Monthly
Local denial-of-service in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows a local attacker to exhaust system resources and render the platform unavailable, without requiring any credentials. The vulnerability stems from improper resource allocation controls (CWE-770), meaning the system places no effective cap on resource consumption triggered by local access. No public exploit has been identified at time of analysis, and a vendor patch is available via IBM's support portal.
Unbounded W3C tracestate parsing in the datadog-opentelemetry Rust crate (dd-trace-rs) allows remote unauthenticated attackers to exhaust CPU and memory on any instrumented service by sending HTTP requests with an arbitrarily large or pair-dense dd= vendor entry in the tracestate header. Affected versions 0.1.0 through 0.3.2 are exposed under default configuration because tracecontext extraction is enabled without any opt-in, making every internet-facing Rust service using Datadog APM a viable target. No active exploitation is confirmed (not in CISA KEV), but the zero-configuration attack surface and published advisory make this a prompt remediation priority for affected deployments.
Unauthenticated denial of service in Smush Image Compression and Optimization plugin (versions ≤ 4.2.0) allows any remote attacker to exhaust WordPress server resources without credentials or user interaction. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms trivial, unauthenticated network exploitation with high availability impact, making every site running an affected version an easy target for sustained disruption. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity means exploitation requires minimal skill.
Resource exhaustion in OWASP json-sanitizer v1.2.3 allows unauthenticated remote attackers to trigger a Denial of Service by supplying a crafted payload to the JsonSanitizer.sanitize() method. Any Java application that passes untrusted or externally supplied input through this library is affected, making the attack surface proportional to the library's adoption in internet-facing services. SSVC classifies this as automatable with no confirmed exploitation at time of analysis, and no public exploit code has been identified.
Denial of service in jwcrypto's JWE.deserialize() function allows a remote unauthenticated attacker to crash any service that processes untrusted JWE tokens by submitting a malformed compact serialization containing an excessive number of period delimiters, triggering uncontrolled memory allocation and a MemoryError. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 9 and 10, OpenShift AI (RHOAI), and OpenStack Platform 16.2 as disclosed via Red Hat Bugzilla 2524147 and upstream advisory GHSA-96rv-c4vc-h4f4. No public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to availability with no confidentiality or integrity exposure.
Spring Cloud Stream's dynamic destination cache lacks an upper bound on its size, exposing applications to limited information disclosure and integrity concerns under constrained conditions. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release lines, reported by VMware (Broadcom), the Spring project maintainer. No public exploit code exists and the vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 reflects the highly constrained exploitation prerequisites including high privilege requirements and user interaction.
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.
Pre-authentication denial-of-service in jahlives/openssl_encrypt before 1.4.9 allows unauthenticated network attackers to exhaust server memory and CPU by supplying crafted files with arbitrarily large key derivation function cost parameters, crashing or permanently wedging the process before any password verification occurs. The attack requires no credentials and no user interaction, making it trivially automatable against any service that accepts attacker-supplied encrypted files as input. No public exploit code has been identified at time of analysis, and the library's niche footprint limits broad internet exposure despite the low-complexity attack vector.
Unbounded memory exhaustion in Ruby's resolv gem (before 0.7.2) allows an attacker controlling DNS responses to permanently grow a target process's memory without limit, eventually crashing the service. The root cause is that Resolv::DNS::Resource.get_class and related methods register a new Ruby class as a constant for each unknown DNS resource record type/class pair encountered, preventing garbage collection for the lifetime of the process. Because resolv is a default Ruby gem requiring no installation step, any plain Ruby installation performing DNS resolution - web services, workers, CLI tools - is exposed without opt-in configuration, and no public exploit has been identified at time of analysis.
Denial of service in Spring Framework WebFlux applications (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8) occurs when the Aalto XML processor is used to parse request bodies, because the maxInMemorySize buffering limit is not correctly enforced. Remote attackers can submit oversized XML to trigger unbounded in-memory buffering and exhaust heap memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC lists exploitation status as none, though it rates the flaw automatable with total technical impact.
