Monthly
Flux.bufferTimeout operator in Spring Reactor Core can be driven into a Denial of Service condition when the fairBackpressure option is explicitly enabled, affecting versions 3.8.0-3.8.6 and 3.7.19 and earlier. Remote unauthenticated attackers who can reach the application's reactive endpoints may exploit the pathological backpressure state to fully disrupt availability. No public exploit has been identified at time of analysis, and the non-default configuration requirement materially narrows the real-world attack surface.
GitLab Enterprise Edition's SCIM user provisioning feature allows an authenticated low-privileged user to trigger an unbounded loop via specially crafted input, causing denial of service on the affected instance. Versions spanning a wide range from 11.10 through 19.3.0 are affected, with vendor-released patches now available. A publicly available exploit is documented in HackerOne report #3292470; however, this vulnerability is not listed in CISA KEV, indicating active exploitation has not been confirmed at scale.
Infinite loop denial-of-service in bytebot 0.0.1's Agent Execution Workflow can be triggered remotely by a low-privileged attacker, exhausting server resources and disrupting service availability. The product is end-of-life and no longer maintained by bytebot-ai, meaning no official patch will be released. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation despite the moderate CVSS 4.0 score of 5.3.
Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. No public exploit has been identified and no CISA KEV listing exists; CVSS 5.5 reflects a local, user-interaction-dependent denial-of-service with no code execution potential.
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allowing any caller who can supply template input to permanently block rendering with a string as short as two characters. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects that no authentication or special configuration is needed when the rendering endpoint accepts external input. The issue is fixed in version 10.27.1 via a one-character patch; no public exploit code beyond the patch test cases has been confirmed, and no CISA KEV listing is recorded.
Interrupt-storm livelock in Zephyr RTOS's ARM PL011 UART driver (versions 1.14.0 through 4.4.1) allows an attacker controlling the serial peer to permanently hang the CPU by injecting line errors that trigger an error interrupt the ISR never clears. The root cause is that pl011_isr() acknowledged only the CTS modem-status interrupt and never wrote the UARTICR register for error bits (framing, parity, break, overrun), leaving the interrupt line permanently asserted and causing the CPU to re-enter the ISR indefinitely. Exploitation is gated by a non-default configuration requirement - the error interrupt path is off by default and no in-tree Zephyr subsystem enables it - so only embedded applications explicitly calling uart_irq_err_enable() on a PL011 interrupt-driven port are at risk. No public exploit or CISA KEV listing exists at time of analysis.
Denial of service via WebSocket decompression in JetBrains Ktor before 3.4.1 allows unauthenticated remote attackers to exhaust server resources or trigger an infinite loop by sending crafted compressed WebSocket messages. The root cause is CWE-835 (Loop with Unreachable Exit Condition), meaning the decompression routine can enter a state from which it cannot exit, stalling the affected connection handler or the broader server process. No public exploit code or active exploitation has been identified at time of analysis, but the network-reachable, no-authentication attack path makes this relevant to any internet-exposed Ktor deployment with WebSocket compression enabled.
Denial of service in dnsmasq's DNSSEC validation code allows an attacker who operates any DNSSEC-signed authoritative zone to permanently hang the dnsmasq process with a single crafted DNS response, killing all DNS resolution for every client served by that instance. Affected deployments include dnsmasq as packaged in Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis; the assigned CVSS score of 4.4 (Medium) carries a notable inconsistency between the stated local attack vector and the network-delivered attack mechanism described.
Denial of service in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to crash or hang affected systems by triggering an infinite loop condition (CWE-835) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and minimal complexity, making automated exploitation straightforward. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker via a CWE-835 infinite loop condition. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication and no user interaction against affected systems. No public exploit code or active exploitation confirmed at time of analysis; IBM has released a patch.
Flux.bufferTimeout operator in Spring Reactor Core can be driven into a Denial of Service condition when the fairBackpressure option is explicitly enabled, affecting versions 3.8.0-3.8.6 and 3.7.19 and earlier. Remote unauthenticated attackers who can reach the application's reactive endpoints may exploit the pathological backpressure state to fully disrupt availability. No public exploit has been identified at time of analysis, and the non-default configuration requirement materially narrows the real-world attack surface.
GitLab Enterprise Edition's SCIM user provisioning feature allows an authenticated low-privileged user to trigger an unbounded loop via specially crafted input, causing denial of service on the affected instance. Versions spanning a wide range from 11.10 through 19.3.0 are affected, with vendor-released patches now available. A publicly available exploit is documented in HackerOne report #3292470; however, this vulnerability is not listed in CISA KEV, indicating active exploitation has not been confirmed at scale.
Infinite loop denial-of-service in bytebot 0.0.1's Agent Execution Workflow can be triggered remotely by a low-privileged attacker, exhausting server resources and disrupting service availability. The product is end-of-life and no longer maintained by bytebot-ai, meaning no official patch will be released. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation despite the moderate CVSS 4.0 score of 5.3.
Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. No public exploit has been identified and no CISA KEV listing exists; CVSS 5.5 reflects a local, user-interaction-dependent denial-of-service with no code execution potential.
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allowing any caller who can supply template input to permanently block rendering with a string as short as two characters. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects that no authentication or special configuration is needed when the rendering endpoint accepts external input. The issue is fixed in version 10.27.1 via a one-character patch; no public exploit code beyond the patch test cases has been confirmed, and no CISA KEV listing is recorded.
Interrupt-storm livelock in Zephyr RTOS's ARM PL011 UART driver (versions 1.14.0 through 4.4.1) allows an attacker controlling the serial peer to permanently hang the CPU by injecting line errors that trigger an error interrupt the ISR never clears. The root cause is that pl011_isr() acknowledged only the CTS modem-status interrupt and never wrote the UARTICR register for error bits (framing, parity, break, overrun), leaving the interrupt line permanently asserted and causing the CPU to re-enter the ISR indefinitely. Exploitation is gated by a non-default configuration requirement - the error interrupt path is off by default and no in-tree Zephyr subsystem enables it - so only embedded applications explicitly calling uart_irq_err_enable() on a PL011 interrupt-driven port are at risk. No public exploit or CISA KEV listing exists at time of analysis.
Denial of service via WebSocket decompression in JetBrains Ktor before 3.4.1 allows unauthenticated remote attackers to exhaust server resources or trigger an infinite loop by sending crafted compressed WebSocket messages. The root cause is CWE-835 (Loop with Unreachable Exit Condition), meaning the decompression routine can enter a state from which it cannot exit, stalling the affected connection handler or the broader server process. No public exploit code or active exploitation has been identified at time of analysis, but the network-reachable, no-authentication attack path makes this relevant to any internet-exposed Ktor deployment with WebSocket compression enabled.
Denial of service in dnsmasq's DNSSEC validation code allows an attacker who operates any DNSSEC-signed authoritative zone to permanently hang the dnsmasq process with a single crafted DNS response, killing all DNS resolution for every client served by that instance. Affected deployments include dnsmasq as packaged in Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis; the assigned CVSS score of 4.4 (Medium) carries a notable inconsistency between the stated local attack vector and the network-delivered attack mechanism described.
Denial of service in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to crash or hang affected systems by triggering an infinite loop condition (CWE-835) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and minimal complexity, making automated exploitation straightforward. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker via a CWE-835 infinite loop condition. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication and no user interaction against affected systems. No public exploit code or active exploitation confirmed at time of analysis; IBM has released a patch.