials or user interaction, and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting its availability-only impact.
A remote, unauthenticated attacker can cause a denial of service in the routing protocol daemon (rpd) of Juniper Junos OS and Junos OS Evolved by sending crafted EVPN multihoming traffic when the device is configured with preference-based designated-forwarder election. The flaw, an infinite loop (CWE-835), halts the routing daemon and affects only availability, with no confidentiality or integrity impact. Exploitation requires the non-default EVPN multihoming feature to be enabled; a vendor patch (JSA112187) is available, and no public exploit has been identified at time of analysis.
Crafted SCTP network traffic can drive the netsctp.ko kernel module on Juniper MX Series routers running affected Junos OS releases into an infinite loop, stalling the SCTP processing path and producing a denial of service against the device. Exploitation is unauthenticated and requires no user interaction (PR:N/UI:N per the assessed vector) - the attacker only needs network reachability to a device that is actually processing SCTP traffic, which in practice means MX platforms used in telecom/mobile signaling roles; routers that do not handle SCTP are not exposed. The vendor has published an advisory and fixed releases, and no public exploit code or confirmed active exploitation was identified at time of analysis (this CVE is not associated with CISA KEV), so the primary risk driver is the size of the exposed, SCTP-handling MX population rather than demonstrated in-the-wild abuse.
FreeRDP clients 2.3.0 through 3.31.x can be hung by a malicious or compromised RD Gateway that returns an incomplete HTTP chunked response and then cleanly closes the TLS connection. The bug is an infinite loop (CWE-835) in http_chuncked_read: zero-byte reads after a truncated chunk-size line or footer keep the decoder thread spinning, causing a client-side denial of service. This is a remote, unauthenticated availability-only issue per the provided CVSS vector (PR:N) but requires the victim to initiate the gateway connection (UI:P/UI:R); no public exploit identified at time of analysis.
Denial of service in GNOME Remote Desktop (gnome-remote-desktop) as shipped in Red Hat Enterprise Linux 8, 9, and 10 allows an unauthenticated remote attacker to pin the daemon's event-loop thread at high CPU by sending traffic to a TLS-enabled VNC listener, causing the service to stop making forward progress. The defect is in the VNC TLS I/O handlers, which treat retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) with an unbounded busy loop instead of returning control to the event loop, so the thread spins indefinitely rather than waiting for socket readiness. No public exploit code exists and there is no confirmed active exploitation, and practical exposure is bounded: the VNC backend must be running with a TLS listener reachable over the network, a configuration that is not enabled by default on typical RHEL installs and is far more common on desktops than on servers.
FFmpeg through 9.0.2 contains an infinite loop in ff_rtsp_connect() (libavformat/rtsp.c) because the RTSP client follows 3xx redirects without a redirect limit, allowing a malicious RTSP server to cause endless reconnects that saturate a CPU core. Exploitation is remote and unauthenticated (CVSS PR:N) but requires passive user interaction (UI:P/UI:R): the victim must open an RTSP stream that resolves to the attacker-controlled server, which then answers every request with a 302 redirect to itself or another server. Publicly available exploit code exists (a gist PoC), but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a genuine but bounded availability threat, with the highest exposure in services that accept and open user-supplied RTSP URLs automatically.
Malformed MP4 box-size fields submitted to the MP4Parser component in j4care dcm4chee-arc-light drive the parser into a non-terminating loop that repeatedly reprocesses the same input, consuming CPU and hanging the affected ingestion service. The defect is classified CWE-835 (loop with unreachable exit condition) and is network-reachable and unauthenticated per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so any actor able to reach an archive endpoint that accepts and parses DICOM-encapsulated MP4 media can trigger it; impact is availability-only with no confidentiality or integrity consequence. No public exploit code was identified at time of analysis, and the issue is documented by CISA in ICS medical advisory ICSMA-26-288-02.
JPEGParser in j4care's dcm4chee-arc-light can be driven into an infinite loop by a specially crafted or truncated JPEG-encoded stream delivered to the archive's image/DICOM ingestion path, resulting in a denial-of-service condition (CWE-835). Per the supplied CVSS 4.0 vector the flaw is network-reachable and requires no authentication and no user interaction (AV:N, AC:L, PR:N, UI:N), but the impact is availability-only (VA:H with VC:N/VI:N) - no code execution, data disclosure, or integrity loss is described. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is bounded by network reachability: deployments that expose a JPEG/DICOM parsing endpoint beyond a segmented clinical network are the ones materially at risk.