Local denial-of-service in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows a local attacker to exhaust system resources and render the platform unavailable, without requiring any credentials. The vulnerability stems from improper resource allocation controls (CWE-770), meaning the system places no effective cap on resource consumption triggered by local access. No public exploit has been identified at time of analysis, and a vendor patch is available via IBM's support portal.
Unbounded W3C tracestate parsing in the datadog-opentelemetry Rust crate (dd-trace-rs) allows remote unauthenticated attackers to exhaust CPU and memory on any instrumented service by sending HTTP requests with an arbitrarily large or pair-dense dd= vendor entry in the tracestate header. Affected versions 0.1.0 through 0.3.2 are exposed under default configuration because tracecontext extraction is enabled without any opt-in, making every internet-facing Rust service using Datadog APM a viable target. No active exploitation is confirmed (not in CISA KEV), but the zero-configuration attack surface and published advisory make this a prompt remediation priority for affected deployments.
Unauthenticated denial of service in Smush Image Compression and Optimization plugin (versions ≤ 4.2.0) allows any remote attacker to exhaust WordPress server resources without credentials or user interaction. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms trivial, unauthenticated network exploitation with high availability impact, making every site running an affected version an easy target for sustained disruption. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity means exploitation requires minimal skill.
Resource exhaustion in OWASP json-sanitizer v1.2.3 allows unauthenticated remote attackers to trigger a Denial of Service by supplying a crafted payload to the JsonSanitizer.sanitize() method. Any Java application that passes untrusted or externally supplied input through this library is affected, making the attack surface proportional to the library's adoption in internet-facing services. SSVC classifies this as automatable with no confirmed exploitation at time of analysis, and no public exploit code has been identified.
Denial of service in jwcrypto's JWE.deserialize() function allows a remote unauthenticated attacker to crash any service that processes untrusted JWE tokens by submitting a malformed compact serialization containing an excessive number of period delimiters, triggering uncontrolled memory allocation and a MemoryError. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 9 and 10, OpenShift AI (RHOAI), and OpenStack Platform 16.2 as disclosed via Red Hat Bugzilla 2524147 and upstream advisory GHSA-96rv-c4vc-h4f4. No public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to availability with no confidentiality or integrity exposure.
Spring Cloud Stream's dynamic destination cache lacks an upper bound on its size, exposing applications to limited information disclosure and integrity concerns under constrained conditions. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release lines, reported by VMware (Broadcom), the Spring project maintainer. No public exploit code exists and the vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 reflects the highly constrained exploitation prerequisites including high privilege requirements and user interaction.
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.
Pre-authentication denial-of-service in jahlives/openssl_encrypt before 1.4.9 allows unauthenticated network attackers to exhaust server memory and CPU by supplying crafted files with arbitrarily large key derivation function cost parameters, crashing or permanently wedging the process before any password verification occurs. The attack requires no credentials and no user interaction, making it trivially automatable against any service that accepts attacker-supplied encrypted files as input. No public exploit code has been identified at time of analysis, and the library's niche footprint limits broad internet exposure despite the low-complexity attack vector.
Unbounded memory exhaustion in Ruby's resolv gem (before 0.7.2) allows an attacker controlling DNS responses to permanently grow a target process's memory without limit, eventually crashing the service. The root cause is that Resolv::DNS::Resource.get_class and related methods register a new Ruby class as a constant for each unknown DNS resource record type/class pair encountered, preventing garbage collection for the lifetime of the process. Because resolv is a default Ruby gem requiring no installation step, any plain Ruby installation performing DNS resolution - web services, workers, CLI tools - is exposed without opt-in configuration, and no public exploit has been identified at time of analysis.
Denial of service in Spring Framework WebFlux applications (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8) occurs when the Aalto XML processor is used to parse request bodies, because the maxInMemorySize buffering limit is not correctly enforced. Remote attackers can submit oversized XML to trigger unbounded in-memory buffering and exhaust heap memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC lists exploitation status as none, though it rates the flaw automatable with total technical impact.