Denial Of Service
Monthly
Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's queue directory structure and halt all Wazuh services by registering an agent whose name begins with a dot (e.g., ".."). Two compounding weaknesses drive the impact: OS_IsValidName() failed to reject dot-prefixed agent names, and delete_diff() performs unsafe path concatenation that resolves the traversal sequence to the parent queue directory, wiping its subdirectories. Recovery requires manual intervention, creating a complete and sustained loss of SIEM and XDR visibility. No public exploit or CISA KEV listing has been identified at time of analysis.
Unbounded HTTP request payload processing in OpenSearch Dashboards' capabilities route handler allows unauthenticated remote attackers to exhaust server resources and cause a denial of service. Affected products span both self-hosted OpenSearch Dashboards (all versions per CPE) and Amazon OpenSearch Service. The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects low attack complexity and no authentication prerequisite, making any network-exposed instance potentially reachable. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Account takeover in authentik (goauthentik) identity provider before 2026.2.6 and 2026.5.5 allows an attacker holding an account on an upstream SAML identity provider to hijack a victim's authentik account. By injecting an XML comment into the SAML NameID (e.g. victim<!--x-->attacker), the value authentik reads for user matching is truncated to the text before the comment while the IdP's signed assertion still validates, because comment-excluding canonicalization (xml-exc-c14n) strips the comment before the signature digest is computed. This binds the attacker's external identity to the victim's existing account without the victim's password or the IdP private key, and the malicious link persists across future logins. No public exploit identified at time of analysis; the flaw is fixed upstream and demonstrated by regression tests in the vendor patch.
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through 7000T and beyond) to unauthenticated remote exploitation. The CWE-120 flaw in the RPC request handler allows an unauthenticated network attacker to achieve arbitrary command execution or denial of service against the NAS service. The CVSS 8.1 score is tempered by High Attack Complexity (AC:H), indicating exploitation requires non-trivial payload engineering rather than a simple spray-and-pray approach; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
Unbounded mutual recursion in the RabbitMQ Java client library (amqp-client <= 5.33.0) allows a malicious AMQP server or network intermediary to crash the client JVM before authentication completes. By sending approximately 580 levels of nested AMQP table structures within a single connection.start frame - well within the default 131,072-byte frame limit - an attacker triggers a StackOverflowError that kills the client's I/O processing thread, resulting in denial of service. No public exploit code has been published, but the GHSA advisory includes a precise technical breakdown and proof-of-concept payload specification, significantly lowering the bar for exploitation.
Memory exhaustion denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.33.0) allows a malicious AMQP peer to crash the client JVM by sending a LongString field with a wire-declared length near Integer.MAX_VALUE during the pre-authentication connection.start handshake. The ValueReader.readBytes() method allocates a byte array sized by the attacker-controlled wire value before validating it against actual frame data, causing a ~2 GB allocation and OutOfMemoryError that terminates the entire JVM process. No public exploit code has been identified at time of analysis, but the GHSA advisory discloses the exact vulnerable code path, the precise trigger value (0x7FFFFFFE), and the step-by-step attack scenario, making independent implementation trivial.
Resource exhaustion in Brainstorm Force SureForms before version 2.1.3 enables unauthenticated remote attackers to submit crafted form entries that exhaust server resources, block administrator access to the Entries interface, and trigger HTTP 500 errors sitewide. The root cause is CWE-400: the Entries component imposes no adequate limits on user-controlled field content during processing and rendering, making the attack low-complexity and fully automatable. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the barrier to exploitation, though no CISA KEV listing confirms mass active exploitation at time of analysis.
Integer overflow in Dragonfly's Count-Min Sketch implementation prior to v1.40.0 allows unauthenticated remote clients to corrupt adjacent heap memory, partially disclose heap contents, and crash the server. The flaw exists in src/core/cms.cc: CMS.INITBYDIM and CMS.INITBYPROB accept width/depth parameters whose product with sizeof(int64_t) overflows size_t, causing the allocator to receive a truncated length and produce an undersized buffer; CMS.INCRBY and CMS.QUERY then operate with the original large dimensions, writing and reading past the end of that buffer. No public exploit code has been identified at time of analysis, but the CVSS 4.0 vector confirms unauthenticated network exploitation with no preconditions, rating this 8.8.
Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute processing function, enabling remote unauthenticated attackers to exhaust server CPU with a compact, well-formed XML document. The flaw-closely related to CVE-2026-45186 fixed in Expat 2.8.1-requires no authentication, no external entity resolution, and no non-default parser options to trigger, and is significantly amplified when XML payloads are compression-wrapped. No public exploit code has been identified at time of analysis, but the attack algorithm is fully derivable from the public PR diff and vulnerability description, making independent weaponization low-effort.
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.
Denial-of-service in Mozilla Firefox's Widget component allows remote attackers to crash or hang the browser via specially crafted web content, exploiting uncontrolled resource consumption (CWE-400). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing patches across four security advisories (mfsa2026-74, -77, -78, -80). No public exploit has been identified and EPSS sits at the 5th percentile, indicating low real-world exploitation probability despite the high CVSS base score.
Uncontrolled recursion in docx4j-core's PropertyResolver crashes Java server-side applications that process untrusted DOCX files. The fillPPrStack method and adjacent style-resolution helpers traverse the OpenXML w:basedOn style inheritance chain without cycle detection, meaning a crafted DOCX with two mutually referencing styles triggers unbounded recursion and a java.lang.StackOverflowError, killing the processing thread. No public exploit identified at time of analysis, but the attack is trivially reproducible by editing OOXML XML internals, and the malicious document is a syntactically valid OOXML package that bypasses antivirus and content-inspection filters.
Remote denial-of-service in Apple iOS, iPadOS, and macOS Tahoe exploits a use-after-free memory corruption flaw, allowing an unauthenticated remote attacker to trigger unexpected system termination without user interaction. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, as confirmed by Apple security advisories. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible, zero-interaction attack surface presents a meaningful availability risk for all unpatched Apple devices.
Remote unauthenticated denial of service in ACME mini_httpd 1.30 and earlier is triggered by sending crafted HTTP requests that exploit a parsing flaw in the handle_request() function's header processing logic. The attack requires no authentication, no user interaction, and is classified as automatable by CISA's SSVC framework, meaning scripted mass-scanning for vulnerable instances is feasible. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been independently verified, though a researcher blog post linked in NVD references the vulnerability directly.
Prototype pollution in ApostropheCMS 4.32.0 and earlier enables an authenticated editor to trigger a persistent, process-wide denial of service via a single PATCH REST API request. By sending `{ "toString.call": "x" }` to `PATCH /api/v1/article/:id`, the attacker walks the JavaScript prototype chain through `apos.util.set()` into the shared `Object.prototype.toString` function object and shadows its `call` method, breaking every subsequent `Object.prototype.toString.call()` invocation in Node.js - including those inside the MongoDB driver - until the server process is manually restarted. No separate proof-of-concept repository has been published, but the exact attack payload is fully disclosed in the public GitHub security advisory GHSA-vmg4-6gfg-83qx and the upstream commit diff, and active exploitation has not been confirmed by CISA KEV.
Stack buffer overflow in COVESA Open1722 through version 0.9.2 enables unauthenticated remote attackers to corrupt stack memory and achieve arbitrary code execution or denial of service by sending a single crafted UDP datagram containing more than 15 ACF-CAN messages. The root cause is an unbounded write index in the avtp_to_can() function, which increments unconditionally past the end of a fixed 15-slot stack array without comparing against the caller-supplied size. Exploitation requires no authentication because the ACF-CAN listener accepts packets from any sender matching a hardcoded stream identifier transmitted in plaintext; no public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to drive a JVM into OutOfMemoryError by sending oversized, incomplete SCTP message fragments. The handler enforces limits on concurrent incomplete messages and per-message fragment counts - introduced as a fix for the prior CVE-2026-46340 - but omits a corresponding cap on total buffered bytes. With default settings of 128 messages and 128 fragments, an attacker can buffer approximately 1GB per connection; a small number of concurrent connections suffices to exhaust server heap. Vendor-released patches exist in versions 4.1.137.Final and 4.2.17.Final; no active exploitation or public POC has been identified at time of analysis.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.
Denial-of-service in vm2 (Node.js sandbox library) versions 3.11.0-3.11.5 allows sandbox code to bypass the `bufferAllocLimit` DoS mitigation via two unwrapped allocation paths - `Buffer.concat(list, totalLength)` and `Buffer.from({length: N})` - committing unbounded host external memory in a single synchronous C++ call that V8's timeout mechanism cannot interrupt. A publicly available PoC confirms that a 200-byte sandbox payload inflates host RSS by hundreds of megabytes per invocation, making a single crafted request sufficient to OOM-kill a host process running inside a Docker container, Kubernetes pod, or AWS Lambda function. No public exploit identified in CISA KEV at time of analysis, though functional exploit code is embedded in the GHSA advisory itself.
Quadratic CPU consumption in sqlparse's group_comments function (grouping.py) allows remote unauthenticated denial of service against any Python application that passes attacker-controlled input to sqlparse.parse() or sqlparse.format(sql, strip_comments=True). A comment-only payload of roughly 250 KB forces minutes of CPU burn regardless of the MAX_GROUPING_TOKENS guard, because group_comments executes before that cap is checked. A public proof-of-concept with benchmark data confirms O(n²) scaling: n=4000 comments takes ~1600 ms versus ~106 ms at n=1000; no public exploit identified at time of analysis beyond the researcher's PoC, and the vulnerability is not listed in CISA KEV.
Unauthenticated denial-of-service in New API (QuantumNous), an open-source LLM gateway and AI asset management platform, allows remote attackers to exhaust host memory and disk resources by sending arbitrarily large payloads to payment webhook endpoints before any signature validation occurs. The payment processing routes for Stripe, Creem, and Waffo read and fully log request bodies prior to any cryptographic verification, meaning no valid payment credential or forged signature is required to trigger sustained resource consumption. No public exploit code has been identified at time of analysis, but the attack is trivially automatable given the unauthenticated, network-accessible surface and low complexity; the vendor-released fix in v1.0.0-rc.11 enforces a configurable 512 KB body limit on all anonymous endpoints.
Stack exhaustion denial-of-service in deepmerge-ts crashes Node.js processes when attacker-controlled recursive object graphs are passed to `deepmerge()`, `deepmergeInto()`, `deepmergeCustom()()`, or `deepmergeIntoCustom()()`. All versions prior to 8.0.0 lack cycle detection in the recursive record-merge routine, allowing two self-referencing objects sharing a key path to drive the process into infinite recursion until the Node.js runtime throws `RangeError: Maximum call stack size exceeded`. A public proof-of-concept is included in the GitHub security advisory; no CISA KEV listing exists at time of analysis.