Denial of service in Junrar before 7.6.1 allows unauthenticated remote attackers to exhaust CPU and archive-processing worker capacity by supplying a crafted RAR4 archive. The archive drives the built-in RAR virtual machine into an infinite loop via a VM_JMP instruction targeting an address at or beyond the prepared program's codeSize; because the VM cannot execute native code, the supported impact is availability loss rather than code execution. No public exploit code or confirmed active exploitation has been identified, and the flaw is fixed in version 7.6.1.
Denial of service in FreeRDP 3.0.0 through 3.31.x allows a malicious RDP gateway to pin a client thread at full CPU indefinitely via an infinite loop in http_response_recv(). An attacker who controls the gateway endpoint the client connects to can return an HTTP response with a nonzero Content-Length and an unrecognized, semicolon-containing Content-Type header, causing the client to consume CPU without progress. Exploitation is unauthenticated but requires the victim to initiate a gateway-mode connection (user interaction); no public exploit code has been identified at time of analysis, and the issue is a moderate-severity availability concern with no impact on confidentiality or integrity.
Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted StartupMessage whose options parameter contains an empty parameter name (for example "-c="), which makes the server's ignore_startup_parameters lookup loop indefinitely during the pre-authentication startup phase. Because PgBouncer serves every client from a single process, the loop pins a CPU core and stalls all connection pools until an administrator manually restarts the daemon, so a lone packet from any TCP-reachable source can take down the entire pooler. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the issue is network-reachable with low complexity, requires no credentials or user interaction, and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting its availability-only impact.
A remote, unauthenticated attacker can cause a denial of service in the routing protocol daemon (rpd) of Juniper Junos OS and Junos OS Evolved by sending crafted EVPN multihoming traffic when the device is configured with preference-based designated-forwarder election. The flaw, an infinite loop (CWE-835), halts the routing daemon and affects only availability, with no confidentiality or integrity impact. Exploitation requires the non-default EVPN multihoming feature to be enabled; a vendor patch (JSA112187) is available, and no public exploit has been identified at time of analysis.
Crafted SCTP network traffic can drive the netsctp.ko kernel module on Juniper MX Series routers running affected Junos OS releases into an infinite loop, stalling the SCTP processing path and producing a denial of service against the device. Exploitation is unauthenticated and requires no user interaction (PR:N/UI:N per the assessed vector) - the attacker only needs network reachability to a device that is actually processing SCTP traffic, which in practice means MX platforms used in telecom/mobile signaling roles; routers that do not handle SCTP are not exposed. The vendor has published an advisory and fixed releases, and no public exploit code or confirmed active exploitation was identified at time of analysis (this CVE is not associated with CISA KEV), so the primary risk driver is the size of the exposed, SCTP-handling MX population rather than demonstrated in-the-wild abuse.
FreeRDP clients 2.3.0 through 3.31.x can be hung by a malicious or compromised RD Gateway that returns an incomplete HTTP chunked response and then cleanly closes the TLS connection. The bug is an infinite loop (CWE-835) in http_chuncked_read: zero-byte reads after a truncated chunk-size line or footer keep the decoder thread spinning, causing a client-side denial of service. This is a remote, unauthenticated availability-only issue per the provided CVSS vector (PR:N) but requires the victim to initiate the gateway connection (UI:P/UI:R); no public exploit identified at time of analysis.
Denial of service in GNOME Remote Desktop (gnome-remote-desktop) as shipped in Red Hat Enterprise Linux 8, 9, and 10 allows an unauthenticated remote attacker to pin the daemon's event-loop thread at high CPU by sending traffic to a TLS-enabled VNC listener, causing the service to stop making forward progress. The defect is in the VNC TLS I/O handlers, which treat retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) with an unbounded busy loop instead of returning control to the event loop, so the thread spins indefinitely rather than waiting for socket readiness. No public exploit code exists and there is no confirmed active exploitation, and practical exposure is bounded: the VNC backend must be running with a TLS listener reachable over the network, a configuration that is not enabled by default on typical RHEL installs and is far more common on desktops than on servers.
FFmpeg through 9.0.2 contains an infinite loop in ff_rtsp_connect() (libavformat/rtsp.c) because the RTSP client follows 3xx redirects without a redirect limit, allowing a malicious RTSP server to cause endless reconnects that saturate a CPU core. Exploitation is remote and unauthenticated (CVSS PR:N) but requires passive user interaction (UI:P/UI:R): the victim must open an RTSP stream that resolves to the attacker-controlled server, which then answers every request with a 302 redirect to itself or another server. Publicly available exploit code exists (a gist PoC), but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a genuine but bounded availability threat, with the highest exposure in services that accept and open user-supplied RTSP URLs automatically.