Monthly
Denial of service in pupnp (the portable UPnP SDK) versions prior to 2.0.2 allows unauthenticated remote attackers to exhaust process resources by sending HTTP messages that use Transfer-Encoding: chunked, which the internal parser decodes and buffers without ever enforcing the configured g_maxContentLength limit on the decoded entity. The flaw is reachable through default-enabled SOAP, GENA, miniserver, and control-point HTTP response paths, so any host that can reach a pupnp-based UPnP endpoint - commonly other devices on the same LAN segment - can trigger memory/resource exhaustion with no authentication or user interaction (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; the vendor has shipped a fix in release 2.0.2.
Remote unauthenticated denial of service in rust-libp2p Gossipsub affects versions prior to 0.49.5 and allows any peer that can reach a Gossipsub listener to repeatedly send novel GRAFT topic hashes. The handler unconditionally records those attacker-supplied topics in the per-peer connected_peer.topics map, so memory grows cumulatively without being bounded by subscription filters, peer scoring, or per-message size limits, eventually exhausting process memory and taking the node down. No public exploit identified at time of analysis; the issue is availability-only (CVSS 4.0 8.7 / assessed CVSS 3.1 7.5), and reachability of the Gossipsub listener is the practical prerequisite.
Remote unauthenticated requests to a network-reachable CSAF Provider instance can exhaust CPU resources through unbounded resource allocation, leading to a denial of service. The flaw (CWE-770) affects the gocsaf development community's CSAF Provider, with no specific version constraints identified in the CPE data (all versions appear affected). No public exploit code was identified at time of analysis and there is no CISA KEV entry, though the CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with no confidentiality or integrity loss.
Nezha monitoring dashboards running versions 1.0.0 through 2.3.14 can be knocked offline by an authenticated user who holds file-manager scope, because the dashboard's file manager WebSocket handler (fmStream) never imposes a read limit on incoming frames. A single oversized binary message sent to /api/v1/ws/file/:id is buffered whole by gorilla/websocket, exhausting process memory until the kernel OOM-killer terminates the dashboard - which in turn severs monitoring visibility for every agent the dashboard managed. There is no public exploit identified at time of analysis, but a vendor patch (2.3.15) and the upstream fixing commit are already public, so any dashboard exposed to users with file-manager permissions should be treated as a moderate-priority availability risk rather than a critical one; the attacked service is the dashboard itself, not the monitored endpoints.
Resource exhaustion in Nezha 2.0.13 through 2.3.14 allows an authenticated user to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint and hold thousands of ServerTransferClass.Subscribe subscriptions without limit, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections. Exploitation requires a valid authenticated dashboard session (CVSS vector includes PR:L), with no user interaction and no non-default configuration beyond a login-capable account; the impact is limited to availability of the dashboard and agent connectivity, and no public exploit has been identified at time of analysis. A vendor patch is available in Nezha 2.3.15 and later.
Unbounded resource allocation in ASP.NET Core - reachable through the System.Formats.Cbor component shipped with Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 - lets unauthenticated remote attackers exhaust server resources and cause a denial of service. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact), meaning any network-exposed service that actually parses attacker-supplied CBOR input through the vulnerable path can be driven into resource exhaustion without credentials or user interaction. Exploitation is bounded by reachability: deployments that never process untrusted external CBOR/network data, or that sit behind request-size limits, rate limiting, timeouts, or a WAF, have materially reduced exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available via the Microsoft Security Response Center advisory.
Unbounded response-header buffering in ReactPHP's HTTP client (react/http) versions 1.0.0 through 1.11.0 allows a malicious or compromised remote server to exhaust the PHP memory_limit of an application that uses React\Http\Browser to fetch attacker-influenced URLs. Because CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H rates this 7.5, the impact is availability-only (event-loop or worker process crash), with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. The vendor-released patch is version 1.11.1, which enforces a 65536-byte response-header cap and raises an OverflowException when exceeded.