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate limiter is held in per-process in-memory state (a class-level defaultdict) rather than shared storage. In multi-worker or multi-instance deployments each worker enforces its own independent counters, and all lockout state evaporates on restart, so an attacker can parallelize or restart-reset their way through TOTP guesses. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; a vendor patch exists in 1.4.0.
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting process by submitting deeply nested template expressions to the recursive-descent parser. Because the ExpressionDepthLimit property in ParserOptions defaults to null (disabled), an attacker can supply thousands of nested parentheses or blocks that exhaust thread stack space, triggering a StackOverflowException - which .NET cannot intercept - causing immediate, unrecoverable process termination. A proof-of-concept is publicly documented in the vendor's GitHub Security Advisory GHSA-wgh7-7m3c-fx25; no authentication is required, and the fix is available in version 6.6.0.
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to bypass the LoopLimit safety control and exhaust CPU or memory on the host process. Versions 0 through 6.6.0 of the nuget/scriban and nuget/Scriban.Signed packages are affected; the root cause is that LoopLimit enforcement is coupled exclusively to script-level loop statements and is never invoked by built-in operators such as the range constructor or string multiplication. A working proof-of-concept is publicly available in the GitHub Security Advisory GHSA-c875-h985-hvrc, making exploitation trivially reproducible for any application that renders attacker-controlled templates; no public exploit identified at time of analysis for CISA KEV status.
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthenticated remote denial of service against any application that exposes Scriban to attacker-controlled template input. All NuGet releases of scriban and scriban.Signed prior to 7.0.0 are affected, with a publicly documented 39-byte proof-of-concept payload capable of forcing ~1GB synchronous allocations per request, crashing the host process via OutOfMemoryException. No active exploitation has been confirmed in CISA KEV at time of analysis, but the trivial PoC and zero-complexity attack lower the effective risk bar significantly for exposed deployments.
Denial of service in Scriban's .NET template engine (all versions before 7.0.0) allows low-privileged attackers who can supply templates to exhaust host application memory and crash the process. By rendering a string just under the 1MB LimitToString default inside a template loop, each iteration resets the per-call length counter in ObjectToString while the underlying StringBuilderOutput appends to a StringBuilder with no cumulative size guard - enabling ~1GB of allocation across 1,000 loop iterations. No public exploit tool has been separately released, but the GitHub security advisory (GHSA-m2p3-hwv5-xpqw) contains full source-level reproduction detail sufficient to implement the attack without further research.
Three distinct denial-of-service vulnerabilities in Scriban's expression evaluator (all versions before 7.0.0) allow any low-privileged attacker who can supply templates to exhaust host process memory or CPU, typically crashing the entire .NET application. The flaws are particularly deceptive because they bypass Scriban's own built-in safety controls - LimitToString and LoopLimit - through unbounded string multiplication, uncapped BigInteger left-shift operations, and lazy range enumeration passed to builtin functions, giving developers a false sense of protection. No public exploit has been identified at time of analysis, but the GHSA advisory provides full source-code-level disclosure of all three code paths with file and line references.
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the host process with a single template call. Affected are all releases of the nuget/scriban and nuget/Scriban.Signed packages up to and including version 7.1.0. By supplying a sufficiently large index parameter, an attacker triggers a tight C# fill loop that allocates hundreds of millions of null entries, causing an `OutOfMemoryException` that terminates the host process in under a second - bypassing all existing safety controls including `LoopLimit` and `LimitToString`. A public proof-of-concept template is documented in the vendor's GHSA advisory; no CISA KEV listing has been issued at the time of analysis.
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memory allocations using a ~40-byte template containing the array multiplication operator. The flaw is an overlooked sibling of operations hardened in prior releases: `string * integer` and `array.insert_at` received LoopLimit guards in versions 7.0.0 and 7.2.0, but `array * integer` in `ScriptArray<T>.TryEvaluate` was never subjected to those checks. The vendor-released fix is available in Scriban 7.2.1 and Scriban.Signed 7.2.1; no public exploit identified at time of analysis.
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CPU exhaustion and garbage collection collapse via crafted array-multiplication expressions. The ScriptArray.Multiply operator fails to credit iterations against the caller-configured LoopLimit, rendering the safety mechanism entirely ineffective on this code path - even LoopLimit=1 provides no protection against the bypass. Vendor patches are available as two upstream commits referenced in GitHub security advisory GHSA-89cf-6hmv-8rxm, with no active exploitation confirmed at time of analysis.
Memory exhaustion denial of service in stoatchat before 0.15.0 allows unauthenticated remote attackers to crash the service by submitting concurrent proxy requests referencing attacker-hosted SVGs with arbitrarily large viewBox width and height values. The proxy endpoint allocates memory proportional to declared SVG dimensions without enforcing any upper bound (CWE-400), and concurrent exploitation amplifies impact across all running replicas simultaneously. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the high availability impact with no confidentiality or integrity component.
Arbitrary file write in Pandora (pandora-analysis), an open-source file/malware analysis platform, arises from unsafe TAR extraction where archive member names were passed to Python's tarfile.extract() without a safety filter. An attacker who submits a crafted TAR containing ../ sequences or absolute paths can write files outside the intended extraction directory, potentially overwriting files owned by the Pandora worker and escalating to code execution or denial of service. No public exploit identified at time of analysis, though the upstream fix commit is public and the flaw is trivially reproducible.
Disk exhaustion via orphaned temporary files in @fastify/multipart versions 3.0.0 through 10.1.0 allows unauthenticated remote clients to cause persistent denial of service against Fastify applications that use the `request.saveRequestFiles()` API. The defect is an incomplete fix of CVE-2025-24033: while the per-file cleanup path was previously patched, the iterator rejection raised between multipart parts falls outside that cleanup scope, leaving already-completed temporary files permanently on disk. Repeated client disconnections mid-upload cause linear, unbounded disk consumption that can exhaust storage and render the host or container unavailable. No public exploit identified at time of analysis, but the attack is trivially automatable given the unauthenticated, low-complexity network vector.
Uncontrolled resource consumption in @fastify/multipart (versions 5.3.0 through 10.1.0) allows any unauthenticated remote client to permanently leak temporary files on disk and suspend Fastify request handler executions, ultimately exhausting both disk space and the Node.js event loop. The root defect is a state-management flaw: when busboy's fileSize limit truncates an incoming file part, the plugin prematurely clears its internal stream reference, so a subsequent client-initiated abort finds nothing to clean up, leaving saveRequestFiles() awaiting a settlement that never arrives. No public exploit code has been identified at the time of analysis, but the attack is trivially repeatable with standard HTTP tooling, making this a realistic denial-of-service risk for any service that accepts multipart file uploads from untrusted clients.
Local privilege-escalation/denial-of-service via a use-after-free in the Linux kernel's KVM x86 I/O APIC emulation (CVE-2026-74517): during VM teardown the delayed I/O APIC EOI work (kvm_ioapic_eoi_inject_work) can execute after the target vCPUs are freed, causing __kvm_irq_delivery_to_apic_fast to read freed slab memory. Any local principal able to create and run a KVM guest can race VM destruction against a pending delayed EOI to corrupt host kernel memory. EPSS is low (0.15%, 5th percentile) and the issue is not on CISA KEV; no public exploit is identified, and the reporter/tags frame the practical impact as denial of service.
Use-After-Free in the Linux kernel's mm/page_reporting subsystem triggers a General Protection Fault during PM suspend and hibernation on systems running virtio_balloon with page reporting enabled. When the PM freezer initiates a suspend or S4 hibernation cycle, the virtio_balloon driver tears down its virtqueues via del_vqs(), but page_reporting_process - scheduled on the non-freezable system_wq workqueue - remains active. If the buddy allocator frees pages during this window (e.g., the balloon shrinker runs during S4 image saving), the reporting worker calls virtballoon_free_page_report() on already-deleted virtqueues, causing kernel memory corruption. No public exploit has been identified at time of analysis; EPSS is 0.18% (8th percentile), reflecting minimal exploitation probability, though this is a confirmed kernel UAF with crash-level impact validated by Google in production virtualization infrastructure.
Denial-of-service (kernel crash) in the Linux kernel's veth driver affects hosts running an XDP program with AF_XDP sockets in copy mode bound to a virtual ethernet interface. When a frag_list skb (data_len set, nr_frags zero) reaches veth_convert_skb_to_xdp_buff(), the driver advertises XDP fragment metadata for a non-existent frags[] array, causing __xsk_rcv() to walk an empty fragment and crash inside memcpy(). NVD rates it CVSS 9.1, though the underlying tags and code path point to availability impact (crash) rather than the confidentiality loss the vector claims; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.
NULL pointer dereference and use-after-free in the Linux kernel i2c-imx driver (NXP i.MX SoC family) allows a local attacker or concurrent kernel path to trigger kernel memory corruption during I2C slave unregistration. The race condition in i2c_imx_unreg_slave() permits a pending hrtimer callback to fire after the slave pointer has been cleared, causing i2c_imx_slave_finish_op() to dereference a NULL pointer with potential for privilege escalation or system crash. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) confirms low exploitation likelihood, though the CVSS base score of 8.4 reflects high potential impact if triggered.
Unbounded locale cache growth in Apache Struts allows unauthenticated remote attackers to exhaust JVM heap memory and deny service to all users of the application. The vulnerability spans an exceptionally wide version range - from 2.0.0 through 7.2.1 across four release branches - and is exploitable only when no fixed locale is configured, a condition common in multilingual deployments. No public exploit has been identified at time of analysis, and EPSS at 0.19% (9th percentile) reflects low observed exploitation activity; however, the network vector with zero prerequisites on vulnerable configurations makes this a meaningful DoS risk in exposed environments.
Unbounded memory consumption in Apache Struts allows a single unauthenticated HTTP request to exhaust JVM heap and deny service to all concurrent users on applications that expose a Content Security Policy violation report collection endpoint. Affected versions span the 6.0.0-6.10.0 and 7.0.0-7.2.1 release branches; applications that have not implemented a custom CSP report endpoint are unaffected regardless of Struts version. No public exploit code has been identified and EPSS places current exploitation probability at 0.23% (14th percentile), though the trivial, unauthenticated attack path means any exposed endpoint represents a reliable, low-effort denial-of-service target.
NULL pointer dereference in the Linux kernel netfilter nft_fib subsystem crashes the kernel when a FIB expression is placed in a netdev egress base chain, enabling denial of service against any system carrying that configuration. The root cause is a hook namespace collision where NF_NETDEV_EGRESS aliases NF_INET_LOCAL_IN numerically, causing nft_fib_validate() to incorrectly approve egress chain placement and then dereference nft_in(pkt) - which is NULL on the transmit path. No public exploit exists and EPSS is 0.21% (11th percentile), but systems running custom nftables egress FIB rules are at immediate kernel crash risk until patched.
