Denial Of Service
Monthly
Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.
Remote denial of service in the Netty networking framework (codec-haproxy module) versions 4.1.0.Final through 4.1.135 and 4.2.0.Final through 4.2.15.Final lets unauthenticated attackers exhaust JVM direct memory. The HAProxyMessageDecoder mis-parses a PROXY protocol v2 header whose version byte is 0xFF, sign-extending it to -1, which collides with the decoder's 'need more data' sentinel, so ByteToMessageDecoder accumulates inbound bytes in an unbounded cumulation buffer until the process runs out of direct memory. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity effect.
Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 stems from a heap-based buffer overflow in the set_ap_param command exposed by the /localcfg endpoint. An authenticated attacker who can reach the device's local configuration interface can send oversized input to crash the charger or potentially execute arbitrary code on it. Publicly available exploit code exists (published by CyberDanube), and the CVSS 4.0 base score is 9.4, though there is no evidence of active exploitation in the CISA KEV catalog at time of analysis.
Remote denial of service in Ollama (HEAD f0078ae) allows unauthenticated attackers to crash the entire server by uploading a sub-1KB crafted GGUF file whose attacker-controlled string lengths, tensor dimension counts, and metadata array counts are trusted as allocation sizes without bounds checking against the remaining file size. Reachable through the blob upload plus model create/pull API endpoints, the flaw triggers unrecoverable Go runtime out-of-memory fatal errors or makeslice panics that bypass the server's recovery middleware, taking down the whole process rather than a single request. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but a vendor patch is available and VulnCheck has published an advisory.
Denial of service in Amazon's smithy-rs code generation framework allows remote attackers to abort the process via stack exhaustion by sending a small request containing deeply nested data that matches a recursive model shape. The flaw affects generated deserializers for JSON, CBOR, and XML across the AWS SDK for Rust and any custom clients or servers built with smithy-rs codegen; because deserialization runs before business logic, a compact malicious payload can crash the target. This carries a CVSS 4.0 base score of 8.7 (availability-only impact), and no public exploit was identified at time of analysis.
Denial of service in the golang.org/x/text/unicode/norm package (versions before 0.39.0) allows remote attackers to cause an unrecoverable infinite loop by supplying input containing invalid UTF-8 bytes to a norm.Iter. Any Go service that Unicode-normalizes untrusted input using this widely-used supplementary library can be hung with a single malformed request, consuming CPU until the process is killed. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile), but the network-reachable, no-authentication, no-interaction profile makes it broadly triggerable.
Denial of service in websocket-driver-ruby (all versions before 0.8.2) allows any unauthenticated remote client to crash a Ruby WebSocket server process by sending an HTTP Upgrade request containing a syntactically invalid Host header value. The root cause is an unhandled URI::InvalidURIError exception raised during Host header parsing in the request.complete() method, which propagates uncaught to the top level and terminates the server process. No public exploit has been identified at time of analysis, but the attack technique is trivially constructible from the CVE description and the published patch diff alone.
Denial of service in Atlassian Confluence Data Center allows an authenticated attacker to render the application unavailable to legitimate users by triggering resource exhaustion that disrupts the host's services. Affected releases span the 9.0.x through 10.2.x branches, with a CVSS 4.0 score of 7.1 (High) driven entirely by availability impact. No public exploit has been identified at time of analysis; the flaw was discovered internally via Atlassian's penetration testing program rather than through in-the-wild activity.
Denial of service in React's Server Components runtime (react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack) lets remote unauthenticated attackers spike CPU to exhaustion by POSTing specially crafted HTTP requests to Server Function ('use server') endpoints across versions 19.0.0-19.0.7, 19.1.0-19.1.8, and 19.2.0-19.2.7. The flaw was reported by Meta (React's maintainer) and carries CVSS 7.5 (availability-only impact). No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and CISA SSVC scores exploitation as none, indicating a real but non-urgent memory-safety fix.
Denial of service in libssh affects clients that use automatic certificate-based public key authentication, where logic errors cause the client to loop indefinitely when configured certificates are absent or are repeatedly rejected by the SSH server. Reported by Red Hat and shipped in Red Hat Enterprise Linux 8, 9, and 10 plus Red Hat Hardened Images, the flaw lets a hostile or misconfigured server hang a connecting client and consume CPU. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile), consistent with an availability-only, client-side bug rather than a mass-exploited issue.
Remote denial-of-service in Mozilla Firefox's Graphics: WebGPU component allows a malicious web page to exhaust browser resources and crash or hang the browser without any user credentials or interaction. The flaw affects Firefox versions prior to 153 and is triggered simply by loading attacker-controlled content that abuses the WebGPU API. There is no public exploit identified at time of analysis, and EPSS scores the exploitation likelihood at only 0.14%, indicating low near-term probability of widespread exploitation.
Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let remote attackers submit a crafted Fory-serialized payload that triggers a use-after-free, causing undefined behavior, process crashes, or leakage of adjacent process memory. The flaw affects any service that deserializes untrusted Fory data using the Rust implementation, and Apache has published a fixed release (1.4.0). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile), but the network-reachable, unauthenticated attack surface makes it a meaningful hardening priority for exposed services.
Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.Final) allows a remote peer to send a small zlib-compressed SPDY HEADERS block that Netty keeps inflating even after the raw header parser exceeds maxHeaderSize and marks the frame truncated in SpdyFrameCodec. The result is disproportionate CPU consumption and allocation churn (CWE-400) from a tiny input, degrading or crashing services that expose the SPDY codec. No public exploit identified at time of analysis and it is not listed in CISA KEV; impact is availability-only per CVSS 7.5 (A:H).
Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16.Final allows a remote unauthenticated peer to send a single ~2 MiB SPDY SETTINGS frame that forces the server to materialize 262,144 map entries in DefaultSpdySettingsFrame, driving heap growth and ordered-map insertion CPU cost far out of proportion to the input. Affected are Java services that enable Netty's SPDY handler and accept untrusted connections; there is no public exploit identified at time of analysis, and while CVSS is 7.5 the low EPSS-style real-world footprint is tempered by SPDY/3.1 being a deprecated, rarely-enabled protocol.
Denial of service in the Net::DNS Perl library (versions through 1.55) lets a remote attacker crash any application that parses untrusted DNS messages by sending a crafted response with a deeply nested chain of compression pointers. Net::DNS::DomainName::decode recurses once per pointer with no depth cap, so a chain of ~8191 (UDP/14-bit) to ~32767 (TCP/16-bit) two-byte pointers exhausts Perl's C stack and triggers SIGSEGV. EPSS is low (0.20%, 10th percentile) and there is no public exploit identified at time of analysis, though CPANSec/oss-security disclosure provides enough detail to reconstruct a trigger.