Unbounded inbound memory retention in the Eclipse Vert.x MQTT client (io.vertx:vertx-mqtt) allows a malicious or compromised MQTT broker to drive the Vert.x process into memory exhaustion and eventual out-of-memory termination. Client-side applications embedded in Vert.x 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 that subscribe to QoS 2 (exactly-once) topics are affected; the attacker supplies QoS 2 PUBLISH packets with distinct packet identifiers and never sends the matching PUBREL, so each message is retained indefinitely in the client's internal qos2inbound map. The assessed vectors rate this AV:N/AC:H/PR:N with high availability impact only (no confidentiality or integrity impact), reflecting that exploitation requires the attacker to occupy the broker role rather than being an arbitrary remote peer; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and EPSS data was not provided. Note that the maxInflightQueue option does not mitigate this issue because it constrains only the outbound publish path.
Denial of service in the Eclipse Vert.x Redis client (io.vertx:vertx-redis-client) affects versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0: the RESP parser trusts a server-declared array, push, or attribute length and pre-allocates that many elements without an upper bound, so a crafted response triggers a massive heap allocation that terminates the Vert.x event-loop thread with OutOfMemoryError and denies service to every connection and verticle sharing that loop. Exploitation is conditional rather than opportunistic - a remote, unauthenticated attacker qualifies only if they control or have compromised the Redis server the client talks to, or if they can occupy a man-in-the-middle position on the client-to-Redis path; neither user interaction nor prior client authentication is required, which is why the assessed vector is AV:N/PR:N but AC:H, and impact is availability-only (no confidentiality or integrity loss). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a genuine but conditional DoS issue rather than a top-tier emergency.
Denial of service in Eclipse Vert.x HTTP proxy (io.vertx:vertx-http-proxy) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, allowing remote unauthenticated attackers to cause indefinite heap allocation. Exploitation requires the application to explicitly configure an intercepting body transformer-a non-default, developer-enabled feature-and the flaw lies in the transformer interceptor's reliance on a max buffered bytes limit that fails to keep per-request buffers bounded. No public exploit code has been identified at time of analysis; the CVSS 4.0 score is 8.7 with high availability impact.
Denial of service in pupnp (the portable UPnP SDK) versions prior to 2.0.2 allows unauthenticated remote attackers to exhaust process resources by sending HTTP messages that use Transfer-Encoding: chunked, which the internal parser decodes and buffers without ever enforcing the configured g_maxContentLength limit on the decoded entity. The flaw is reachable through default-enabled SOAP, GENA, miniserver, and control-point HTTP response paths, so any host that can reach a pupnp-based UPnP endpoint - commonly other devices on the same LAN segment - can trigger memory/resource exhaustion with no authentication or user interaction (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; the vendor has shipped a fix in release 2.0.2.
Remote unauthenticated denial of service in rust-libp2p Gossipsub affects versions prior to 0.49.5 and allows any peer that can reach a Gossipsub listener to repeatedly send novel GRAFT topic hashes. The handler unconditionally records those attacker-supplied topics in the per-peer connected_peer.topics map, so memory grows cumulatively without being bounded by subscription filters, peer scoring, or per-message size limits, eventually exhausting process memory and taking the node down. No public exploit identified at time of analysis; the issue is availability-only (CVSS 4.0 8.7 / assessed CVSS 3.1 7.5), and reachability of the Gossipsub listener is the practical prerequisite.
Remote unauthenticated requests to a network-reachable CSAF Provider instance can exhaust CPU resources through unbounded resource allocation, leading to a denial of service. The flaw (CWE-770) affects the gocsaf development community's CSAF Provider, with no specific version constraints identified in the CPE data (all versions appear affected). No public exploit code was identified at time of analysis and there is no CISA KEV entry, though the CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with no confidentiality or integrity loss.
