Monthly
Heap exhaustion denial of service in FasterXML jackson-core 2.16.0 and later allows an unauthenticated remote attacker to force allocation of roughly 100 MB or more per oversized JSON property name whenever untrusted JSON is parsed from a character-based source (String, Reader, or char[]), which is the normal path for a request body already read into a String. Because the maxNameLength bound (default 50,000 characters, ~100 KB) is only validated after the entire name has been buffered, the much larger maxStringLength bound (default 100,000,000 characters, roughly 200 MB with segment bookkeeping overhead) governs first, and repeating this across concurrent requests can exhaust the heap and crash the process. The impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Algorithmic resource exhaustion in destructive_command_guard (dcg) versions prior to 0.6.6 lets a crafted shell command - a destructive command followed by nested or unclosed $( or $(( substitution sequences - trigger exponential-time rescans in the split_command_segments scanners (src/packs/mod.rs), hanging the process. Because dcg runs as a PreToolUse guard hook for AI coding agents and that hook fails open on timeout, the hang does not block the command but instead allows the destructive command to be executed - turning a denial-of-service bug (CWE-400) into a safety-control bypass with high integrity impact. The issue is rated 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating a local attack path with no privileges required but requiring user interaction (the command must actually be submitted), and the fix is the vendor-released version 0.6.6; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Denial of service in pupnp (libupnp) releases prior to 22.0.4 lets remote unauthenticated attackers stall the UPnP miniserver by feeding it hostnames that resolve slowly or not at all: parse_hostport() in uri.c synchronously calls getaddrinfo() while parsing inbound HTTP request targets and GENA SUBSCRIBE CALLBACK headers, so each request pins a worker thread for the resolver timeout. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with only availability impact (C:N/I:N/A:H, 7.5), a small number of crafted requests can exhaust the bounded miniserver worker pool and deny UPnP service to legitimate devices; no public exploit code was identified at the time of analysis, though the upstream fix commit and advisory are public. Realistically the issue is bounded and self-recovering - once the hostile requests stop, threads free up - and exploitation in practice presumes LAN reachability, since miniservers are normally bound to the local network.
Unauthenticated memory exhaustion in the FreeRDP server-side component (3.0.0 through 3.31.x) allows a remote attacker to drive the process toward out-of-memory failure by completing a TLS handshake and then streaming bytes that do not begin with the DER SEQUENCE tag 0x30, which causes parse_nla_mode_pdu to grow the receive buffer without bound before NLA authentication ever completes. No credentials, user interaction, or non-default feature flag are required, but the attack surface is limited to hosts running a FreeRDP-based server with TLS reachable on its listening port; the far more common client role is not affected. Impact is availability-only (no code execution, no data disclosure), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Memory exhaustion in FreeRDP 2.0.0 through 3.31.x lets an authenticated RDP client degrade or crash a server that exposes FreeRDP's listener role: the attacker opens a static virtual channel message and then streams endless channel-data fragments while withholding the CHANNEL_FLAG_LAST terminator, so the server-side reassembly buffer grows without bound. The issue is scored 7.1 under CVSS 4.0 and independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, meaning availability-only impact with no confidentiality or integrity loss. Exploitation is not confirmed in the wild (no CISA KEV listing) and no public exploit identified at time of analysis; the practical exposure is narrowed because the vulnerable code path is server-side and the attacker must already hold an authenticated RDP session.
Denial of service in AdonisJS HTTP Server (adonisjs/http-server) lets unauthenticated remote attackers stall the Node.js event loop: versions prior to 8.2.2 and 9.1.1 contain a catastrophic-backtracking regular expression in router.matchers.slug(), and a long slug ending in a character rejected by the final assertion triggers quadratic CPU consumption. Because the matcher runs during route matching and before route and group middleware, authentication or rate-limiting middleware attached to the affected route does not prevent the request from blocking the worker and starving unrelated requests and health checks. Impact is availability-only with no data exposure, the CVSS 4.0 base score is 8.7 (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no public exploit identified at time of analysis, and exploitation requires the application to explicitly apply the slug matcher to an externally reachable, attacker-controlled route parameter rather than affecting every AdonisJS deployment.
Denial of service in Lychee before 7.7.0 allows an authenticated user with upload/import permission to tie up image-processing capacity by submitting a tiny PDF whose first page declares an oversized /MediaBox. Lychee hands PDFs to ImageMagick with Ghostscript enabled and applies no pre-render page-size check in ImagickHandler::loadPdf(), so Ghostscript burns CPU rasterizing an enormous page before the pixel-cache policy rejects the result; in synchronous QUEUE_CONNECTION deployments a single request occupies a web worker, while the official asynchronous Docker setup instead backs up the shared image-processing queue and delays other users' work. Exploitation is gated behind authentication, only availability is affected (no confidentiality, integrity, or Ghostscript sandbox-escape impact), and no public exploit was identified at time of analysis. The vendor/CNA scored this 7.1 under CVSS 4.0, whereas the independent assessment rates the same issue CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (4.3), reflecting limited per-request availability impact.