Denial of service in libcupsfilters and cups-filters (the OpenPrinting image-filtering stack bundled with Red Hat Enterprise Linux 7 through 10) allows an unauthenticated attacker to abort the CUPS image filter by submitting a specially crafted PNG print job. The PNG reader instantiates a libpng decoder without registering an error-recovery handler, so a malformed image triggers libpng's default fatal-error path and terminates the filter process, killing the in-flight print job. No public exploit identified at time of analysis; this is a print-job availability issue, not a code-execution or data-exposure flaw.
Stack-based buffer overflow in rsyslog's optional mmpstrucdata module allows a remote, unauthenticated attacker to crash the rsyslog process and interrupt log collection, with theoretical code execution on weakly hardened builds. Affected versions span rsyslog 7.5.4 through 8.2605.x; the fix is included in 8.2606.0. No public exploit code or active exploitation has been confirmed, but the crash was independently reproduced over both TCP and UDP on Debian 12 with rsyslog 8.2302.0, and the corrective PR (#6991) was merged publicly before coordinated disclosure completed.
Privilege escalation in HCL Commerce (versions 7 through 9.1.19) allows an authenticated low-privileged user to elevate their rights and perform unauthorized administrative operations, disclose other users' personal data, and cause denial of service. The flaw is network-reachable with low attack complexity and requires only existing low-level credentials, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis; the issue was self-reported by HCL and is not listed in CISA KEV.
Denial of service in FreeRDP servers (versions <=3.27.1) allows unauthenticated remote attackers to crash the service by forging a malicious encrypted client random during RDP Standard Security negotiation. Because the server publishes its RSA public key, an attacker can craft a ciphertext whose decrypted plaintext spans the full RSA modulus (up to 256 bytes for RSA-2048), overflowing a fixed 32-byte heap buffer in crypto_rsa_common() by roughly 224 attacker-controlled bytes before any authentication occurs. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix landed in FreeRDP 3.28.0.
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single WebSocket message by sending a deeply nested JSON payload to the /rpc endpoint. The value/JSON parser ignores the configured recursion depth limit for nested braces, brackets, and parentheses, so uncontrolled recursion (CWE-674) exhausts server memory and terminates the process. This is an incomplete-fix regression of GHSA-6r8p-hpg7-825g, which patched the same bug class in the expression parser but missed the value/JSON code path; no public exploit identified at time of analysis, though the trigger is trivially reproducible from the advisory.
Denial of service in SurrealDB before 3.1.0 lets an authenticated user with query-execution privileges crash the server with a single WebSocket message. The type/kind parser fails to enforce the configured recursion depth limit when parsing deeply nested type annotations (e.g. array<option<array<option<...>>>>), driving uncontrolled recursion that exhausts server memory and terminates the process. No public exploit identified at time of analysis and not listed in CISA KEV, but the flaw is trivially triggerable and is an incomplete fix of a previously patched bug class (GHSA-6r8p-hpg7-825g).
Denial of service in SurrealDB before 3.1.0 allows an authenticated user holding only 'select' permission on a table to indefinitely block all CREATE, UPDATE, and DELETE operations on that table for every other user - including root. By registering a LIVE query whose WHERE clause deterministically throws an evaluation error (e.g. calling a typed SurrealQL function with a wrong-typed argument), the resulting error propagates into the write path and rolls back the triggering modification. No public exploit identified at time of analysis, but the technique is fully documented in the vendor's GHSA advisory.
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process with a single WebSocket message to the /rpc endpoint. Sending an RPC 'use' call that sets a database (db) without first selecting a namespace triggers a Rust panic on an .expect() call; because surrealdb-core is compiled with panic = 'abort', the panic aborts the whole process rather than the connection. The vulnerability (CVSS 4.0 8.7, VulnCheck/GHSA-wjjj-24cx-f28g) requires no credentials, token, or --allow-guests flag, and no public exploit has been identified at time of analysis.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire server process with a single crafted query. Submitting a flat operator chain of tens of thousands of terms (e.g. RETURN 1 + 1 + 1 + ...) builds an unbounded expression tree that overflows the thread stack when later walked recursively, aborting the process and denying service to every namespace and database on the instance. No public exploit identified at time of analysis; impact is availability-only with an EPSS-independent CVSS 4.0 score of 7.1.
Denial-of-service in the Linux kernel iwlwifi mvm WiFi driver affects older Intel wireless adapters such as the 7265D, where a regression in TX-rate encoding sets TX_CMD rates incorrectly. When the device reports these malformed rates back, the driver can emit warnings and, for beacon rates, trigger a firmware assert/crash that disrupts wireless connectivity. This is a fixed regression with no public exploit identified at time of analysis and a low EPSS score (0.15%), indicating negligible real-world exploitation interest.
Denial of service in the Linux kernel's Intel iwlwifi 'mld' Wi-Fi driver allows a firmware crash on Intel BE201/Wi-Fi 7 adapters to spiral into sustained resource exhaustion. Because iwl_mld_tx_from_txq() failed to check the in_hw_restart flag, TX frames kept being dequeued and pushed to dead firmware, each returning -EIO and being freed in a tight loop that burns CPU and churns skb allocations, causing slab fragmentation and memory pressure. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and the issue is not on CISA KEV; it is a reliability/availability bug that manifests under real load, not an attacker-driven remote exploit.
Improper error handling in the Linux kernel's pds_core driver (AMD Pensando Distributed Services Card core driver) causes pdsc_devcmd_wait() to return stale success from the completion register when firmware crashes or a device command times out, instead of propagating -ENXIO or -ETIMEDOUT. Because the error path is bypassed, the driver fails to queue health_work recovery, leaving the device in an inconsistent state and producing an availability (denial-of-service) condition. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and the issue is not on the CISA KEV list.
Remote denial of service in the Linux kernel's ksmbd in-kernel SMB3 server allows an attacker to trigger a NULL-pointer dereference and kernel panic during SMB2 CREATE lease processing. After a SESSION_LOGOFF, a stale opinfo remains linked in the per-ClientGuid lease list with its conn pointer cleared; a subsequent session reusing the same ClientGuid and taking a lease on a different inode causes compare_guid_key() to dereference the NULL conn->ClientGUID. Exploitation requires only a successful SMB2 SESSION_SETUP against a share with 'durable handles = yes'; no public exploit is identified at time of analysis and EPSS risk is low (0.17%).
Kernel-panic denial of service in the Linux kernel's in-kernel SMB server (ksmbd) allows the file-pointer table to retain a durable-handle file object with a NULL tcon after a client issues SMB2 SESSION_LOGOFF; any subsequent read of /proc/fs/ksmbd/files then dereferences the NULL fp->tcon in proc_show_files() and crashes the host. Affected are kernels running ksmbd on shares configured with 'durable handles = yes'. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), consistent with a stability/robustness bug rather than a weaponizable RCE.
Denial of service in the Linux kernel ALSA PCM subsystem allows a local low-privileged user with sound-device access to crash the system on RISC-V hardware. During the transition to iov_iter for PCM data transfer, the silencing path (data = NULL) reused the interleaved iov_iter setup, producing a bogus iterator that triggers a NULL pointer dereference; on most other architectures it was benign, but RISC-V faults. No public exploit is identified at time of analysis, and EPSS risk is low at 0.17% (6th percentile). The kernel tags flag potential information disclosure, though the concretely described symptom is a crash.