Nezha monitoring dashboards running versions 1.0.0 through 2.3.14 can be knocked offline by an authenticated user who holds file-manager scope, because the dashboard's file manager WebSocket handler (fmStream) never imposes a read limit on incoming frames. A single oversized binary message sent to /api/v1/ws/file/:id is buffered whole by gorilla/websocket, exhausting process memory until the kernel OOM-killer terminates the dashboard - which in turn severs monitoring visibility for every agent the dashboard managed. There is no public exploit identified at time of analysis, but a vendor patch (2.3.15) and the upstream fixing commit are already public, so any dashboard exposed to users with file-manager permissions should be treated as a moderate-priority availability risk rather than a critical one; the attacked service is the dashboard itself, not the monitored endpoints.
Resource exhaustion in Nezha 2.0.13 through 2.3.14 allows an authenticated user to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint and hold thousands of ServerTransferClass.Subscribe subscriptions without limit, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections. Exploitation requires a valid authenticated dashboard session (CVSS vector includes PR:L), with no user interaction and no non-default configuration beyond a login-capable account; the impact is limited to availability of the dashboard and agent connectivity, and no public exploit has been identified at time of analysis. A vendor patch is available in Nezha 2.3.15 and later.
Unbounded resource allocation in ASP.NET Core - reachable through the System.Formats.Cbor component shipped with Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 - lets unauthenticated remote attackers exhaust server resources and cause a denial of service. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact), meaning any network-exposed service that actually parses attacker-supplied CBOR input through the vulnerable path can be driven into resource exhaustion without credentials or user interaction. Exploitation is bounded by reachability: deployments that never process untrusted external CBOR/network data, or that sit behind request-size limits, rate limiting, timeouts, or a WAF, have materially reduced exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available via the Microsoft Security Response Center advisory.
Unbounded response-header buffering in ReactPHP's HTTP client (react/http) versions 1.0.0 through 1.11.0 allows a malicious or compromised remote server to exhaust the PHP memory_limit of an application that uses React\Http\Browser to fetch attacker-influenced URLs. Because CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H rates this 7.5, the impact is availability-only (event-loop or worker process crash), with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. The vendor-released patch is version 1.11.1, which enforces a 65536-byte response-header cap and raises an OverflowException when exceeded.
Unbounded inbound memory retention in the Eclipse Vert.x MQTT client (io.vertx:vertx-mqtt) allows a malicious or compromised MQTT broker to drive the Vert.x process into memory exhaustion and eventual out-of-memory termination. Client-side applications embedded in Vert.x 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 that subscribe to QoS 2 (exactly-once) topics are affected; the attacker supplies QoS 2 PUBLISH packets with distinct packet identifiers and never sends the matching PUBREL, so each message is retained indefinitely in the client's internal qos2inbound map. The assessed vectors rate this AV:N/AC:H/PR:N with high availability impact only (no confidentiality or integrity impact), reflecting that exploitation requires the attacker to occupy the broker role rather than being an arbitrary remote peer; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and EPSS data was not provided. Note that the maxInflightQueue option does not mitigate this issue because it constrains only the outbound publish path.
Denial of service in the Eclipse Vert.x Redis client (io.vertx:vertx-redis-client) affects versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0: the RESP parser trusts a server-declared array, push, or attribute length and pre-allocates that many elements without an upper bound, so a crafted response triggers a massive heap allocation that terminates the Vert.x event-loop thread with OutOfMemoryError and denies service to every connection and verticle sharing that loop. Exploitation is conditional rather than opportunistic - a remote, unauthenticated attacker qualifies only if they control or have compromised the Redis server the client talks to, or if they can occupy a man-in-the-middle position on the client-to-Redis path; neither user interaction nor prior client authentication is required, which is why the assessed vector is AV:N/PR:N but AC:H, and impact is availability-only (no confidentiality or integrity loss). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a genuine but conditional DoS issue rather than a top-tier emergency.
Denial of service in Eclipse Vert.x HTTP proxy (io.vertx:vertx-http-proxy) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, allowing remote unauthenticated attackers to cause indefinite heap allocation. Exploitation requires the application to explicitly configure an intercepting body transformer-a non-default, developer-enabled feature-and the flaw lies in the transformer interceptor's reliance on a max buffered bytes limit that fails to keep per-request buffers bounded. No public exploit code has been identified at time of analysis; the CVSS 4.0 score is 8.7 with high availability impact.