Null pointer dereference in the Linux kernel's netfilter SIP connection tracking helper (nf_conntrack_sip) can crash the kernel when the non-default sip_external_media=1 module parameter is active and SIP traffic traverses tc ingress or OpenVSwitch paths. Successful exploitation causes a complete availability loss (kernel panic/crash), satisfying the CVSS A:H rating. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low observed exploitation activity despite the high base score.
Denial of service in the Linux kernel netfilter flowtable subsystem allows a crash in the tunnel transmit path when IPIP tunnel offload is combined with a direct-xmit device such as a bridge. Because no dst_entry is supplied, the code performs invalid dst usage while checking skb headroom and setting iph->frag_off, leading to a kernel crash. Rated CVSS 9.8 by automated scoring, but vendor tags classify it as Denial Of Service; EPSS is 0.20% (10th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Out-of-bounds kernel write in the Linux kernel's ntfs3 filesystem driver allows a local attacker to corrupt kernel memory and panic the system by mounting a crafted NTFS image and performing a single directory operation. The flaw lives in indx_insert_into_buffer(), where an unvalidated split-point size from hdr_find_split() causes a u32 subtraction underflow and a near-4-GiB memmove. A vendor fix is available across multiple stable branches; EPSS is low (0.21%) and no public exploit is identified at time of analysis, though the trigger is trivial (a 'touch' on a mounted attacker-supplied image).
Uninitialized struct page corruption in the Linux kernel's ZONE_DEVICE memory subsystem exposes systems with DAX/persistent memory hotplug to kernel memory corruption. When DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap while compound_nr_pages() incorrectly assumes vmemmap optimization is active, initializing fewer struct pages than the memory region actually contains. The resulting uninitialized tail struct pages can cause crashes or, under adverse conditions, kernel memory corruption with high confidentiality, integrity, and availability impact per the CVSS 7.8 rating. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile).
NULL pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel, causing a denial of service. The flaw exists in rxrpc_verify_data(), which skips allocating the rx_dec_buffer when the associated skb private length is zero, while its caller rxrpc_recvmsg_data() unconditionally assumes the buffer is populated after a successful return. A crafted RxRPC network packet with zero-length payload data can trigger this path, passing a NULL pointer to skb_copy_bits() and causing a kernel panic. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is very low at 0.16% (5th percentile), consistent with a niche kernel subsystem.
Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. No public exploit exists and EPSS sits at 0.15% (5th percentile), signaling negligible real-world exploitation probability; this is not listed in CISA KEV.
Kernel soft lockup and system panic in the Linux rtw89 Wi-Fi driver affects systems with Realtek RTW89 802.11ax chipsets during 6GHz band scanning. The root cause is an integer truncation bug where the loop counter variable `i` is silently narrowed to 8 bits via a `movzbl %bl, %eax` instruction; when `req->n_6ghz_params` exceeds 255, the counter wraps to zero and the loop never terminates, trapping the CPU for 26+ seconds until the watchdog fires and triggers a kernel panic. No public exploit identified at time of analysis, and EPSS of 0.17% at the 6th percentile reflects low exploitation probability despite the provided CVSS score of 8.8.
Kernel panic via NULL pointer dereference in the Linux kernel's ath11k PCI WiFi driver affects systems running kernel versions from 5.19 through pre-7.1.5/7.2-rc1 with Qualcomm PCI-attached WiFi chipsets such as WCN6855. The race condition occurs when a system reboot overlaps with WLAN firmware crash recovery (Subsystem Reset, SSR), causing the MHI teardown path and SSR recovery path to simultaneously attempt to deinitialize MHI and free DMA-backed contexts, resulting in a double-free scenario and kernel crash. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with an accidental-trigger vulnerability rather than a targeted attack vector.
Use-after-free in Linux kernel's configfs_lookup() allows a local low-privilege attacker to trigger kernel memory corruption via a dangling pointer in configfs_dirent->s_dentry. When inode allocation fails during a directory lookup, the code drops the configfs_dirent reference but neglects to clear ->s_dentry, leaving it pointing at a dentry object that is subsequently freed; a follow-on getdents(2) call in the same directory dereferences that stale pointer to read the inode number, producing the UAF condition. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (7th percentile), but the defect has been latent since Linux 2.6.16 in 2006, meaning a vast range of unpatched production kernels carries the flaw.
Out-of-bounds kernel memory access in the Linux kernel vhost/vdpa subsystem allows a local attacker with low privileges to crash the system or trigger invalid physical memory mappings via crafted mmap operations. The vhost_vdpa_mmap() and vhost_vdpa_fault() functions accept a user-controlled virtqueue index from vma->vm_pgoff without validating it against the driver's configured queue count (v->nvqs), while the ioctl path already enforces both a bounds check and array_index_nospec(). Patches are available across all active stable branches; EPSS is 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV.
Guest kernel crash in the Linux virtio RTC driver occurs during device restore when stale virtqueues are not cleaned up before reinitialization. Systems running virtual machines with a virtio-rtc device exposed are affected across Linux kernel versions up to 6.18.40 and 7.1.5 stable series. A local low-privileged user on the guest who triggers a suspend/resume cycle under conditions where virtqueue reinitialization fails can dereference a NULL info pointer in vp_del_vq(), panicking the guest kernel. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms exploitation is not currently widespread.
Memory corruption in the Linux kernel's bnxt (Broadcom NetXtreme) Ethernet driver arises when an XDP program grows the packet head, causing a head-pointer underflow in bnxt_rx_multi_page_skb that drops a page-pool fragment reference on the wrong page or fragment. This corrupts page-pool refcounts, allowing a page to be recycled while still in use and producing a double free on driver teardown, which realistically manifests as a kernel crash or memory corruption on hosts using Broadcom bnxt NICs with native XDP. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS is low at 0.15% (5th percentile).
Refcount tracking race in the Linux kernel's network watchdog subsystem enables a local low-privilege user to crash the kernel via list corruption. The flaw originates from a commit that introduced `dev->watchdog_dev_tracker` to store reference tracking state without adding synchronization between `netdev_watchdog_up()` and the `dev_watchdog()` timer, allowing the pointer to be concurrently overwritten or freed. The observable outcome is a `list_del` corruption BUG followed by a kernel Oops, confirmed by syzbot; no public exploit exists and the vulnerability is not in CISA KEV, with EPSS at 0.20% (10th percentile). Patches are available in stable kernel releases.
NULL pointer dereference in the Linux kernel's TCP/IPv6 stack crashes the kernel when a system with a large-MTU interface processes oversized TCP segments whose GSO size collides with the GSO_BY_FRAGS magic value (0xFFFF). Systems running Linux kernel from commit 3953c46c onwards with jumbo-frame or high-MTU IPv6 interfaces are affected across multiple stable branches up to and including 7.1.4. A remote, unauthenticated attacker capable of establishing a TCP/IPv6 session with a vulnerable host can induce a kernel panic, causing a full denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.21%, 12th percentile).
Out-of-bounds memory access in the Linux kernel PCI ROM parsing subsystem crashes or leaks kernel memory on both x86_64 and arm64 architectures. The `pci_get_rom_size()` function fails to validate ROM image header and PCI data structure pointer bounds before dereferencing them, allowing a crafted or malformed PCI ROM space to induce a kernel page fault (x86_64) or alignment fault (arm64). Any local actor able to trigger a PCI ROM sysfs read against a device with a broken ROM region can crash the kernel (DoS) or expose kernel memory contents (information disclosure). EPSS is 0.21% with no KEV listing, indicating no confirmed broad exploitation, though the local crash path is straightforwardly reproducible as demonstrated by stress-ng.
Use-after-free in the Linux kernel dmaengine subsystem allows a local low-privileged attacker to corrupt kernel memory or crash the system by racing DMA channel release against DMA provider device teardown. The flaw exists in `dma_release_channel()` across kernels from 2.6.30 through multiple active stable branches, with patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit has been identified at time of analysis, and the EPSS probability of 0.22% (13th percentile) indicates very low near-term exploitation likelihood despite the High CVSS score.
Use-after-free and kernel crash exposure in the Linux kernel's MIPI I3C HCI driver stems from a locking gap between the IRQ handler and the bus device list. The `i3c_hci_addr_to_dev()` function traverses the bus device list from interrupt context without holding `bus.lock`, while concurrent I3C core operations can mutate that list under the lock - creating a window where the IRQ handler dereferences stale or freed device pointers. No public exploit code exists and EPSS sits at 0.16%, but exploitation on a system with I3C HCI hardware and active device hotplug could yield privilege escalation or a kernel panic.
Denial-of-service (and potential use-after-free) in the Linux kernel's xfrm/IPsec state-cache logic lets a stale state be inserted into the input-path cache because the state's validity is checked before the global xfrm_state_lock is taken. In the window between the check and the lock, a concurrent operation can kill the state, so a dead (freed-path) state gets cached and later dereferenced on the IPsec input path. Despite an auto-generated 9.8 CVSS, real-world signals are modest: EPSS is 0.21% (11th percentile), the issue is tagged Denial of Service, it is not in CISA KEV, and no public exploit was identified at time of analysis.
Use-after-free in the Linux kernel's TIPC UDP media bearer teardown path allows a local low-privileged user to trigger a kernel memory corruption by racing bearer cleanup against concurrent UDP transmission or reception. The function cleanup_bearer() calls dst_cache_destroy() - which immediately frees per-CPU cache memory - before calling synchronize_net() to drain RCU readers, leaving concurrent tipc_udp_xmit() and tipc_udp_recv() callers able to dereference freed memory. The fix is available in stable commits and kernel 7.1.5; no public exploit has been identified at time of analysis, and EPSS at the 10th percentile reflects the niche exploitability profile.
Denial-of-service in the Linux kernel's AFS (Andrew File System) client allows a remote attacker to crash the kernel by triggering a NULL pointer dereference in `afs_break_some_callbacks()`. The flaw exists because `afs_lookup_volume_rcu()` can return NULL when a referenced volume is unknown, and this return value is used without a NULL check. No public exploit code exists and EPSS sits at 0.21%, though the official CVSS scores it 7.5 (High) due to a network attack vector with no authentication required.
Kernel crash via bad memory access in the mlx5e traffic control peer flow cleanup path affects Linux systems running Mellanox/NVIDIA mlx5 NICs in LAG (Link Aggregation Group) mode. When mlx5_lag_get_dev_seq() returns an error during device teardown - because the peer is absent from the LAG or no master device is marked - the driver proceeds to dereference an invalid pointer in mlx5e_tc_del_fdb_peers_flow, causing a kernel panic. No public exploit exists and EPSS is 0.20% (10th percentile), but the crash is deterministically reproducible on affected hardware configurations during device removal or driver teardown sequences.