Denial-of-service and memory corruption in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver occurs when RBUF_EEE_EN and RBUF_PM_EN are set in RBUF_ENERGY_CTRL and MAC Energy-Efficient Ethernet becomes active, silently halting the RX path while the link stays up and, on some boards, triggering a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. It affects Linux systems using Broadcom GENET NICs (e.g. Raspberry Pi 4B/BCM2711, Broadcom 4908-family SoCs), and is triggered by default now that phy_support_eee() enables EEE automatically, or on older kernels once TX LPI is enabled via ethtool. No public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile), and the CISA-KEV / attacker-controlled framing implied by the CVSS 9.8 does not match the local hardware-interaction nature of the bug.
Denial of service in the Linux kernel's IPv6 In-situ OAM (IOAM) processing path allows remote attackers to crash the system via a NULL pointer dereference in ipv6_hop_ioam(). The function dereferences the result of __in6_dev_get(skb->dev) to read cnf.ioam6_enabled without checking for NULL, so a packet carrying an IOAM Hop-by-Hop option that arrives while addrconf_ifdown() concurrently clears dev->ip6_ptr via RCU can trigger a kernel panic. EPSS is low (0.18%), no public exploit or CISA KEV entry exists, and the fix ships in multiple stable kernel releases; the availability-only impact (CVSS 7.5, A:H) reflects a crash rather than code execution or data exposure.
Use-after-free (CWE-416) in the Linux kernel nvme-pci driver allows a local attacker or triggerable hardware condition to crash the kernel or potentially corrupt memory. The nvme_free_host_mem() function frees dev->hmb_sgt but never clears the pointer, so a double-call during an error path in nvme_probe() dereferences the freed and zeroed DMA structure, causing a NULL pointer dereference in iommu_dma_free_noncontiguous(). Observed reliably on Thunderbolt-attached NVMe devices with PCIe link instability; no public exploit or active exploitation identified at time of analysis.
Remote denial of service in the Linux kernel's SMC-D (Shared Memory Communications over ISM) client allows a malicious peer to crash the system via a null-pointer dereference during SMC-Dv2 connection setup. When a client sends an SMC-Dv2-only proposal and no SMC-Dv1 device is selected, a peer that replies with an ACCEPT containing CHID value 0 matches the reserved empty slot 0 of the ism_dev[] array, causing a null-ptr-deref on ism_dev[0]->lgr_lock in smc_conn_create(). No public exploit identified at time of analysis; EPSS is low (0.17%) and it is not listed in CISA KEV, but the fix is upstream in the kernel stable tree.
Use-after-free in the Linux kernel's in-kernel OpenVPN data channel offload (ovpn) TCP transport allows a local attacker to corrupt kernel memory by racing a TCP socket close against peer removal. The flaw lives in ovpn_tcp_close(), which caches a peer pointer under an RCU read lock but then escapes and dereferences sock->peer after the lock is dropped and without holding lock_sock(), so ovpn_socket_release() can free the socket concurrently. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the CVSS 8.4 rating reflects full high impact to confidentiality, integrity, and availability if the race is won. A vendor patch is available.
Remote kernel crash in the Linux kernel's mac80211 WiFi stack affects WiFi 7 (802.11be) clients: the ieee80211_ml_epcs() handler fails to bounds-check the 4-bit link_id (0-15) extracted from an EPCS PER_STA_PROFILE subelement, but sdata->link[] holds only 15 entries (indices 0-14), so link_id=15 reads out of bounds. A connected access point can send an EPCS Enable Response action frame with link_id=15 to read a garbage pointer that bypasses the NULL check and is dereferenced in ieee80211_sta_wmm_params(), crashing the kernel. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and this is a denial-of-service (kernel panic) rather than the code-execution/data-disclosure implied by the vendor CVSS.
Local denial of service in the Linux kernel's AF_IUCV networking stack allows any unprivileged user on an s390/IBM Z host to crash the machine by racing recvmsg() against getsockopt(SO_MSGSIZE) on a HiperSockets (HIPER) socket. The .getsockopt handler dereferenced iucv->hs_dev->mtu without holding lock_sock(), so a concurrent iucv_sock_close() (triggered from recvmsg) could set hs_dev to NULL between the check and the dereference, producing a NULL pointer dereference oops. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the upstream fix wraps the entire getsockopt switch in lock_sock()/release_sock() to mirror the existing setsockopt locking.
Use-after-free in the Linux kernel net/handshake subsystem (kernel 6.4 through the fixed 7.x builds) lets a concurrent handshake consumer free a struct socket and its backing file while the netlink accept path (handshake_nl_accept_doit) is dereferencing them, producing a NULL pointer read or freed-memory access. The flaw is a race between handshake_req_next() dropping hn_lock and the accept side reaching FD_PREPARE(), during which tls_handshake_cancel() plus sockfd_put()/__fput_sync() can release the object. No CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and the tags classify the practical impact as Denial of Service.
Denial-of-service (kernel crash) in the Linux kernel Bluetooth L2CAP subsystem lets an in-range attacker trigger memory corruption by sending a crafted Enhanced Credit-Based (ECRED) connection response that reuses an already-assigned destination CID, corrupting the list_for_each_entry_safe cursor during channel teardown. All Linux systems with Bluetooth enabled and processing LE CoC ECRED channels are affected until patched. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile); the issue is not listed in CISA KEV.
Denial of service in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver allows the port reset recovery path to trigger a NULL pointer dereference and kernel crash. The flaw occurs when mana_per_port_queue_reset_work_handler() runs after a prior detach succeeded but a subsequent attach failed, leaving apc->tx_qp and apc->rxqs freed; a second unconditional mana_detach() then dereferences NULL during queue teardown. No public exploit has been identified, EPSS is low (0.20%, 10th percentile), and the CVSS 3.1 score is 7.5 driven purely by availability impact.
Denial of service in the Linux kernel's IPv6 routing stack allows remote attackers to trigger an infinite loop in fib6_select_path(), hanging a CPU in softirq context and causing a system-wide hang or hard lockup. The flaw exists because writers holding tb6_lock can list_del_rcu() a route's fib6_siblings entry without waiting for RCU readers, leaving the softirq-side path-selection walker traversing a stale sibling ring that never reaches its list terminator. A vendor patch is available; EPSS is low (0.21%) and there is no public exploit identified at time of analysis, but the network-triggerable, no-privilege CVSS 7.5 vector makes it a meaningful availability risk on multipath IPv6 deployments.
Local denial-of-service in the Linux kernel's HPFS (High Performance File System) driver allows a crash when hpfs_map_dnode_bitmap fails and the code subsequently calls hpfs_brelse4 on an uninitialized quad buffer head. Affected are Linux kernels prior to the fixed stable releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1) when an HPFS filesystem is mounted. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is very low (0.21%), consistent with a niche legacy-filesystem bug rather than a broadly weaponizable flaw.