Unbounded direct-memory allocation in Eclipse Vert.x's MSSQL client (io.vertx:vertx-mssql-client) lets a malicious, compromised, or man-in-the-middle SQL Server endpoint crash a connecting client application by streaming TDS packets that never set the END_OF_MESSAGE status flag. Affected versions are [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9] and 5.2.0: the TDS message decoder aggregates inbound packets into a composite direct-memory buffer with no cumulative size cap, so the buffer grows until memory is exhausted and the process dies (availability impact only, with no confidentiality or integrity loss, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw is reachable before authentication completes, meaning no valid server credentials are required, but exploitation is not available to an arbitrary remote attacker - it demands control of, or a man-in-the-middle position on, the server side of the connection, which is why access complexity is rated High. No public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Nodemailer 3.0.0 through 10.0.9 allows an attacker-controlled or on-path SMTP server to stall a Node.js application by streaming SMTP continuation lines that never deliver a terminating completion line during the greeting/authentication phase. The vulnerable reply parser in SMTPConnection._onData and isPartialResponse re-evaluates its buffered response on every incoming chunk, so parsing cost grows quadratically with the size of the accumulated reply, blocking the single-threaded event loop and consuming memory before authentication completes. No public exploit code was identified at time of analysis, and exploitation is conditional: the client must be configured to connect to an untrusted or attacker-influenceable SMTP server, or an attacker must be positioned on-path on an interceptable SMTP connection, which is why the assessed vector carries AC:H and AT:P and this is a genuine but conditional availability risk rather than a blanket critical one.
Denial of service in Nodemailer versions 3.0.0 up to but not including 10.0.10 allows an attacker who can influence message content - specifically the recipient list (to/cc/bcc) or header fields passed to the message builder - to force quadratic header unfolding in MessageParser.parseHeaders, exhausting CPU and blocking the Node.js event loop while DKIM signing is performed. Only low-privileged access to the send functionality is required (CVSS PR:L), and impact is limited to availability: no data exposure, integrity loss, or code execution is involved. There is no public exploit identified at time of analysis, and exploitation additionally depends on DKIM signing being active in the same process, which makes real-world risk highest for multi-tenant mail-sending services that accept user-controlled recipients or headers.
Heap exhaustion denial of service in FasterXML jackson-core 2.16.0 and later allows an unauthenticated remote attacker to force allocation of roughly 100 MB or more per oversized JSON property name whenever untrusted JSON is parsed from a character-based source (String, Reader, or char[]), which is the normal path for a request body already read into a String. Because the maxNameLength bound (default 50,000 characters, ~100 KB) is only validated after the entire name has been buffered, the much larger maxStringLength bound (default 100,000,000 characters, roughly 200 MB with segment bookkeeping overhead) governs first, and repeating this across concurrent requests can exhaust the heap and crash the process. The impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Algorithmic resource exhaustion in destructive_command_guard (dcg) versions prior to 0.6.6 lets a crafted shell command - a destructive command followed by nested or unclosed $( or $(( substitution sequences - trigger exponential-time rescans in the split_command_segments scanners (src/packs/mod.rs), hanging the process. Because dcg runs as a PreToolUse guard hook for AI coding agents and that hook fails open on timeout, the hang does not block the command but instead allows the destructive command to be executed - turning a denial-of-service bug (CWE-400) into a safety-control bypass with high integrity impact. The issue is rated 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating a local attack path with no privileges required but requiring user interaction (the command must actually be submitted), and the fix is the vendor-released version 0.6.6; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Denial of service in pupnp (libupnp) releases prior to 22.0.4 lets remote unauthenticated attackers stall the UPnP miniserver by feeding it hostnames that resolve slowly or not at all: parse_hostport() in uri.c synchronously calls getaddrinfo() while parsing inbound HTTP request targets and GENA SUBSCRIBE CALLBACK headers, so each request pins a worker thread for the resolver timeout. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with only availability impact (C:N/I:N/A:H, 7.5), a small number of crafted requests can exhaust the bounded miniserver worker pool and deny UPnP service to legitimate devices; no public exploit code was identified at the time of analysis, though the upstream fix commit and advisory are public. Realistically the issue is bounded and self-recovering - once the hostile requests stop, threads free up - and exploitation in practice presumes LAN reachability, since miniservers are normally bound to the local network.