Memory corruption in the Linux kernel qede network driver (QLogic/Marvell FastLinQ 40/100GbE) arises because qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(), consuming an extra buffer descriptor and desynchronizing the RX BD ring. The resulting off-by-one can corrupt DMA page reference counts and trigger SLUB freelist corruption, most plausibly a kernel-crash denial of service rather than reliable code execution. No public exploit has been identified and it is not in CISA KEV; the low EPSS (0.22%, 13th percentile) reflects that the bug only manifests under kernel memory pressure.
Denial-of-service in the Linux kernel's IFE (Inter-Forwarding-Element) traffic-control action allows a crafted, malformed IFE frame to crash the host, because ife_decode() only guaranteed the outer IFE header was pullable before handing the decapsulated packet to eth_type_trans(), which then reads an inner Ethernet header that may be shorter than ETH_HLEN in the linear skb area. Only systems that have the tc act_ife action configured are exposed. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV; the fix adds ETH_HLEN to the pull check.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK (pre-shared key) is absent, enabling remote unauthenticated attackers to flood the notification queue and inject path traversal characters into outbound Clair API URL paths. The primary impact is worker resource exhaustion leading to denial of service, with a secondary low-integrity impact from blind path manipulation against the configured Clair vulnerability scanner host. No public exploit identified at time of analysis, and EPSS of 0.26% (17th percentile) indicates low current exploitation probability.
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to crash the service, resulting in a complete loss of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable over the network without credentials or user interaction, making it trivially reachable in any internet- or network-exposed deployment. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity elevates practical risk.
Unprivileged user-mode threads in Zephyr RTOS can crash the kernel or disclose arbitrary kernel memory by exploiting a missing validation step in the logging subsystem's syscall verifier, directly violating the user/kernel isolation boundary that CONFIG_USERSPACE is designed to enforce. Any Zephyr build compiled with CONFIG_USERSPACE=y is affected, as the __syscall-decorated z_log_msg_static_create() function accepted fully attacker-controlled pointer and length arguments without any K_SYSCALL_* bounds checking in its verifier function z_vrfy_z_log_msg_static_create(). No public exploit identified at time of analysis; an upstream fix has been committed to zephyrproject-rtos/zephyr and documented in GitHub Security Advisory GHSA-h7rf-g9mg-g23f.
Memory exhaustion via crafted VP8L images affects golang.org/x/image/vp8l in all versions before 0.45.0, enabling remote unauthenticated attackers to crash Go applications that process untrusted image content through this library. The VP8L decoder fails to bound heap allocation when decoding images that declare many unused Huffman tree groups, turning a parsing decision into unconstrained memory growth. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial network attack vector and zero-privilege requirement make this a practical DoS risk for any internet-facing service accepting image uploads.
Race condition exploitation in KUNBUS piControl 2.6.2 allows a local authenticated attacker to corrupt kernel memory by issuing concurrent crafted requests through the piControl character device, triggering use-after-free and invalid pointer dereferences in kernel configuration objects. The flaw resides in the configuration and process-image management subsystem of this industrial Revolution Pi (RevPi) controller platform component, with potential impact spanning confidentiality, integrity, and availability per the CVSS 4.0 vector, though denial of service is the explicitly confirmed outcome. No public exploit code and no active exploitation have been identified at time of analysis; this was responsibly disclosed by Nozomi Networks Labs.
Kernel memory corruption in KUNBUS piControl version 2.6.2 allows a local authenticated attacker with device configuration access to write beyond process-image buffer boundaries, corrupting adjacent kernel memory and causing denial of service. The vulnerability resides in process-image management functionality and is triggered by supplying crafted device configuration data and crafted input through the piControl character device. No public exploit code or active exploitation has been confirmed at time of analysis, though the industrial OT context and kernel-level impact elevate operational priority for RevPi deployments.
Heap exhaustion via unbounded JSON body reading in the Apache Struts JSON plugin allows unauthenticated remote attackers to deny service by sending a single oversized HTTP request to any endpoint where request-body-to-action population is enabled. Affected version ranges span the 2.x, 6.x, and 7.x release lines. No public exploit code has been identified at time of analysis and SSVC signals no active exploitation, but the attack is rated automatable, meaning scripted large-scale scanning and denial-of-service campaigns are feasible against exposed endpoints.
FileBrowser versions before 2.63.19 fail to enforce the TUS Upload-Length boundary in the PATCH resumable-upload endpoint, enabling authenticated users to stream arbitrarily large request bodies directly to disk regardless of the length declared at upload creation. The root cause, confirmed by the patch diff, is an unbounded io.Copy call that passed r.Body directly to the target file without capping reads to the remaining declared bytes. No public exploit has been identified at time of analysis, and exploitation requires a valid low-privilege account, but the impact - full disk exhaustion causing service unavailability - can be triggered with a single crafted PATCH request.
Remote denial of service via stack-based buffer overflow affects IBM i versions 7.3 through 7.6, allowing unauthenticated network attackers to crash an affected service without any user interaction or elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is straightforward from the network with no special conditions, making this a reliable availability threat against exposed IBM i systems. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the vendor has released a patch via the IBM support portal.
Out-of-bounds write (CWE-787) in IBM i versions 7.3 through 7.6 enables remote unauthenticated attackers to crash affected systems and cause denial of service. The CVSS 3.1 base score of 8.6 is backed by a network-reachable, zero-prerequisite attack vector spanning all four currently supported IBM i release lines, making the exposed attack surface broad. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available and should be applied promptly given the unauthenticated network vector.
Resource exhaustion in Go's net/http package allows unauthenticated remote attackers to indefinitely hold server connections open when cleartext HTTP/2 (h2c) is enabled, causing denial of service. The root cause is that ReadHeaderTimeout - the safeguard meant to prevent slow-connection abuse - is not enforced during the HTTP/2 client preface detection phase unique to h2c. Affected deployments include Go net/http servers built with Go versions prior to 1.25.13, 1.26.6, or 1.27.0-rc.3; no public exploit has been identified and CISA KEV does not list this vulnerability.
Uncontrolled CPU exhaustion in Go's standard-library crypto/tls package allows remote unauthenticated attackers to send an unbounded stream of TLS 1.3 KeyUpdate messages, forcing the server to perform continuous HKDF key derivation operations and causing a denial of service. Affected versions span Go crypto/tls prior to 1.25.13, 1.26.6, and 1.27.0-rc.3 across all three active release branches. No public exploit has been identified and EPSS stands at a low 0.18%, but the zero-authentication network attack surface makes this trivially reachable against any internet-exposed Go TLS server without any special preconditions.
Stack exhaustion in Go's encoding/asn1 standard library package allows any caller of Unmarshal to crash the Go process by supplying a deeply-nested, recursive ASN.1 structure that exceeds the goroutine stack limit. Applications that parse ASN.1 data from untrusted sources - including TLS certificate validation, PKCS message handling, LDAP clients, SNMP agents, and custom cryptographic protocol implementations - are directly at risk of denial of service. No public exploit code has been identified at time of analysis; vendor-released patches are available in Go 1.26.6 and Go 1.25.13.
Stack exhaustion in Go's standard library encoding/xml package exposes any Go application parsing untrusted XML to remote denial of service. The DecodeElement function incorrectly resets an internal recursion depth counter on each invocation, neutralizing the depth-limit guard that exists to prevent unbounded stack growth from deeply nested XML documents. Unauthenticated remote attackers can trigger goroutine stack exhaustion and crash the affected process with no authentication required. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS is 0.18% (8th percentile), reflecting low near-term exploitation probability despite the straightforward attack primitive.
Denial of service via buffer overflow in IBM i 7.3 through 7.6 exposes all supported release lines of IBM's midrange operating system to remote disruption. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that an unauthenticated remote attacker can trigger the flaw with low complexity and no user interaction, resulting in high availability impact and limited integrity impact - consistent with an out-of-bounds write that can crash or destabilize a targeted component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
IBM i 7.6 exposes a remotely exploitable denial-of-service condition via an out-of-bounds write (CWE-787) that can be triggered by an unauthenticated remote attacker over the network without user interaction. The vulnerability produces high availability impact with no confidentiality or integrity consequence, consistent with a crash or resource exhaustion outcome rather than code execution. No public exploit or active exploitation has been identified at time of analysis; a vendor patch has been released.
Denial of service affecting IBM i versions 7.3 through 7.6 stems from uninitialized memory consumption during ASN.1 length processing, reachable by remote unauthenticated attackers over a network path without user interaction. The vendor CVSS vector rates C:H/I:H/A:H despite the public description referencing only a DoS outcome, a discrepancy suggesting the vulnerability's full potential may extend to memory disclosure or integrity impacts - reviewers should consult IBM Support advisory 7283573 to resolve this conflict before prioritizing response. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the high-complexity network attack vector means adversaries with specific knowledge of the target's ASN.1 service exposure remain a realistic threat to unpatched systems.
Information disclosure and denial of service in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 lets a remote unauthenticated attacker trigger a stack-based buffer overflow, potentially reading sensitive memory contents and crashing the affected service. IBM (the reporter) has released a patch, and no public exploit has been identified at time of analysis. Despite a CVSS of 9.1, the EPSS probability is low (0.25%, 17th percentile) and CISA SSVC records no known exploitation.
Prototype pollution in Trigger.dev's run metadata API (versions 3.3.8 through 4.5.5) lets any authenticated tenant corrupt the shared Node.js webapp process's Object.prototype by supplying crafted path keys to the PUT /api/v1/runs/:runId/metadata endpoint. The root cause is the unsanitized use of attacker-supplied operation.key values passed directly to JSONHeroPath.set() in packages/core/src/v3/runMetadata/operations.ts without filtering __proto__, constructor, or prototype segments. A single exploiting tenant can corrupt Prisma ORM queries, poison Prometheus metric labels, break other tenants' worker authentication, and cause a process-wide denial of service - making this a multi-tenant isolation failure with scope-changed impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to crash or hang affected systems by triggering an infinite loop condition (CWE-835) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and minimal complexity, making automated exploitation straightforward. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Denial of service in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to exhaust system resources through unbounded resource allocation, rendering the platform unavailable to legitimate users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction, with low attack complexity over the network. No public exploit code and no CISA KEV entry have been identified at the time of analysis; a vendor patch is available.
Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker via a CWE-835 infinite loop condition. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication and no user interaction against affected systems. No public exploit code or active exploitation confirmed at time of analysis; IBM has released a patch.
Heap buffer overflow in IBM i 7.3 through 7.6 enables remote, unauthenticated attackers to crash affected systems via a network-reachable code path, resulting in a complete denial of availability. The vulnerability is rooted in CWE-787 (out-of-bounds write) and carries a CVSS 3.1 base score of 7.5 (High) with a fully unauthenticated network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch through its support portal.