Local privilege escalation or denial of service in the Linux kernel's zram block device (writeback path) stems from a use-after-free in zram_writeback_endio, where the bio completion handler calls wake_up() on wb_ctl->done_wait after the writeback task may have already observed num_inflight reach zero and freed wb_ctl via release_wb_ctl(). Affecting kernels around 6.19/7.0 with zram writeback in use, a local attacker who can drive zram writeback activity may trigger the race to corrupt kernel memory, crashing the system or potentially escalating privileges. There is no public exploit identified at time of analysis and EPSS is low (0.21%), consistent with a hard-to-win kernel race rather than a trivially weaponizable bug.
Memory-management memory corruption in the Linux kernel's reverse-mapping (rmap) code lets a local, low-privileged user crash the system by corrupting folio refcount/mapcount state. The flaw lives in try_to_unmap_one() (mm/rmap.c), where the nr_pages counter is not reset to 1 at the start of each page-table-walk iteration, so a stale batch count from a prior lazyfree folio unmap is reused against a device-exclusive PTE. No public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile); the demonstrated userspace-visible effect is a kernel crash (denial of service).
Local privilege escalation or denial of service in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem arises from a race condition where iso_sock_close() calls iso_sock_clear_timer() before taking the socket lock, letting a concurrent iso_conn_del() free the connection object and trigger a NULL pointer dereference or use-after-free. Any local user able to open and close AF_BLUETOOTH ISO sockets can race the two code paths; UAF of a kernel connection structure can escalate from a crash to memory corruption. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Privilege-independent local crash in the Linux kernel's parport (parallel port) subsystem allows a race between port registration and client-driver attachment, where drivers such as lp bind to ports that are not yet fully initialised or are being torn down, causing a NULL/use-after-free style kernel crash. Affects systems where parport_pc and lp are built as modules and loaded concurrently during boot with PC-style parallel-port hardware present. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not listed in CISA KEV, consistent with the vendor 'Denial Of Service' tag rather than code execution.
Local denial-of-service (and potential information disclosure) in the Linux kernel's dwc2 USB host controller driver, where debug code dereferences the 'urb' structure after it has already been handed back via usb_hcd_giveback_urb(), causing a use-after-free read of freed memory. The flaw affects systems using the DesignWare HS OTG USB 2.0 controller driver (common on ARM SoCs such as Raspberry Pi). It is patched upstream, has no public exploit identified at time of analysis, and carries a low EPSS score (0.21%).
Memory corruption in the Linux kernel's mac802154 IEEE 802.15.4 link-layer security (llsec) subsystem allows an adjacent attacker to trigger a slab use-after-free and data corruption by sending 802.15.4 frames to a host with link-layer security enabled. The llsec encrypt/decrypt routines perform in-place crypto on socket buffer data that may be shared across skb clones, so modifying it corrupts memory still referenced by other clones. No public exploit has been identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not in CISA KEV, but a vendor patch is available.
Out-of-bounds memory writes in the Linux kernel's gcov code-coverage instrumentation can corrupt memory and crash the system when inflate_fast() (zlib decompression) runs concurrently on multiple CPUs, most notably during IPComp/IPsec (xfrm_input) packet decompression. GCC merges the global GCOV branch counter with loop induction variables, so simultaneous execution reloads the shared counter mid-loop and computes an index that wrote ~3.4 MB past a 65 KB buffer. This only affects kernels built with GCOV profiling enabled; there is no public exploit identified at time of analysis and EPSS is very low (0.17%).
Memory corruption in the Linux kernel's exFAT filesystem driver allows a crafted exFAT image to trigger a use-after-free in exfat_find_dir_entry(): the buffer_head backing the directory entry (bh) is released via brelse() before the fall-through TYPE_EXTEND branch still reads through the ep pointer into bh->b_data. Any system that mounts an attacker-supplied exFAT volume (e.g. a USB stick or disk image with a long filename engineered to force same-hash collisions down the TYPE_EXTEND path) is affected; the stale dereference can fault or corrupt kernel memory. No public exploit identified at time of analysis, and the input CVSS 9.8/AV:N score is not credible for a local filesystem-parsing bug that the reporter could only trigger under instrumentation (KASAN + DEBUG_PAGEALLOC with a debug invalidate_bdev()).
Use-after-free in the Linux kernel NFS server (nfsd) pNFS layout code allows an NFSv4.1+ client to leave a freed layout state ID published in the client's IDR when nfsd4_layout_setlease() fails, so any later IDR walk (states_show, client teardown) dereferences a dangling slab pointer. The affected component is the pNFS block/SCSI/flexfiles layout server path on kernels between commit c5c707f96fc9 and the fixed stable releases. No public exploit has been identified and it is not in CISA KEV; the practical impact is kernel memory corruption leading to crash (DoS) and possible information disclosure per the vendor tag, though the auto-assigned CVSS of 9.8 significantly overstates real-world exploitability.
Remote denial-of-service in the Linux kernel NFSv4 flexfiles (pNFS) client allows a malicious or compromised NFS server to crash a mounting client via a malformed flexfiles layout that declares a zero filehandle-version count. The flaw stems from ff_layout_alloc_lseg() accepting fh_count == 0, which produces a ZERO_SIZE_PTR that is later dereferenced during layoutreturn encoding, triggering a null-pointer-deref and kernel panic. No public exploit identified at time of analysis, though the commit includes a QEMU/KASAN reproducer; CVSS 7.5 reflects availability-only impact (A:H) with no confidentiality or integrity effect.
Remote denial of service in the Linux kernel's NFSv4/pNFS flexfiles client allows a malicious or compromised NFS metadata server to crash any mounted client by returning a GETDEVICEINFO response containing a zero-length r_addr or r_netid opaque. The decoder nfs4_decode_mp_ds_addr() only checks for negative lengths, so a zero-length value leaves the buffer pointer NULL and the subsequent strrchr(NULL, '.') triggers a kernel NULL-pointer dereference and panic. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a targeted server-side trust attack rather than mass exploitation.
Denial of service in the Linux kernel in-kernel SMB3 server (ksmbd) lets remote, unauthenticated clients crash the ksmbd worker via a crafted COMPOUND request. Because smb2_check_user_session() skips the SMB2_SESSION_VALID state check for non-first compound operations and treats a SessionId of 0xFFFFFFFFFFFFFFFF as automatically valid, a TREE_CONNECT chained onto a half-open session (created by an NTLM Type-1 negotiate blob, sess->user still NULL) reaches ksmbd_ipc_tree_connect_request() and dereferences a NULL pointer, wedging the worker for all clients. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis.