Unauthenticated memory exhaustion in the FreeRDP server-side component (3.0.0 through 3.31.x) allows a remote attacker to drive the process toward out-of-memory failure by completing a TLS handshake and then streaming bytes that do not begin with the DER SEQUENCE tag 0x30, which causes parse_nla_mode_pdu to grow the receive buffer without bound before NLA authentication ever completes. No credentials, user interaction, or non-default feature flag are required, but the attack surface is limited to hosts running a FreeRDP-based server with TLS reachable on its listening port; the far more common client role is not affected. Impact is availability-only (no code execution, no data disclosure), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Memory exhaustion in FreeRDP 2.0.0 through 3.31.x lets an authenticated RDP client degrade or crash a server that exposes FreeRDP's listener role: the attacker opens a static virtual channel message and then streams endless channel-data fragments while withholding the CHANNEL_FLAG_LAST terminator, so the server-side reassembly buffer grows without bound. The issue is scored 7.1 under CVSS 4.0 and independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, meaning availability-only impact with no confidentiality or integrity loss. Exploitation is not confirmed in the wild (no CISA KEV listing) and no public exploit identified at time of analysis; the practical exposure is narrowed because the vulnerable code path is server-side and the attacker must already hold an authenticated RDP session.
Denial of service in AdonisJS HTTP Server (adonisjs/http-server) lets unauthenticated remote attackers stall the Node.js event loop: versions prior to 8.2.2 and 9.1.1 contain a catastrophic-backtracking regular expression in router.matchers.slug(), and a long slug ending in a character rejected by the final assertion triggers quadratic CPU consumption. Because the matcher runs during route matching and before route and group middleware, authentication or rate-limiting middleware attached to the affected route does not prevent the request from blocking the worker and starving unrelated requests and health checks. Impact is availability-only with no data exposure, the CVSS 4.0 base score is 8.7 (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no public exploit identified at time of analysis, and exploitation requires the application to explicitly apply the slug matcher to an externally reachable, attacker-controlled route parameter rather than affecting every AdonisJS deployment.
Denial of service in Lychee before 7.7.0 allows an authenticated user with upload/import permission to tie up image-processing capacity by submitting a tiny PDF whose first page declares an oversized /MediaBox. Lychee hands PDFs to ImageMagick with Ghostscript enabled and applies no pre-render page-size check in ImagickHandler::loadPdf(), so Ghostscript burns CPU rasterizing an enormous page before the pixel-cache policy rejects the result; in synchronous QUEUE_CONNECTION deployments a single request occupies a web worker, while the official asynchronous Docker setup instead backs up the shared image-processing queue and delays other users' work. Exploitation is gated behind authentication, only availability is affected (no confidentiality, integrity, or Ghostscript sandbox-escape impact), and no public exploit was identified at time of analysis. The vendor/CNA scored this 7.1 under CVSS 4.0, whereas the independent assessment rates the same issue CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (4.3), reflecting limited per-request availability impact.
Unbounded direct-memory allocation in Eclipse Vert.x's MSSQL client (io.vertx:vertx-mssql-client) lets a malicious, compromised, or man-in-the-middle SQL Server endpoint crash a connecting client application by streaming TDS packets that never set the END_OF_MESSAGE status flag. Affected versions are [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9] and 5.2.0: the TDS message decoder aggregates inbound packets into a composite direct-memory buffer with no cumulative size cap, so the buffer grows until memory is exhausted and the process dies (availability impact only, with no confidentiality or integrity loss, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw is reachable before authentication completes, meaning no valid server credentials are required, but exploitation is not available to an arbitrary remote attacker - it demands control of, or a man-in-the-middle position on, the server side of the connection, which is why access complexity is rated High. No public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Nodemailer 3.0.0 through 10.0.9 allows an attacker-controlled or on-path SMTP server to stall a Node.js application by streaming SMTP continuation lines that never deliver a terminating completion line during the greeting/authentication phase. The vulnerable reply parser in SMTPConnection._onData and isPartialResponse re-evaluates its buffered response on every incoming chunk, so parsing cost grows quadratically with the size of the accumulated reply, blocking the single-threaded event loop and consuming memory before authentication completes. No public exploit code was identified at time of analysis, and exploitation is conditional: the client must be configured to connect to an untrusted or attacker-influenceable SMTP server, or an attacker must be positioned on-path on an interceptable SMTP connection, which is why the assessed vector carries AC:H and AT:P and this is a genuine but conditional availability risk rather than a blanket critical one.
Denial of service in Nodemailer versions 3.0.0 up to but not including 10.0.10 allows an attacker who can influence message content - specifically the recipient list (to/cc/bcc) or header fields passed to the message builder - to force quadratic header unfolding in MessageParser.parseHeaders, exhausting CPU and blocking the Node.js event loop while DKIM signing is performed. Only low-privileged access to the send functionality is required (CVSS PR:L), and impact is limited to availability: no data exposure, integrity loss, or code execution is involved. There is no public exploit identified at time of analysis, and exploitation additionally depends on DKIM signing being active in the same process, which makes real-world risk highest for multi-tenant mail-sending services that accept user-controlled recipients or headers.