Unauthenticated remote exploitation of a buffer overflow in IBM i 7.3 through 7.6 allows attackers to cause denial of service and modify authentication metadata without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially reachable exploitation over the network against default-accessible services. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's queue directory structure and halt all Wazuh services by registering an agent whose name begins with a dot (e.g., ".."). Two compounding weaknesses drive the impact: OS_IsValidName() failed to reject dot-prefixed agent names, and delete_diff() performs unsafe path concatenation that resolves the traversal sequence to the parent queue directory, wiping its subdirectories. Recovery requires manual intervention, creating a complete and sustained loss of SIEM and XDR visibility. No public exploit or CISA KEV listing has been identified at time of analysis.
Unbounded HTTP request payload processing in OpenSearch Dashboards' capabilities route handler allows unauthenticated remote attackers to exhaust server resources and cause a denial of service. Affected products span both self-hosted OpenSearch Dashboards (all versions per CPE) and Amazon OpenSearch Service. The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects low attack complexity and no authentication prerequisite, making any network-exposed instance potentially reachable. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Account takeover in authentik (goauthentik) identity provider before 2026.2.6 and 2026.5.5 allows an attacker holding an account on an upstream SAML identity provider to hijack a victim's authentik account. By injecting an XML comment into the SAML NameID (e.g. victim<!--x-->attacker), the value authentik reads for user matching is truncated to the text before the comment while the IdP's signed assertion still validates, because comment-excluding canonicalization (xml-exc-c14n) strips the comment before the signature digest is computed. This binds the attacker's external identity to the victim's existing account without the victim's password or the IdP private key, and the malicious link persists across future logins. No public exploit identified at time of analysis; the flaw is fixed upstream and demonstrated by regression tests in the vendor patch.
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through 7000T and beyond) to unauthenticated remote exploitation. The CWE-120 flaw in the RPC request handler allows an unauthenticated network attacker to achieve arbitrary command execution or denial of service against the NAS service. The CVSS 8.1 score is tempered by High Attack Complexity (AC:H), indicating exploitation requires non-trivial payload engineering rather than a simple spray-and-pray approach; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
Unbounded mutual recursion in the RabbitMQ Java client library (amqp-client <= 5.33.0) allows a malicious AMQP server or network intermediary to crash the client JVM before authentication completes. By sending approximately 580 levels of nested AMQP table structures within a single connection.start frame - well within the default 131,072-byte frame limit - an attacker triggers a StackOverflowError that kills the client's I/O processing thread, resulting in denial of service. No public exploit code has been published, but the GHSA advisory includes a precise technical breakdown and proof-of-concept payload specification, significantly lowering the bar for exploitation.
Memory exhaustion denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.33.0) allows a malicious AMQP peer to crash the client JVM by sending a LongString field with a wire-declared length near Integer.MAX_VALUE during the pre-authentication connection.start handshake. The ValueReader.readBytes() method allocates a byte array sized by the attacker-controlled wire value before validating it against actual frame data, causing a ~2 GB allocation and OutOfMemoryError that terminates the entire JVM process. No public exploit code has been identified at time of analysis, but the GHSA advisory discloses the exact vulnerable code path, the precise trigger value (0x7FFFFFFE), and the step-by-step attack scenario, making independent implementation trivial.
Resource exhaustion in Brainstorm Force SureForms before version 2.1.3 enables unauthenticated remote attackers to submit crafted form entries that exhaust server resources, block administrator access to the Entries interface, and trigger HTTP 500 errors sitewide. The root cause is CWE-400: the Entries component imposes no adequate limits on user-controlled field content during processing and rendering, making the attack low-complexity and fully automatable. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the barrier to exploitation, though no CISA KEV listing confirms mass active exploitation at time of analysis.
Integer overflow in Dragonfly's Count-Min Sketch implementation prior to v1.40.0 allows unauthenticated remote clients to corrupt adjacent heap memory, partially disclose heap contents, and crash the server. The flaw exists in src/core/cms.cc: CMS.INITBYDIM and CMS.INITBYPROB accept width/depth parameters whose product with sizeof(int64_t) overflows size_t, causing the allocator to receive a truncated length and produce an undersized buffer; CMS.INCRBY and CMS.QUERY then operate with the original large dimensions, writing and reading past the end of that buffer. No public exploit code has been identified at time of analysis, but the CVSS 4.0 vector confirms unauthenticated network exploitation with no preconditions, rating this 8.8.
Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute processing function, enabling remote unauthenticated attackers to exhaust server CPU with a compact, well-formed XML document. The flaw-closely related to CVE-2026-45186 fixed in Expat 2.8.1-requires no authentication, no external entity resolution, and no non-default parser options to trigger, and is significantly amplified when XML payloads are compression-wrapped. No public exploit code has been identified at time of analysis, but the attack algorithm is fully derivable from the public PR diff and vulnerability description, making independent weaponization low-effort.
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.
Denial-of-service in Mozilla Firefox's Widget component allows remote attackers to crash or hang the browser via specially crafted web content, exploiting uncontrolled resource consumption (CWE-400). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing patches across four security advisories (mfsa2026-74, -77, -78, -80). No public exploit has been identified and EPSS sits at the 5th percentile, indicating low real-world exploitation probability despite the high CVSS base score.
Uncontrolled recursion in docx4j-core's PropertyResolver crashes Java server-side applications that process untrusted DOCX files. The fillPPrStack method and adjacent style-resolution helpers traverse the OpenXML w:basedOn style inheritance chain without cycle detection, meaning a crafted DOCX with two mutually referencing styles triggers unbounded recursion and a java.lang.StackOverflowError, killing the processing thread. No public exploit identified at time of analysis, but the attack is trivially reproducible by editing OOXML XML internals, and the malicious document is a syntactically valid OOXML package that bypasses antivirus and content-inspection filters.
Remote denial-of-service in Apple iOS, iPadOS, and macOS Tahoe exploits a use-after-free memory corruption flaw, allowing an unauthenticated remote attacker to trigger unexpected system termination without user interaction. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, as confirmed by Apple security advisories. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible, zero-interaction attack surface presents a meaningful availability risk for all unpatched Apple devices.
Remote unauthenticated denial of service in ACME mini_httpd 1.30 and earlier is triggered by sending crafted HTTP requests that exploit a parsing flaw in the handle_request() function's header processing logic. The attack requires no authentication, no user interaction, and is classified as automatable by CISA's SSVC framework, meaning scripted mass-scanning for vulnerable instances is feasible. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been independently verified, though a researcher blog post linked in NVD references the vulnerability directly.
Prototype pollution in ApostropheCMS 4.32.0 and earlier enables an authenticated editor to trigger a persistent, process-wide denial of service via a single PATCH REST API request. By sending `{ "toString.call": "x" }` to `PATCH /api/v1/article/:id`, the attacker walks the JavaScript prototype chain through `apos.util.set()` into the shared `Object.prototype.toString` function object and shadows its `call` method, breaking every subsequent `Object.prototype.toString.call()` invocation in Node.js - including those inside the MongoDB driver - until the server process is manually restarted. No separate proof-of-concept repository has been published, but the exact attack payload is fully disclosed in the public GitHub security advisory GHSA-vmg4-6gfg-83qx and the upstream commit diff, and active exploitation has not been confirmed by CISA KEV.
Stack buffer overflow in COVESA Open1722 through version 0.9.2 enables unauthenticated remote attackers to corrupt stack memory and achieve arbitrary code execution or denial of service by sending a single crafted UDP datagram containing more than 15 ACF-CAN messages. The root cause is an unbounded write index in the avtp_to_can() function, which increments unconditionally past the end of a fixed 15-slot stack array without comparing against the caller-supplied size. Exploitation requires no authentication because the ACF-CAN listener accepts packets from any sender matching a hardcoded stream identifier transmitted in plaintext; no public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to drive a JVM into OutOfMemoryError by sending oversized, incomplete SCTP message fragments. The handler enforces limits on concurrent incomplete messages and per-message fragment counts - introduced as a fix for the prior CVE-2026-46340 - but omits a corresponding cap on total buffered bytes. With default settings of 128 messages and 128 fragments, an attacker can buffer approximately 1GB per connection; a small number of concurrent connections suffices to exhaust server heap. Vendor-released patches exist in versions 4.1.137.Final and 4.2.17.Final; no active exploitation or public POC has been identified at time of analysis.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.
Denial-of-service in vm2 (Node.js sandbox library) versions 3.11.0-3.11.5 allows sandbox code to bypass the `bufferAllocLimit` DoS mitigation via two unwrapped allocation paths - `Buffer.concat(list, totalLength)` and `Buffer.from({length: N})` - committing unbounded host external memory in a single synchronous C++ call that V8's timeout mechanism cannot interrupt. A publicly available PoC confirms that a 200-byte sandbox payload inflates host RSS by hundreds of megabytes per invocation, making a single crafted request sufficient to OOM-kill a host process running inside a Docker container, Kubernetes pod, or AWS Lambda function. No public exploit identified in CISA KEV at time of analysis, though functional exploit code is embedded in the GHSA advisory itself.
Quadratic CPU consumption in sqlparse's group_comments function (grouping.py) allows remote unauthenticated denial of service against any Python application that passes attacker-controlled input to sqlparse.parse() or sqlparse.format(sql, strip_comments=True). A comment-only payload of roughly 250 KB forces minutes of CPU burn regardless of the MAX_GROUPING_TOKENS guard, because group_comments executes before that cap is checked. A public proof-of-concept with benchmark data confirms O(n²) scaling: n=4000 comments takes ~1600 ms versus ~106 ms at n=1000; no public exploit identified at time of analysis beyond the researcher's PoC, and the vulnerability is not listed in CISA KEV.
Unauthenticated denial-of-service in New API (QuantumNous), an open-source LLM gateway and AI asset management platform, allows remote attackers to exhaust host memory and disk resources by sending arbitrarily large payloads to payment webhook endpoints before any signature validation occurs. The payment processing routes for Stripe, Creem, and Waffo read and fully log request bodies prior to any cryptographic verification, meaning no valid payment credential or forged signature is required to trigger sustained resource consumption. No public exploit code has been identified at time of analysis, but the attack is trivially automatable given the unauthenticated, network-accessible surface and low complexity; the vendor-released fix in v1.0.0-rc.11 enforces a configurable 512 KB body limit on all anonymous endpoints.
Stack exhaustion denial-of-service in deepmerge-ts crashes Node.js processes when attacker-controlled recursive object graphs are passed to `deepmerge()`, `deepmergeInto()`, `deepmergeCustom()()`, or `deepmergeIntoCustom()()`. All versions prior to 8.0.0 lack cycle detection in the recursive record-merge routine, allowing two self-referencing objects sharing a key path to drive the process into infinite recursion until the Node.js runtime throws `RangeError: Maximum call stack size exceeded`. A public proof-of-concept is included in the GitHub security advisory; no CISA KEV listing exists at time of analysis.
