Monthly
Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's `maxTotalMergeKeys` safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (`<<`) processing is enabled by default on both release lines. No confirmed active exploitation appears in CISA KEV at time of analysis, but the attack is trivially reproducible from the published advisory and pathological test case, and the library's ubiquity in the npm ecosystem makes this a high-priority availability risk.
Heap-exhaustion denial-of-service in Hono web framework before 4.13.5 allows unauthenticated network attackers to crash the JavaScript server process by submitting form requests with deeply nested or numerous dot-separated field names when dot-notation parsing is explicitly enabled. The `parseBody()` function expands dot-separated keys into nested JavaScript objects without any bound on nesting depth or total intermediate object count, allowing a normal-sized request body to produce an object graph orders of magnitude larger and exhaust the runtime heap. Exploitation causes server process termination and service outage until manual restart; no public exploit is identified at time of analysis.
Denial-of-service in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator to interrupt service availability. The flaw requires high-complexity conditions (AV:N/AC:H/PR:L) and produces only limited availability impact, placing it at CVSS 3.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in HPE Networking Fabric Composer's web-based management interface can be triggered by an authenticated low-privilege operator, disrupting the availability of the management UI. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a low-severity, network-accessible flaw requiring valid credentials and user interaction, yielding only limited availability impact. No exploitation has been publicly demonstrated, and the vulnerability does not affect the underlying fabric infrastructure - only the management interface itself.
Memory exhaustion in gRPC-Go before version 1.83.1 allows an unauthenticated remote attacker to crash any service built on this library by sending HTTP/2 streams fragmented into millions of tiny one-byte DATA frames. Each fragment is stored as a separate recvMsg object in recvBuffer, creating severe heap overhead that bypasses HTTP/2 flow-control protections - which limit payload bytes, not the number of allocated metadata objects. No public exploit has been identified at time of analysis, but the attack is fully derivable from the public GitHub advisory and PR diff.
ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event loop by submitting a small crafted XML document containing a malformed end tag. The SAX parser in lib/sax.js uses an unanchored global regex /[ \t\n\r]+$/g to trim end-tag names; a tag with N whitespace characters followed by one non-whitespace character causes the engine to retry the match from every character position with O(N) backtracking per position, yielding O(N²) total work that blocks the single-threaded event loop. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 4.0 score of 8.7 with VA:H and PR:N reflects the severity of unauthenticated, network-reachable availability impact.
Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The `@xmldom/xmldom` package before versions 0.8.15 and 0.9.12, and all versions of the legacy `xmldom` package (0.3.0-0.6.0), expose both paths through the default `DOMParser.parseFromString()` interface, requiring no authentication or special configuration. No public exploit has been identified at time of analysis, but the security advisories and fix commits are publicly available on GitHub.
Quadratic regex backtracking in @xmldom/xmldom versions 0.9.0-beta.9 through 0.9.10 allows unauthenticated remote attackers to stall the Node.js event loop by supplying a small malformed XML document containing an unterminated processing instruction with a long whitespace tail. The flaw resides in the processing-instruction production regex in lib/grammar.js, where the greedy S+ separator and lazy Char*? data group endlessly repartition whitespace when the required closing ?> is absent, causing O(n²) backtracking in both parsePI and parseProcessingInstruction. No public exploit has been identified at time of analysis, but the fix commit and GitHub Security Advisory GHSA-g53g-w8rj-fmg7 fully document the vulnerable code path, making independent reproduction straightforward. Vendor-released patch: 0.9.11.
Denial-of-service in a Rockwell Automation industrial module allows unauthenticated remote attackers to crash the device by sending a single crafted CIP (Common Industrial Protocol) packet, requiring a manual restart to restore availability. The vulnerability affects operational technology (OT) environments where CIP is network-accessible, making it particularly dangerous in industrial control system (ICS) contexts where device downtime can disrupt physical processes. No public exploit code has been identified at time of analysis, and Rockwell Automation has published advisory SD1798 addressing the issue.
Scheduler exhaustion in ash Framework (Elixir) versions 2.19.0 through 3.32.2 allows any workload triggering concurrent slow async read operations to pin BEAM scheduler threads at 100% CPU. The root cause is a busy-polling loop in Ash.Actions.Read.AsyncLimiter.await_at_least_one/1 that called Task.yield(task, 0) repeatedly with zero timeout rather than sleeping until a task completed, keeping the calling scheduler thread active throughout the wait. Multiple concurrent slow related-data loads or calculations compound the impact by saturating additional scheduler threads, potentially degrading or denying service to the entire Elixir node. No public exploit identified at time of analysis; vendor-released patch ash 3.32.2 resolves the issue.
Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's `maxTotalMergeKeys` safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (`<<`) processing is enabled by default on both release lines. No confirmed active exploitation appears in CISA KEV at time of analysis, but the attack is trivially reproducible from the published advisory and pathological test case, and the library's ubiquity in the npm ecosystem makes this a high-priority availability risk.
Heap-exhaustion denial-of-service in Hono web framework before 4.13.5 allows unauthenticated network attackers to crash the JavaScript server process by submitting form requests with deeply nested or numerous dot-separated field names when dot-notation parsing is explicitly enabled. The `parseBody()` function expands dot-separated keys into nested JavaScript objects without any bound on nesting depth or total intermediate object count, allowing a normal-sized request body to produce an object graph orders of magnitude larger and exhaust the runtime heap. Exploitation causes server process termination and service outage until manual restart; no public exploit is identified at time of analysis.
Denial-of-service in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator to interrupt service availability. The flaw requires high-complexity conditions (AV:N/AC:H/PR:L) and produces only limited availability impact, placing it at CVSS 3.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in HPE Networking Fabric Composer's web-based management interface can be triggered by an authenticated low-privilege operator, disrupting the availability of the management UI. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a low-severity, network-accessible flaw requiring valid credentials and user interaction, yielding only limited availability impact. No exploitation has been publicly demonstrated, and the vulnerability does not affect the underlying fabric infrastructure - only the management interface itself.
Memory exhaustion in gRPC-Go before version 1.83.1 allows an unauthenticated remote attacker to crash any service built on this library by sending HTTP/2 streams fragmented into millions of tiny one-byte DATA frames. Each fragment is stored as a separate recvMsg object in recvBuffer, creating severe heap overhead that bypasses HTTP/2 flow-control protections - which limit payload bytes, not the number of allocated metadata objects. No public exploit has been identified at time of analysis, but the attack is fully derivable from the public GitHub advisory and PR diff.
ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event loop by submitting a small crafted XML document containing a malformed end tag. The SAX parser in lib/sax.js uses an unanchored global regex /[ \t\n\r]+$/g to trim end-tag names; a tag with N whitespace characters followed by one non-whitespace character causes the engine to retry the match from every character position with O(N) backtracking per position, yielding O(N²) total work that blocks the single-threaded event loop. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 4.0 score of 8.7 with VA:H and PR:N reflects the severity of unauthenticated, network-reachable availability impact.
Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The `@xmldom/xmldom` package before versions 0.8.15 and 0.9.12, and all versions of the legacy `xmldom` package (0.3.0-0.6.0), expose both paths through the default `DOMParser.parseFromString()` interface, requiring no authentication or special configuration. No public exploit has been identified at time of analysis, but the security advisories and fix commits are publicly available on GitHub.
Quadratic regex backtracking in @xmldom/xmldom versions 0.9.0-beta.9 through 0.9.10 allows unauthenticated remote attackers to stall the Node.js event loop by supplying a small malformed XML document containing an unterminated processing instruction with a long whitespace tail. The flaw resides in the processing-instruction production regex in lib/grammar.js, where the greedy S+ separator and lazy Char*? data group endlessly repartition whitespace when the required closing ?> is absent, causing O(n²) backtracking in both parsePI and parseProcessingInstruction. No public exploit has been identified at time of analysis, but the fix commit and GitHub Security Advisory GHSA-g53g-w8rj-fmg7 fully document the vulnerable code path, making independent reproduction straightforward. Vendor-released patch: 0.9.11.
Denial-of-service in a Rockwell Automation industrial module allows unauthenticated remote attackers to crash the device by sending a single crafted CIP (Common Industrial Protocol) packet, requiring a manual restart to restore availability. The vulnerability affects operational technology (OT) environments where CIP is network-accessible, making it particularly dangerous in industrial control system (ICS) contexts where device downtime can disrupt physical processes. No public exploit code has been identified at time of analysis, and Rockwell Automation has published advisory SD1798 addressing the issue.
Scheduler exhaustion in ash Framework (Elixir) versions 2.19.0 through 3.32.2 allows any workload triggering concurrent slow async read operations to pin BEAM scheduler threads at 100% CPU. The root cause is a busy-polling loop in Ash.Actions.Read.AsyncLimiter.await_at_least_one/1 that called Task.yield(task, 0) repeatedly with zero timeout rather than sleeping until a task completed, keeping the calling scheduler thread active throughout the wait. Multiple concurrent slow related-data loads or calculations compound the impact by saturating additional scheduler threads, potentially degrading or denying service to the entire Elixir node. No public exploit identified at time of analysis; vendor-released patch ash 3.32.2 resolves the issue.