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash the per-connection server child with a single malformed packet. The flaw stems from an unsigned integer underflow and a size_t-to-int truncation that fools the allocator into returning a ~512-byte block while the caller believes it received ~4 GB, causing an attacker-controlled heap overflow past a 544-byte allocation. Publicly available exploit code exists (a VulnCheck proof of concept) demonstrating reliable DoS; heap metadata corruption and consequences beyond DoS are theorized but not demonstrated, and there is no public exploit identified for code execution.
Denial of service and heap corruption in OpenPLC_v3 lets an authenticated web-interface user overflow the 100-byte MB_device.dev_name buffer via an oversized device_name field on the /modbus endpoint. Because getData() in modbus_master.cpp copies delimiter-bounded characters with no bounds check, a ~200-byte value writes 100 bytes past the allocation, overwriting adjacent Modbus config fields (protocol, dev_address, ip_port) and crashing the PLC control loop. No public exploit identified at time of analysis, though VulnCheck published a detailed technical advisory; the affected repository is archived and no vendor-released patch was identified.
Unauthenticated remote denial of service in the JLine3 remote-telnet server module (versions before 3.30.14, 4.0.16, and 4.2.1) lets an attacker crash the JVM by flooding the Telnet NEW-ENVIRON negotiation with unbounded unique environment-variable pairs. Because TelnetIO.readNEVariables() stores every pair in an uncapped HashMap on ConnectionData before login, roughly 3-4 MB of traffic can exhaust a 512 MB heap and force an OutOfMemoryError. No public exploit code is identified, but the vendor advisory (GHSA-47qp-hqvx-6r3f) documents proof-of-concept methodology; the flaw is not listed in CISA KEV and no EPSS score was supplied.
Denial of service in the JLine3 Telnet server (jline-remote-telnet module) lets an unauthenticated remote attacker exhaust server CPU by abusing the Telnet NAWS window-size option. Because TelnetIO enforces only a lower bound on terminal dimensions, a client can advertise a 65535x65535 terminal and repeatedly alternate values to force continuous, expensive redisplay/rendering cycles. Publicly available exploit code exists (a raw two-packet Telnet PoC is published in the vendor GHSA advisory), and there is no public exploit identified as being actively exploited; the issue is fixed in 3.30.14, 4.0.16, and 4.2.1.
Denial of service in IBM Engineering Lifecycle Management's DOORS component exposes unauthenticated remote attackers to crash or degrade the service by submitting XML payloads exploiting recursive entity expansion. Affected deployments span three active release branches - 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 including Interim Fix 001. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.36% (28th percentile) confirms low current exploitation activity, but the unauthenticated network vector makes remediation advisable for internet-facing or low-trust-network deployments.
Uncontrolled memory consumption in IBM PowerVM NovaLink lets a remote, unauthenticated attacker send a specially-crafted request that drives the server to exhaust memory resources, degrading or halting availability of the virtualization management layer. The CVSS 3.1 base score is 7.5 (High) with an availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and a vendor patch is available.
Wallet-draining denial of service in ZenHive mpp (Elixir library) versions 0.2.0 through 0.5.x affects deployments configured as a Tempo fee payer (fee_payer: true), where the MPP.Methods.Tempo method co-signs and broadcasts a client-supplied EVM transaction without verifying the client's gas_limit is high enough to complete execution. An unauthenticated remote client can submit a signed transferWithMemo transaction with gas_limit set just below the required amount, causing an on-chain out-of-gas revert that still charges the sponsor's fee-payer wallet while the attacker pays nothing. There is no public exploit identified at time of analysis and this is not on CISA KEV, but repeated low-cost requests can exhaust the sponsor wallet and stop the server from funding gas for legitimate payment requests.
Remote denial of service in the h2o HTTP server (all versions prior to commit 9265bdd) allows unauthenticated attackers to exhaust server memory by combining HPACK header-decompression amplification with Slowloris-style HTTP/2 stream stalling. By opening many streams that stall mid-request, an attacker forces the server to retain large volumes of amplified decoded header state, degrading or crashing the service. There is no public exploit identified at time of analysis, and the CVSS 7.5 (A:H only) reflects an availability-only impact with no confidentiality or integrity effect.
Local privilege escalation and silent denial-of-service in the Wazuh Windows agent (versions 4.6.0 through 4.14.4) arise from a heap-based buffer overflow in the syscheck registry-monitoring component. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, a low-privileged local user who creates a 255-character registry subkey under a monitored wildcard path can trigger an out-of-bounds heap write, either blinding the agent or potentially executing code as SYSTEM. Proof-of-concept exploit code exists (SSVC: poc), but it is not in CISA KEV and EPSS is very low (0.09%, 1st percentile), consistent with the local-only, non-automatable attack profile.
Denial of service in the h2o HTTP server (all versions prior to commit 6b5370d) allows remote unauthenticated attackers to crash the server by requesting static files whose on-stack path construction via alloca can reach ~600KB, exceeding musl libc's default 128KB pthread stack and triggering a guard-page segmentation fault. The flaw is a CWE-770 uncontrolled resource allocation issue affecting availability only (CVSS 7.5, A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but exploitation is trivial where h2o is built against musl libc.
Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corrupt connection state and crash the process prior to commit 8b178e6. Quicly's packet decoder accepts Connection IDs up to 255 bytes (permitted for unknown QUIC versions) but its version-1 CID buffers are only 20 bytes, and the library - unlike its bundled CLI - never rejected over-length CIDs, letting an oversized CID overrun the buffer within its allocated chunk and trigger assertion failures. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote denial of service in quicly, the IETF QUIC implementation used by the H2O HTTP server, allows unauthenticated attackers to crash the process by sending more than 32KB of valid handshake messages over the CRYPTO stream within a single packet number space, tripping a reachable assertion (CWE-617). Affects all builds prior to commit 937d0e9. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the network-reachable, no-privilege nature makes it trivially triggerable once understood.
Memory exhaustion in Quicly's QUIC flow control handling allows an unauthenticated remote peer to force disproportionate receive buffer allocation in the H2O HTTP server by sending STREAM frames containing a single byte placed at the maximum permitted stream offset. The library pre-allocates buffers up to the largest received offset to accommodate out-of-order delivery, so a handful of crafted packets can cause the server to allocate memory far exceeding what the transferred data warrants. Under H2O's default stream concurrency settings, this attack multiplies per-connection memory usage by roughly 4x, making memory exhaustion achievable at low bandwidth cost. No public exploit identified at time of analysis; EPSS is 0.25% (16th percentile) and CISA SSVC lists exploitation as 'none', suggesting no observed real-world abuse.
Denial of service in NASA's Core Flight System (cFS) Health & Safety (HS) application allows a remote attacker to crash the application through a NULL pointer dereference triggered while processing a routine Housekeeping Telemetry request. All HS versions prior to v7.0.1 are affected; the crash produces a segmentation fault that halts the health-monitoring task. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a CISA ICS advisory (ICSA-26-197-03) and vendor-tagged fix release exist.
Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server with a single 28-byte UDP datagram when the proxyproto plugin is enabled. The malformed PROXY protocol v2 header triggers a nil pointer dereference in the PacketConn.ReadFrom log path, killing the process before per-request recovery can intervene. No public exploit identified at time of analysis, though the fixing PR includes a reproducer test that encodes the exact crashing byte sequence; not listed in CISA KEV.
Memory exhaustion denial-of-service affects HTTP/2 server implementations that fail to cap buffered response data under stalled flow-control conditions. A remote unauthenticated attacker opens many simultaneous HTTP/2 streams while advertising SETTINGS_INITIAL_WINDOW_SIZE = 0 or withholding WINDOW_UPDATE frames, forcing the server to accumulate unbounded in-memory response buffers it cannot transmit. Under permissive resource limits this can trigger OOM kills, swap exhaustion, and full system unresponsiveness; under tighter limits, connection and worker pool exhaustion degrades availability for legitimate clients. Reported 2026-07-16 by Okta Red Team and coordinated as CERT VU#885548 covering at least three CVE IDs (CVE-2026-59762, CVE-2026-59173, CVE-2026-44909) across multiple vendor implementations. No public exploit code identified at time of analysis, and CISA KEV listing not confirmed.
Memory-exhaustion denial of service in Meta's Proxygen HTTP library (versions v2017.01.16.00 through v2026.07.20.00) allows remote, unauthenticated attackers to force unbounded server-side buffering by abusing HTTP/2 flow control. Because the core HTTP session layer had no generalized slow-consumer detection, a client that advertises SETTINGS_INITIAL_WINDOW_SIZE of 0 or simply withholds WINDOW_UPDATE frames can stall many concurrent streams while fully-generated response bodies pile up in memory. No public exploit identified at time of analysis, but the technique is well-understood and the CVSS 7.5 availability impact is real against default deployments.
Denial of service in the Perl XML::Bare module (versions through 0.53) allows remote attackers to force an infinite loop by submitting malformed XML attributes to any application that parses attacker-controlled input with the library. The parserc_parse function fails to advance its cursor on certain malformed attribute forms, causing 100% CPU consumption and unresponsiveness. No public exploit identified at time of analysis, but the trivial reproducer strings published in the oss-security advisory make triggering it straightforward.
Denial of service in HTML::Bare through version 0.04, a Perl XML/HTML parsing module, allows remote unauthenticated attackers to hang the parsing process in an infinite loop by supplying malformed markup. The parserc_parse function fails to advance its attribute-parse cursor on certain malformed attribute forms - such as nameless attributes ("<a ='c'>") or unbalanced quotes ("<a b='''''''c'>") - causing the CPU to spin indefinitely. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 8th percentile), consistent with a resource-exhaustion bug rather than a high-value target.
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Uncontrolled memory allocation in Grafana Loki lets remote unauthenticated users issue queries with excessively large limit values, forcing the service to allocate large amounts of memory and potentially exhausting host resources. The impact is denial of service (CVSS 7.5, A:H only) and varies by deployment topology - a single-binary or under-provisioned deployment is far more exposed than a horizontally scaled microservices setup. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the input 'Information Disclosure' tag conflicts with the CVSS impact (C:N/I:N/A:H), which indicates an availability-only issue.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.
Denial of service in the Feast Feature Server (the Python feature-store serving component, also shipped within Red Hat OpenShift AI/RHOAI) lets remote unauthenticated attackers exhaust host resources through its `/ws/chat` WebSocket endpoint. Because the endpoint accepts unlimited concurrent connections and unbounded message traffic, opening many simultaneous sockets drains memory, CPU, and file descriptors until legitimate clients are locked out. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; the upstream fix in PR #192 caps connections, message size, and message rate.
Pre-authentication memory-exhaustion denial of service in Pomerium's identity-aware proxy (versions >= 0.32.6, < 0.32.8) lets remote unauthenticated attackers crash or degrade the proxy by delivering a zstd decompression bomb to the pre-auth `/.pomerium/callback` endpoint. Only deployments using the stateless/hosted authenticate flow (Pomerium Zero / authenticate.pomerium.app) are affected; self-hosted stateful deployments verify an HMAC signature first and are immune. A working proof-of-concept is included in the vendor advisory, though there is no public exploit identified as weaponized in the wild and no CISA KEV listing.
Remote unauthenticated Denial of Service in Datadog's dd-trace-rb Ruby tracing library (versions before 2.32.0) allows attackers to exhaust CPU and memory by sending HTTP requests with oversized or high-cardinality W3C `baggage` headers. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) limits were enforced only on injection and not extraction, the tracer allocates a hash-map entry per comma-separated pair on every request. Baggage propagation is enabled by default, so any internet-facing instrumented Ruby service is exposed; no public exploit was identified at time of analysis, and this CVE is not listed in CISA KEV.
Remote denial of service in Datadog's dd-trace-go APM library lets unauthenticated attackers exhaust CPU and memory on any instrumented HTTP service by sending an oversized W3C 'baggage' header. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safety limits were enforced only on baggage injection, not extraction, so a single crafted request with a huge number of comma-separated key-value pairs forces one hash-map allocation per pair on every request. Because baggage propagation is enabled by default, any internet-facing Go service using an affected tracer is exposed; there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote unauthenticated Denial of Service in the Datadog.Trace .NET tracing library (versions before 3.43.0) arises because W3C baggage HTTP headers are parsed on the extract path without enforcing the DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits that are only applied during injection. An attacker can send a single request with a baggage header containing an arbitrarily large number of comma-separated key-value pairs, forcing the tracer to allocate a hash-map entry per pair and exhausting CPU and memory. Because the baggage propagation style is enabled by default, any internet-facing service instrumented with an affected tracer is exposed; there is no public exploit identified at time of analysis and the CVSS is 7.5 (A:H only).
Remote unauthenticated Denial of Service in the Datadog dd-trace-js Node.js tracing library (versions < 5.100.0) allows attackers to exhaust CPU and memory by sending an HTTP request with an oversized W3C 'baggage' header. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) caps were enforced only on injection and not on the extraction path, the tracer allocates a hash-map entry per comma-separated pair on every request. With baggage propagation enabled by default, any internet-facing instrumented service is exposed. CVSS 3.1 base score is 7.5 (A:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote denial of service in Datadog's dd-trace-py Python tracing library (versions before 4.8.2) lets unauthenticated attackers exhaust CPU and memory by sending oversized W3C 'baggage' HTTP headers. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safeguards were enforced only on baggage injection, never on extraction, so a single crafted request with a huge number of comma-separated pairs forces the tracer to allocate a hash-map entry per pair on every request. Because the baggage propagation style is enabled by default, any reachable service instrumented with an affected tracer is exposed; no public exploit identified at time of analysis.
Remote denial of service in Datadog's dd-trace-java (dd-java-agent) tracing library affects any HTTP service instrumented with a version below 1.62.0 that has W3C baggage propagation enabled, which is the default. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) caps were enforced only on baggage injection and not on extraction, a remote unauthenticated attacker can send a single crafted 'baggage' header with a huge number of key-value pairs or one oversized value to exhaust CPU and memory. There is no public exploit identified at time of analysis and it is not on CISA KEV, but exploitation is trivially reliable (CVSS 7.5, AV:N/AC:L/PR:N).