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate limiter is held in per-process in-memory state (a class-level defaultdict) rather than shared storage. In multi-worker or multi-instance deployments each worker enforces its own independent counters, and all lockout state evaporates on restart, so an attacker can parallelize or restart-reset their way through TOTP guesses. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; a vendor patch exists in 1.4.0.
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting process by submitting deeply nested template expressions to the recursive-descent parser. Because the ExpressionDepthLimit property in ParserOptions defaults to null (disabled), an attacker can supply thousands of nested parentheses or blocks that exhaust thread stack space, triggering a StackOverflowException - which .NET cannot intercept - causing immediate, unrecoverable process termination. A proof-of-concept is publicly documented in the vendor's GitHub Security Advisory GHSA-wgh7-7m3c-fx25; no authentication is required, and the fix is available in version 6.6.0.
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to bypass the LoopLimit safety control and exhaust CPU or memory on the host process. Versions 0 through 6.6.0 of the nuget/scriban and nuget/Scriban.Signed packages are affected; the root cause is that LoopLimit enforcement is coupled exclusively to script-level loop statements and is never invoked by built-in operators such as the range constructor or string multiplication. A working proof-of-concept is publicly available in the GitHub Security Advisory GHSA-c875-h985-hvrc, making exploitation trivially reproducible for any application that renders attacker-controlled templates; no public exploit identified at time of analysis for CISA KEV status.
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthenticated remote denial of service against any application that exposes Scriban to attacker-controlled template input. All NuGet releases of scriban and scriban.Signed prior to 7.0.0 are affected, with a publicly documented 39-byte proof-of-concept payload capable of forcing ~1GB synchronous allocations per request, crashing the host process via OutOfMemoryException. No active exploitation has been confirmed in CISA KEV at time of analysis, but the trivial PoC and zero-complexity attack lower the effective risk bar significantly for exposed deployments.
Denial of service in Scriban's .NET template engine (all versions before 7.0.0) allows low-privileged attackers who can supply templates to exhaust host application memory and crash the process. By rendering a string just under the 1MB LimitToString default inside a template loop, each iteration resets the per-call length counter in ObjectToString while the underlying StringBuilderOutput appends to a StringBuilder with no cumulative size guard - enabling ~1GB of allocation across 1,000 loop iterations. No public exploit tool has been separately released, but the GitHub security advisory (GHSA-m2p3-hwv5-xpqw) contains full source-level reproduction detail sufficient to implement the attack without further research.
Three distinct denial-of-service vulnerabilities in Scriban's expression evaluator (all versions before 7.0.0) allow any low-privileged attacker who can supply templates to exhaust host process memory or CPU, typically crashing the entire .NET application. The flaws are particularly deceptive because they bypass Scriban's own built-in safety controls - LimitToString and LoopLimit - through unbounded string multiplication, uncapped BigInteger left-shift operations, and lazy range enumeration passed to builtin functions, giving developers a false sense of protection. No public exploit has been identified at time of analysis, but the GHSA advisory provides full source-code-level disclosure of all three code paths with file and line references.
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the host process with a single template call. Affected are all releases of the nuget/scriban and nuget/Scriban.Signed packages up to and including version 7.1.0. By supplying a sufficiently large index parameter, an attacker triggers a tight C# fill loop that allocates hundreds of millions of null entries, causing an `OutOfMemoryException` that terminates the host process in under a second - bypassing all existing safety controls including `LoopLimit` and `LimitToString`. A public proof-of-concept template is documented in the vendor's GHSA advisory; no CISA KEV listing has been issued at the time of analysis.
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memory allocations using a ~40-byte template containing the array multiplication operator. The flaw is an overlooked sibling of operations hardened in prior releases: `string * integer` and `array.insert_at` received LoopLimit guards in versions 7.0.0 and 7.2.0, but `array * integer` in `ScriptArray<T>.TryEvaluate` was never subjected to those checks. The vendor-released fix is available in Scriban 7.2.1 and Scriban.Signed 7.2.1; no public exploit identified at time of analysis.
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CPU exhaustion and garbage collection collapse via crafted array-multiplication expressions. The ScriptArray.Multiply operator fails to credit iterations against the caller-configured LoopLimit, rendering the safety mechanism entirely ineffective on this code path - even LoopLimit=1 provides no protection against the bypass. Vendor patches are available as two upstream commits referenced in GitHub security advisory GHSA-89cf-6hmv-8rxm, with no active exploitation confirmed at time of analysis.
Memory exhaustion denial of service in stoatchat before 0.15.0 allows unauthenticated remote attackers to crash the service by submitting concurrent proxy requests referencing attacker-hosted SVGs with arbitrarily large viewBox width and height values. The proxy endpoint allocates memory proportional to declared SVG dimensions without enforcing any upper bound (CWE-400), and concurrent exploitation amplifies impact across all running replicas simultaneously. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the high availability impact with no confidentiality or integrity component.
Arbitrary file write in Pandora (pandora-analysis), an open-source file/malware analysis platform, arises from unsafe TAR extraction where archive member names were passed to Python's tarfile.extract() without a safety filter. An attacker who submits a crafted TAR containing ../ sequences or absolute paths can write files outside the intended extraction directory, potentially overwriting files owned by the Pandora worker and escalating to code execution or denial of service. No public exploit identified at time of analysis, though the upstream fix commit is public and the flaw is trivially reproducible.
Disk exhaustion via orphaned temporary files in @fastify/multipart versions 3.0.0 through 10.1.0 allows unauthenticated remote clients to cause persistent denial of service against Fastify applications that use the `request.saveRequestFiles()` API. The defect is an incomplete fix of CVE-2025-24033: while the per-file cleanup path was previously patched, the iterator rejection raised between multipart parts falls outside that cleanup scope, leaving already-completed temporary files permanently on disk. Repeated client disconnections mid-upload cause linear, unbounded disk consumption that can exhaust storage and render the host or container unavailable. No public exploit identified at time of analysis, but the attack is trivially automatable given the unauthenticated, low-complexity network vector.
Uncontrolled resource consumption in @fastify/multipart (versions 5.3.0 through 10.1.0) allows any unauthenticated remote client to permanently leak temporary files on disk and suspend Fastify request handler executions, ultimately exhausting both disk space and the Node.js event loop. The root defect is a state-management flaw: when busboy's fileSize limit truncates an incoming file part, the plugin prematurely clears its internal stream reference, so a subsequent client-initiated abort finds nothing to clean up, leaving saveRequestFiles() awaiting a settlement that never arrives. No public exploit code has been identified at the time of analysis, but the attack is trivially repeatable with standard HTTP tooling, making this a realistic denial-of-service risk for any service that accepts multipart file uploads from untrusted clients.
Local privilege-escalation/denial-of-service via a use-after-free in the Linux kernel's KVM x86 I/O APIC emulation (CVE-2026-74517): during VM teardown the delayed I/O APIC EOI work (kvm_ioapic_eoi_inject_work) can execute after the target vCPUs are freed, causing __kvm_irq_delivery_to_apic_fast to read freed slab memory. Any local principal able to create and run a KVM guest can race VM destruction against a pending delayed EOI to corrupt host kernel memory. EPSS is low (0.15%, 5th percentile) and the issue is not on CISA KEV; no public exploit is identified, and the reporter/tags frame the practical impact as denial of service.
Use-After-Free in the Linux kernel's mm/page_reporting subsystem triggers a General Protection Fault during PM suspend and hibernation on systems running virtio_balloon with page reporting enabled. When the PM freezer initiates a suspend or S4 hibernation cycle, the virtio_balloon driver tears down its virtqueues via del_vqs(), but page_reporting_process - scheduled on the non-freezable system_wq workqueue - remains active. If the buddy allocator frees pages during this window (e.g., the balloon shrinker runs during S4 image saving), the reporting worker calls virtballoon_free_page_report() on already-deleted virtqueues, causing kernel memory corruption. No public exploit has been identified at time of analysis; EPSS is 0.18% (8th percentile), reflecting minimal exploitation probability, though this is a confirmed kernel UAF with crash-level impact validated by Google in production virtualization infrastructure.
Denial-of-service (kernel crash) in the Linux kernel's veth driver affects hosts running an XDP program with AF_XDP sockets in copy mode bound to a virtual ethernet interface. When a frag_list skb (data_len set, nr_frags zero) reaches veth_convert_skb_to_xdp_buff(), the driver advertises XDP fragment metadata for a non-existent frags[] array, causing __xsk_rcv() to walk an empty fragment and crash inside memcpy(). NVD rates it CVSS 9.1, though the underlying tags and code path point to availability impact (crash) rather than the confidentiality loss the vector claims; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.
NULL pointer dereference and use-after-free in the Linux kernel i2c-imx driver (NXP i.MX SoC family) allows a local attacker or concurrent kernel path to trigger kernel memory corruption during I2C slave unregistration. The race condition in i2c_imx_unreg_slave() permits a pending hrtimer callback to fire after the slave pointer has been cleared, causing i2c_imx_slave_finish_op() to dereference a NULL pointer with potential for privilege escalation or system crash. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) confirms low exploitation likelihood, though the CVSS base score of 8.4 reflects high potential impact if triggered.
Unbounded locale cache growth in Apache Struts allows unauthenticated remote attackers to exhaust JVM heap memory and deny service to all users of the application. The vulnerability spans an exceptionally wide version range - from 2.0.0 through 7.2.1 across four release branches - and is exploitable only when no fixed locale is configured, a condition common in multilingual deployments. No public exploit has been identified at time of analysis, and EPSS at 0.19% (9th percentile) reflects low observed exploitation activity; however, the network vector with zero prerequisites on vulnerable configurations makes this a meaningful DoS risk in exposed environments.
Unbounded memory consumption in Apache Struts allows a single unauthenticated HTTP request to exhaust JVM heap and deny service to all concurrent users on applications that expose a Content Security Policy violation report collection endpoint. Affected versions span the 6.0.0-6.10.0 and 7.0.0-7.2.1 release branches; applications that have not implemented a custom CSP report endpoint are unaffected regardless of Struts version. No public exploit code has been identified and EPSS places current exploitation probability at 0.23% (14th percentile), though the trivial, unauthenticated attack path means any exposed endpoint represents a reliable, low-effort denial-of-service target.
NULL pointer dereference in the Linux kernel netfilter nft_fib subsystem crashes the kernel when a FIB expression is placed in a netdev egress base chain, enabling denial of service against any system carrying that configuration. The root cause is a hook namespace collision where NF_NETDEV_EGRESS aliases NF_INET_LOCAL_IN numerically, causing nft_fib_validate() to incorrectly approve egress chain placement and then dereference nft_in(pkt) - which is NULL on the transmit path. No public exploit exists and EPSS is 0.21% (11th percentile), but systems running custom nftables egress FIB rules are at immediate kernel crash risk until patched.
Null pointer dereference in the Linux kernel's netfilter SIP connection tracking helper (nf_conntrack_sip) can crash the kernel when the non-default sip_external_media=1 module parameter is active and SIP traffic traverses tc ingress or OpenVSwitch paths. Successful exploitation causes a complete availability loss (kernel panic/crash), satisfying the CVSS A:H rating. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low observed exploitation activity despite the high base score.
Denial of service in the Linux kernel netfilter flowtable subsystem allows a crash in the tunnel transmit path when IPIP tunnel offload is combined with a direct-xmit device such as a bridge. Because no dst_entry is supplied, the code performs invalid dst usage while checking skb headroom and setting iph->frag_off, leading to a kernel crash. Rated CVSS 9.8 by automated scoring, but vendor tags classify it as Denial Of Service; EPSS is 0.20% (10th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Out-of-bounds kernel write in the Linux kernel's ntfs3 filesystem driver allows a local attacker to corrupt kernel memory and panic the system by mounting a crafted NTFS image and performing a single directory operation. The flaw lives in indx_insert_into_buffer(), where an unvalidated split-point size from hdr_find_split() causes a u32 subtraction underflow and a near-4-GiB memmove. A vendor fix is available across multiple stable branches; EPSS is low (0.21%) and no public exploit is identified at time of analysis, though the trigger is trivial (a 'touch' on a mounted attacker-supplied image).
Uninitialized struct page corruption in the Linux kernel's ZONE_DEVICE memory subsystem exposes systems with DAX/persistent memory hotplug to kernel memory corruption. When DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap while compound_nr_pages() incorrectly assumes vmemmap optimization is active, initializing fewer struct pages than the memory region actually contains. The resulting uninitialized tail struct pages can cause crashes or, under adverse conditions, kernel memory corruption with high confidentiality, integrity, and availability impact per the CVSS 7.8 rating. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile).
NULL pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel, causing a denial of service. The flaw exists in rxrpc_verify_data(), which skips allocating the rx_dec_buffer when the associated skb private length is zero, while its caller rxrpc_recvmsg_data() unconditionally assumes the buffer is populated after a successful return. A crafted RxRPC network packet with zero-length payload data can trigger this path, passing a NULL pointer to skb_copy_bits() and causing a kernel panic. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is very low at 0.16% (5th percentile), consistent with a niche kernel subsystem.
Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. No public exploit exists and EPSS sits at 0.15% (5th percentile), signaling negligible real-world exploitation probability; this is not listed in CISA KEV.
Kernel soft lockup and system panic in the Linux rtw89 Wi-Fi driver affects systems with Realtek RTW89 802.11ax chipsets during 6GHz band scanning. The root cause is an integer truncation bug where the loop counter variable `i` is silently narrowed to 8 bits via a `movzbl %bl, %eax` instruction; when `req->n_6ghz_params` exceeds 255, the counter wraps to zero and the loop never terminates, trapping the CPU for 26+ seconds until the watchdog fires and triggers a kernel panic. No public exploit identified at time of analysis, and EPSS of 0.17% at the 6th percentile reflects low exploitation probability despite the provided CVSS score of 8.8.
Kernel panic via NULL pointer dereference in the Linux kernel's ath11k PCI WiFi driver affects systems running kernel versions from 5.19 through pre-7.1.5/7.2-rc1 with Qualcomm PCI-attached WiFi chipsets such as WCN6855. The race condition occurs when a system reboot overlaps with WLAN firmware crash recovery (Subsystem Reset, SSR), causing the MHI teardown path and SSR recovery path to simultaneously attempt to deinitialize MHI and free DMA-backed contexts, resulting in a double-free scenario and kernel crash. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with an accidental-trigger vulnerability rather than a targeted attack vector.
Use-after-free in Linux kernel's configfs_lookup() allows a local low-privilege attacker to trigger kernel memory corruption via a dangling pointer in configfs_dirent->s_dentry. When inode allocation fails during a directory lookup, the code drops the configfs_dirent reference but neglects to clear ->s_dentry, leaving it pointing at a dentry object that is subsequently freed; a follow-on getdents(2) call in the same directory dereferences that stale pointer to read the inode number, producing the UAF condition. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (7th percentile), but the defect has been latent since Linux 2.6.16 in 2006, meaning a vast range of unpatched production kernels carries the flaw.
Out-of-bounds kernel memory access in the Linux kernel vhost/vdpa subsystem allows a local attacker with low privileges to crash the system or trigger invalid physical memory mappings via crafted mmap operations. The vhost_vdpa_mmap() and vhost_vdpa_fault() functions accept a user-controlled virtqueue index from vma->vm_pgoff without validating it against the driver's configured queue count (v->nvqs), while the ioctl path already enforces both a bounds check and array_index_nospec(). Patches are available across all active stable branches; EPSS is 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV.
Guest kernel crash in the Linux virtio RTC driver occurs during device restore when stale virtqueues are not cleaned up before reinitialization. Systems running virtual machines with a virtio-rtc device exposed are affected across Linux kernel versions up to 6.18.40 and 7.1.5 stable series. A local low-privileged user on the guest who triggers a suspend/resume cycle under conditions where virtqueue reinitialization fails can dereference a NULL info pointer in vp_del_vq(), panicking the guest kernel. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms exploitation is not currently widespread.
Memory corruption in the Linux kernel's bnxt (Broadcom NetXtreme) Ethernet driver arises when an XDP program grows the packet head, causing a head-pointer underflow in bnxt_rx_multi_page_skb that drops a page-pool fragment reference on the wrong page or fragment. This corrupts page-pool refcounts, allowing a page to be recycled while still in use and producing a double free on driver teardown, which realistically manifests as a kernel crash or memory corruption on hosts using Broadcom bnxt NICs with native XDP. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS is low at 0.15% (5th percentile).
Refcount tracking race in the Linux kernel's network watchdog subsystem enables a local low-privilege user to crash the kernel via list corruption. The flaw originates from a commit that introduced `dev->watchdog_dev_tracker` to store reference tracking state without adding synchronization between `netdev_watchdog_up()` and the `dev_watchdog()` timer, allowing the pointer to be concurrently overwritten or freed. The observable outcome is a `list_del` corruption BUG followed by a kernel Oops, confirmed by syzbot; no public exploit exists and the vulnerability is not in CISA KEV, with EPSS at 0.20% (10th percentile). Patches are available in stable kernel releases.
NULL pointer dereference in the Linux kernel's TCP/IPv6 stack crashes the kernel when a system with a large-MTU interface processes oversized TCP segments whose GSO size collides with the GSO_BY_FRAGS magic value (0xFFFF). Systems running Linux kernel from commit 3953c46c onwards with jumbo-frame or high-MTU IPv6 interfaces are affected across multiple stable branches up to and including 7.1.4. A remote, unauthenticated attacker capable of establishing a TCP/IPv6 session with a vulnerable host can induce a kernel panic, causing a full denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.21%, 12th percentile).
Out-of-bounds memory access in the Linux kernel PCI ROM parsing subsystem crashes or leaks kernel memory on both x86_64 and arm64 architectures. The `pci_get_rom_size()` function fails to validate ROM image header and PCI data structure pointer bounds before dereferencing them, allowing a crafted or malformed PCI ROM space to induce a kernel page fault (x86_64) or alignment fault (arm64). Any local actor able to trigger a PCI ROM sysfs read against a device with a broken ROM region can crash the kernel (DoS) or expose kernel memory contents (information disclosure). EPSS is 0.21% with no KEV listing, indicating no confirmed broad exploitation, though the local crash path is straightforwardly reproducible as demonstrated by stress-ng.
Use-after-free in the Linux kernel dmaengine subsystem allows a local low-privileged attacker to corrupt kernel memory or crash the system by racing DMA channel release against DMA provider device teardown. The flaw exists in `dma_release_channel()` across kernels from 2.6.30 through multiple active stable branches, with patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit has been identified at time of analysis, and the EPSS probability of 0.22% (13th percentile) indicates very low near-term exploitation likelihood despite the High CVSS score.
Use-after-free and kernel crash exposure in the Linux kernel's MIPI I3C HCI driver stems from a locking gap between the IRQ handler and the bus device list. The `i3c_hci_addr_to_dev()` function traverses the bus device list from interrupt context without holding `bus.lock`, while concurrent I3C core operations can mutate that list under the lock - creating a window where the IRQ handler dereferences stale or freed device pointers. No public exploit code exists and EPSS sits at 0.16%, but exploitation on a system with I3C HCI hardware and active device hotplug could yield privilege escalation or a kernel panic.
Denial-of-service (and potential use-after-free) in the Linux kernel's xfrm/IPsec state-cache logic lets a stale state be inserted into the input-path cache because the state's validity is checked before the global xfrm_state_lock is taken. In the window between the check and the lock, a concurrent operation can kill the state, so a dead (freed-path) state gets cached and later dereferenced on the IPsec input path. Despite an auto-generated 9.8 CVSS, real-world signals are modest: EPSS is 0.21% (11th percentile), the issue is tagged Denial of Service, it is not in CISA KEV, and no public exploit was identified at time of analysis.
Use-after-free in the Linux kernel's TIPC UDP media bearer teardown path allows a local low-privileged user to trigger a kernel memory corruption by racing bearer cleanup against concurrent UDP transmission or reception. The function cleanup_bearer() calls dst_cache_destroy() - which immediately frees per-CPU cache memory - before calling synchronize_net() to drain RCU readers, leaving concurrent tipc_udp_xmit() and tipc_udp_recv() callers able to dereference freed memory. The fix is available in stable commits and kernel 7.1.5; no public exploit has been identified at time of analysis, and EPSS at the 10th percentile reflects the niche exploitability profile.
Denial-of-service in the Linux kernel's AFS (Andrew File System) client allows a remote attacker to crash the kernel by triggering a NULL pointer dereference in `afs_break_some_callbacks()`. The flaw exists because `afs_lookup_volume_rcu()` can return NULL when a referenced volume is unknown, and this return value is used without a NULL check. No public exploit code exists and EPSS sits at 0.21%, though the official CVSS scores it 7.5 (High) due to a network attack vector with no authentication required.
Kernel crash via bad memory access in the mlx5e traffic control peer flow cleanup path affects Linux systems running Mellanox/NVIDIA mlx5 NICs in LAG (Link Aggregation Group) mode. When mlx5_lag_get_dev_seq() returns an error during device teardown - because the peer is absent from the LAG or no master device is marked - the driver proceeds to dereference an invalid pointer in mlx5e_tc_del_fdb_peers_flow, causing a kernel panic. No public exploit exists and EPSS is 0.20% (10th percentile), but the crash is deterministically reproducible on affected hardware configurations during device removal or driver teardown sequences.
Memory corruption in the Linux kernel qede network driver (QLogic/Marvell FastLinQ 40/100GbE) arises because qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(), consuming an extra buffer descriptor and desynchronizing the RX BD ring. The resulting off-by-one can corrupt DMA page reference counts and trigger SLUB freelist corruption, most plausibly a kernel-crash denial of service rather than reliable code execution. No public exploit has been identified and it is not in CISA KEV; the low EPSS (0.22%, 13th percentile) reflects that the bug only manifests under kernel memory pressure.
Denial-of-service in the Linux kernel's IFE (Inter-Forwarding-Element) traffic-control action allows a crafted, malformed IFE frame to crash the host, because ife_decode() only guaranteed the outer IFE header was pullable before handing the decapsulated packet to eth_type_trans(), which then reads an inner Ethernet header that may be shorter than ETH_HLEN in the linear skb area. Only systems that have the tc act_ife action configured are exposed. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV; the fix adds ETH_HLEN to the pull check.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK (pre-shared key) is absent, enabling remote unauthenticated attackers to flood the notification queue and inject path traversal characters into outbound Clair API URL paths. The primary impact is worker resource exhaustion leading to denial of service, with a secondary low-integrity impact from blind path manipulation against the configured Clair vulnerability scanner host. No public exploit identified at time of analysis, and EPSS of 0.26% (17th percentile) indicates low current exploitation probability.
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to crash the service, resulting in a complete loss of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable over the network without credentials or user interaction, making it trivially reachable in any internet- or network-exposed deployment. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity elevates practical risk.
Unprivileged user-mode threads in Zephyr RTOS can crash the kernel or disclose arbitrary kernel memory by exploiting a missing validation step in the logging subsystem's syscall verifier, directly violating the user/kernel isolation boundary that CONFIG_USERSPACE is designed to enforce. Any Zephyr build compiled with CONFIG_USERSPACE=y is affected, as the __syscall-decorated z_log_msg_static_create() function accepted fully attacker-controlled pointer and length arguments without any K_SYSCALL_* bounds checking in its verifier function z_vrfy_z_log_msg_static_create(). No public exploit identified at time of analysis; an upstream fix has been committed to zephyrproject-rtos/zephyr and documented in GitHub Security Advisory GHSA-h7rf-g9mg-g23f.
Memory exhaustion via crafted VP8L images affects golang.org/x/image/vp8l in all versions before 0.45.0, enabling remote unauthenticated attackers to crash Go applications that process untrusted image content through this library. The VP8L decoder fails to bound heap allocation when decoding images that declare many unused Huffman tree groups, turning a parsing decision into unconstrained memory growth. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial network attack vector and zero-privilege requirement make this a practical DoS risk for any internet-facing service accepting image uploads.
Race condition exploitation in KUNBUS piControl 2.6.2 allows a local authenticated attacker to corrupt kernel memory by issuing concurrent crafted requests through the piControl character device, triggering use-after-free and invalid pointer dereferences in kernel configuration objects. The flaw resides in the configuration and process-image management subsystem of this industrial Revolution Pi (RevPi) controller platform component, with potential impact spanning confidentiality, integrity, and availability per the CVSS 4.0 vector, though denial of service is the explicitly confirmed outcome. No public exploit code and no active exploitation have been identified at time of analysis; this was responsibly disclosed by Nozomi Networks Labs.
Kernel memory corruption in KUNBUS piControl version 2.6.2 allows a local authenticated attacker with device configuration access to write beyond process-image buffer boundaries, corrupting adjacent kernel memory and causing denial of service. The vulnerability resides in process-image management functionality and is triggered by supplying crafted device configuration data and crafted input through the piControl character device. No public exploit code or active exploitation has been confirmed at time of analysis, though the industrial OT context and kernel-level impact elevate operational priority for RevPi deployments.
Heap exhaustion via unbounded JSON body reading in the Apache Struts JSON plugin allows unauthenticated remote attackers to deny service by sending a single oversized HTTP request to any endpoint where request-body-to-action population is enabled. Affected version ranges span the 2.x, 6.x, and 7.x release lines. No public exploit code has been identified at time of analysis and SSVC signals no active exploitation, but the attack is rated automatable, meaning scripted large-scale scanning and denial-of-service campaigns are feasible against exposed endpoints.
FileBrowser versions before 2.63.19 fail to enforce the TUS Upload-Length boundary in the PATCH resumable-upload endpoint, enabling authenticated users to stream arbitrarily large request bodies directly to disk regardless of the length declared at upload creation. The root cause, confirmed by the patch diff, is an unbounded io.Copy call that passed r.Body directly to the target file without capping reads to the remaining declared bytes. No public exploit has been identified at time of analysis, and exploitation requires a valid low-privilege account, but the impact - full disk exhaustion causing service unavailability - can be triggered with a single crafted PATCH request.
Remote denial of service via stack-based buffer overflow affects IBM i versions 7.3 through 7.6, allowing unauthenticated network attackers to crash an affected service without any user interaction or elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is straightforward from the network with no special conditions, making this a reliable availability threat against exposed IBM i systems. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the vendor has released a patch via the IBM support portal.
Out-of-bounds write (CWE-787) in IBM i versions 7.3 through 7.6 enables remote unauthenticated attackers to crash affected systems and cause denial of service. The CVSS 3.1 base score of 8.6 is backed by a network-reachable, zero-prerequisite attack vector spanning all four currently supported IBM i release lines, making the exposed attack surface broad. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available and should be applied promptly given the unauthenticated network vector.
Resource exhaustion in Go's net/http package allows unauthenticated remote attackers to indefinitely hold server connections open when cleartext HTTP/2 (h2c) is enabled, causing denial of service. The root cause is that ReadHeaderTimeout - the safeguard meant to prevent slow-connection abuse - is not enforced during the HTTP/2 client preface detection phase unique to h2c. Affected deployments include Go net/http servers built with Go versions prior to 1.25.13, 1.26.6, or 1.27.0-rc.3; no public exploit has been identified and CISA KEV does not list this vulnerability.
Uncontrolled CPU exhaustion in Go's standard-library crypto/tls package allows remote unauthenticated attackers to send an unbounded stream of TLS 1.3 KeyUpdate messages, forcing the server to perform continuous HKDF key derivation operations and causing a denial of service. Affected versions span Go crypto/tls prior to 1.25.13, 1.26.6, and 1.27.0-rc.3 across all three active release branches. No public exploit has been identified and EPSS stands at a low 0.18%, but the zero-authentication network attack surface makes this trivially reachable against any internet-exposed Go TLS server without any special preconditions.
Stack exhaustion in Go's encoding/asn1 standard library package allows any caller of Unmarshal to crash the Go process by supplying a deeply-nested, recursive ASN.1 structure that exceeds the goroutine stack limit. Applications that parse ASN.1 data from untrusted sources - including TLS certificate validation, PKCS message handling, LDAP clients, SNMP agents, and custom cryptographic protocol implementations - are directly at risk of denial of service. No public exploit code has been identified at time of analysis; vendor-released patches are available in Go 1.26.6 and Go 1.25.13.
Stack exhaustion in Go's standard library encoding/xml package exposes any Go application parsing untrusted XML to remote denial of service. The DecodeElement function incorrectly resets an internal recursion depth counter on each invocation, neutralizing the depth-limit guard that exists to prevent unbounded stack growth from deeply nested XML documents. Unauthenticated remote attackers can trigger goroutine stack exhaustion and crash the affected process with no authentication required. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS is 0.18% (8th percentile), reflecting low near-term exploitation probability despite the straightforward attack primitive.
Denial of service via buffer overflow in IBM i 7.3 through 7.6 exposes all supported release lines of IBM's midrange operating system to remote disruption. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that an unauthenticated remote attacker can trigger the flaw with low complexity and no user interaction, resulting in high availability impact and limited integrity impact - consistent with an out-of-bounds write that can crash or destabilize a targeted component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
IBM i 7.6 exposes a remotely exploitable denial-of-service condition via an out-of-bounds write (CWE-787) that can be triggered by an unauthenticated remote attacker over the network without user interaction. The vulnerability produces high availability impact with no confidentiality or integrity consequence, consistent with a crash or resource exhaustion outcome rather than code execution. No public exploit or active exploitation has been identified at time of analysis; a vendor patch has been released.
Denial of service affecting IBM i versions 7.3 through 7.6 stems from uninitialized memory consumption during ASN.1 length processing, reachable by remote unauthenticated attackers over a network path without user interaction. The vendor CVSS vector rates C:H/I:H/A:H despite the public description referencing only a DoS outcome, a discrepancy suggesting the vulnerability's full potential may extend to memory disclosure or integrity impacts - reviewers should consult IBM Support advisory 7283573 to resolve this conflict before prioritizing response. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the high-complexity network attack vector means adversaries with specific knowledge of the target's ASN.1 service exposure remain a realistic threat to unpatched systems.
Information disclosure and denial of service in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 lets a remote unauthenticated attacker trigger a stack-based buffer overflow, potentially reading sensitive memory contents and crashing the affected service. IBM (the reporter) has released a patch, and no public exploit has been identified at time of analysis. Despite a CVSS of 9.1, the EPSS probability is low (0.25%, 17th percentile) and CISA SSVC records no known exploitation.
Prototype pollution in Trigger.dev's run metadata API (versions 3.3.8 through 4.5.5) lets any authenticated tenant corrupt the shared Node.js webapp process's Object.prototype by supplying crafted path keys to the PUT /api/v1/runs/:runId/metadata endpoint. The root cause is the unsanitized use of attacker-supplied operation.key values passed directly to JSONHeroPath.set() in packages/core/src/v3/runMetadata/operations.ts without filtering __proto__, constructor, or prototype segments. A single exploiting tenant can corrupt Prisma ORM queries, poison Prometheus metric labels, break other tenants' worker authentication, and cause a process-wide denial of service - making this a multi-tenant isolation failure with scope-changed impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to crash or hang affected systems by triggering an infinite loop condition (CWE-835) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and minimal complexity, making automated exploitation straightforward. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Denial of service in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to exhaust system resources through unbounded resource allocation, rendering the platform unavailable to legitimate users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction, with low attack complexity over the network. No public exploit code and no CISA KEV entry have been identified at the time of analysis; a vendor patch is available.
Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker via a CWE-835 infinite loop condition. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication and no user interaction against affected systems. No public exploit code or active exploitation confirmed at time of analysis; IBM has released a patch.
Heap buffer overflow in IBM i 7.3 through 7.6 enables remote, unauthenticated attackers to crash affected systems via a network-reachable code path, resulting in a complete denial of availability. The vulnerability is rooted in CWE-787 (out-of-bounds write) and carries a CVSS 3.1 base score of 7.5 (High) with a fully unauthenticated network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch through its support portal.
Unauthenticated remote exploitation of a buffer overflow in IBM i 7.3 through 7.6 allows attackers to cause denial of service and modify authentication metadata without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially reachable exploitation over the network against default-accessible services. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.