Arbitrary file read and denial of service in Wekan (open-source Meteor kanban board) before version 9.31 allows an authenticated board member to read any file the server process can access by supplying attacker-controlled versions.original.path and versions.original.storage values to the /attachments/insert DDP method. Because the server-side insert permission rule only validates board write access and the filesystem store never confirms the path stays within the storage root, a low-privileged user can exfiltrate sensitive host files or hang the process by pointing at special files like /dev/zero. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a fixing commit and release (v9.31) are public.
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep, low-level command of the tunnel protocol to corrupt server-side memory management and keep the server down. The flaw carries a CVSS 4.0 base score of 8.7 driven entirely by an availability (VA:H) impact, with no confidentiality or integrity consequence. No public exploit identified at time of analysis and it is not listed in CISA KEV, so real-world exploitation appears unproven.
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel participant to permanently crash or wedge the server by abusing the tunnel protocol. The CVSS 4.0 vector (7.1, PR:L, VA:H) confirms an availability-only impact requiring some level of tunnel authentication, with no confidentiality or integrity effect despite a mislabeled 'Information Disclosure' tag. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Stack-based buffer overflow in TDengine (open-source IoT time-series database) versions 3.4.1.6 and earlier allows an authenticated user to trigger a one-byte out-of-bounds write by submitting SQL containing crafted escape sequences (\%, \_, or \x), leading to denial of service and potentially remote code execution. The flaw sits in the SQL parser's trimString() routine, which validates only a single byte of remaining space in the tmpTokenBuf stack buffer before writing escape-processed data. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in version 3.4.1.14.
Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.
Remote denial of service in the Netty networking framework (codec-haproxy module) versions 4.1.0.Final through 4.1.135 and 4.2.0.Final through 4.2.15.Final lets unauthenticated attackers exhaust JVM direct memory. The HAProxyMessageDecoder mis-parses a PROXY protocol v2 header whose version byte is 0xFF, sign-extending it to -1, which collides with the decoder's 'need more data' sentinel, so ByteToMessageDecoder accumulates inbound bytes in an unbounded cumulation buffer until the process runs out of direct memory. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity effect.
Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 stems from a heap-based buffer overflow in the set_ap_param command exposed by the /localcfg endpoint. An authenticated attacker who can reach the device's local configuration interface can send oversized input to crash the charger or potentially execute arbitrary code on it. Publicly available exploit code exists (published by CyberDanube), and the CVSS 4.0 base score is 9.4, though there is no evidence of active exploitation in the CISA KEV catalog at time of analysis.
Remote denial of service in Ollama (HEAD f0078ae) allows unauthenticated attackers to crash the entire server by uploading a sub-1KB crafted GGUF file whose attacker-controlled string lengths, tensor dimension counts, and metadata array counts are trusted as allocation sizes without bounds checking against the remaining file size. Reachable through the blob upload plus model create/pull API endpoints, the flaw triggers unrecoverable Go runtime out-of-memory fatal errors or makeslice panics that bypass the server's recovery middleware, taking down the whole process rather than a single request. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but a vendor patch is available and VulnCheck has published an advisory.
Denial of service in Amazon's smithy-rs code generation framework allows remote attackers to abort the process via stack exhaustion by sending a small request containing deeply nested data that matches a recursive model shape. The flaw affects generated deserializers for JSON, CBOR, and XML across the AWS SDK for Rust and any custom clients or servers built with smithy-rs codegen; because deserialization runs before business logic, a compact malicious payload can crash the target. This carries a CVSS 4.0 base score of 8.7 (availability-only impact), and no public exploit was identified at time of analysis.
Denial of service in the golang.org/x/text/unicode/norm package (versions before 0.39.0) allows remote attackers to cause an unrecoverable infinite loop by supplying input containing invalid UTF-8 bytes to a norm.Iter. Any Go service that Unicode-normalizes untrusted input using this widely-used supplementary library can be hung with a single malformed request, consuming CPU until the process is killed. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile), but the network-reachable, no-authentication, no-interaction profile makes it broadly triggerable.
Denial of service in websocket-driver-ruby (all versions before 0.8.2) allows any unauthenticated remote client to crash a Ruby WebSocket server process by sending an HTTP Upgrade request containing a syntactically invalid Host header value. The root cause is an unhandled URI::InvalidURIError exception raised during Host header parsing in the request.complete() method, which propagates uncaught to the top level and terminates the server process. No public exploit has been identified at time of analysis, but the attack technique is trivially constructible from the CVE description and the published patch diff alone.
Denial of service in Atlassian Confluence Data Center allows an authenticated attacker to render the application unavailable to legitimate users by triggering resource exhaustion that disrupts the host's services. Affected releases span the 9.0.x through 10.2.x branches, with a CVSS 4.0 score of 7.1 (High) driven entirely by availability impact. No public exploit has been identified at time of analysis; the flaw was discovered internally via Atlassian's penetration testing program rather than through in-the-wild activity.
Denial of service in React's Server Components runtime (react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack) lets remote unauthenticated attackers spike CPU to exhaustion by POSTing specially crafted HTTP requests to Server Function ('use server') endpoints across versions 19.0.0-19.0.7, 19.1.0-19.1.8, and 19.2.0-19.2.7. The flaw was reported by Meta (React's maintainer) and carries CVSS 7.5 (availability-only impact). No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and CISA SSVC scores exploitation as none, indicating a real but non-urgent memory-safety fix.
Denial of service in libssh affects clients that use automatic certificate-based public key authentication, where logic errors cause the client to loop indefinitely when configured certificates are absent or are repeatedly rejected by the SSH server. Reported by Red Hat and shipped in Red Hat Enterprise Linux 8, 9, and 10 plus Red Hat Hardened Images, the flaw lets a hostile or misconfigured server hang a connecting client and consume CPU. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile), consistent with an availability-only, client-side bug rather than a mass-exploited issue.
Remote denial-of-service in Mozilla Firefox's Graphics: WebGPU component allows a malicious web page to exhaust browser resources and crash or hang the browser without any user credentials or interaction. The flaw affects Firefox versions prior to 153 and is triggered simply by loading attacker-controlled content that abuses the WebGPU API. There is no public exploit identified at time of analysis, and EPSS scores the exploitation likelihood at only 0.14%, indicating low near-term probability of widespread exploitation.
Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let remote attackers submit a crafted Fory-serialized payload that triggers a use-after-free, causing undefined behavior, process crashes, or leakage of adjacent process memory. The flaw affects any service that deserializes untrusted Fory data using the Rust implementation, and Apache has published a fixed release (1.4.0). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile), but the network-reachable, unauthenticated attack surface makes it a meaningful hardening priority for exposed services.
Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.Final) allows a remote peer to send a small zlib-compressed SPDY HEADERS block that Netty keeps inflating even after the raw header parser exceeds maxHeaderSize and marks the frame truncated in SpdyFrameCodec. The result is disproportionate CPU consumption and allocation churn (CWE-400) from a tiny input, degrading or crashing services that expose the SPDY codec. No public exploit identified at time of analysis and it is not listed in CISA KEV; impact is availability-only per CVSS 7.5 (A:H).
Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16.Final allows a remote unauthenticated peer to send a single ~2 MiB SPDY SETTINGS frame that forces the server to materialize 262,144 map entries in DefaultSpdySettingsFrame, driving heap growth and ordered-map insertion CPU cost far out of proportion to the input. Affected are Java services that enable Netty's SPDY handler and accept untrusted connections; there is no public exploit identified at time of analysis, and while CVSS is 7.5 the low EPSS-style real-world footprint is tempered by SPDY/3.1 being a deprecated, rarely-enabled protocol.
Denial of service in the Net::DNS Perl library (versions through 1.55) lets a remote attacker crash any application that parses untrusted DNS messages by sending a crafted response with a deeply nested chain of compression pointers. Net::DNS::DomainName::decode recurses once per pointer with no depth cap, so a chain of ~8191 (UDP/14-bit) to ~32767 (TCP/16-bit) two-byte pointers exhausts Perl's C stack and triggers SIGSEGV. EPSS is low (0.20%, 10th percentile) and there is no public exploit identified at time of analysis, though CPANSec/oss-security disclosure provides enough detail to reconstruct a trigger.
Denial of service in libcupsfilters and cups-filters (the OpenPrinting image-filtering stack bundled with Red Hat Enterprise Linux 7 through 10) allows an unauthenticated attacker to abort the CUPS image filter by submitting a specially crafted PNG print job. The PNG reader instantiates a libpng decoder without registering an error-recovery handler, so a malformed image triggers libpng's default fatal-error path and terminates the filter process, killing the in-flight print job. No public exploit identified at time of analysis; this is a print-job availability issue, not a code-execution or data-exposure flaw.
Stack-based buffer overflow in rsyslog's optional mmpstrucdata module allows a remote, unauthenticated attacker to crash the rsyslog process and interrupt log collection, with theoretical code execution on weakly hardened builds. Affected versions span rsyslog 7.5.4 through 8.2605.x; the fix is included in 8.2606.0. No public exploit code or active exploitation has been confirmed, but the crash was independently reproduced over both TCP and UDP on Debian 12 with rsyslog 8.2302.0, and the corrective PR (#6991) was merged publicly before coordinated disclosure completed.
Privilege escalation in HCL Commerce (versions 7 through 9.1.19) allows an authenticated low-privileged user to elevate their rights and perform unauthorized administrative operations, disclose other users' personal data, and cause denial of service. The flaw is network-reachable with low attack complexity and requires only existing low-level credentials, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis; the issue was self-reported by HCL and is not listed in CISA KEV.
Denial of service in FreeRDP servers (versions <=3.27.1) allows unauthenticated remote attackers to crash the service by forging a malicious encrypted client random during RDP Standard Security negotiation. Because the server publishes its RSA public key, an attacker can craft a ciphertext whose decrypted plaintext spans the full RSA modulus (up to 256 bytes for RSA-2048), overflowing a fixed 32-byte heap buffer in crypto_rsa_common() by roughly 224 attacker-controlled bytes before any authentication occurs. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix landed in FreeRDP 3.28.0.
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single WebSocket message by sending a deeply nested JSON payload to the /rpc endpoint. The value/JSON parser ignores the configured recursion depth limit for nested braces, brackets, and parentheses, so uncontrolled recursion (CWE-674) exhausts server memory and terminates the process. This is an incomplete-fix regression of GHSA-6r8p-hpg7-825g, which patched the same bug class in the expression parser but missed the value/JSON code path; no public exploit identified at time of analysis, though the trigger is trivially reproducible from the advisory.
Denial of service in SurrealDB before 3.1.0 lets an authenticated user with query-execution privileges crash the server with a single WebSocket message. The type/kind parser fails to enforce the configured recursion depth limit when parsing deeply nested type annotations (e.g. array<option<array<option<...>>>>), driving uncontrolled recursion that exhausts server memory and terminates the process. No public exploit identified at time of analysis and not listed in CISA KEV, but the flaw is trivially triggerable and is an incomplete fix of a previously patched bug class (GHSA-6r8p-hpg7-825g).
Denial of service in SurrealDB before 3.1.0 allows an authenticated user holding only 'select' permission on a table to indefinitely block all CREATE, UPDATE, and DELETE operations on that table for every other user - including root. By registering a LIVE query whose WHERE clause deterministically throws an evaluation error (e.g. calling a typed SurrealQL function with a wrong-typed argument), the resulting error propagates into the write path and rolls back the triggering modification. No public exploit identified at time of analysis, but the technique is fully documented in the vendor's GHSA advisory.
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process with a single WebSocket message to the /rpc endpoint. Sending an RPC 'use' call that sets a database (db) without first selecting a namespace triggers a Rust panic on an .expect() call; because surrealdb-core is compiled with panic = 'abort', the panic aborts the whole process rather than the connection. The vulnerability (CVSS 4.0 8.7, VulnCheck/GHSA-wjjj-24cx-f28g) requires no credentials, token, or --allow-guests flag, and no public exploit has been identified at time of analysis.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire server process with a single crafted query. Submitting a flat operator chain of tens of thousands of terms (e.g. RETURN 1 + 1 + 1 + ...) builds an unbounded expression tree that overflows the thread stack when later walked recursively, aborting the process and denying service to every namespace and database on the instance. No public exploit identified at time of analysis; impact is availability-only with an EPSS-independent CVSS 4.0 score of 7.1.
Denial-of-service in the Linux kernel iwlwifi mvm WiFi driver affects older Intel wireless adapters such as the 7265D, where a regression in TX-rate encoding sets TX_CMD rates incorrectly. When the device reports these malformed rates back, the driver can emit warnings and, for beacon rates, trigger a firmware assert/crash that disrupts wireless connectivity. This is a fixed regression with no public exploit identified at time of analysis and a low EPSS score (0.15%), indicating negligible real-world exploitation interest.
Denial of service in the Linux kernel's Intel iwlwifi 'mld' Wi-Fi driver allows a firmware crash on Intel BE201/Wi-Fi 7 adapters to spiral into sustained resource exhaustion. Because iwl_mld_tx_from_txq() failed to check the in_hw_restart flag, TX frames kept being dequeued and pushed to dead firmware, each returning -EIO and being freed in a tight loop that burns CPU and churns skb allocations, causing slab fragmentation and memory pressure. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and the issue is not on CISA KEV; it is a reliability/availability bug that manifests under real load, not an attacker-driven remote exploit.
Improper error handling in the Linux kernel's pds_core driver (AMD Pensando Distributed Services Card core driver) causes pdsc_devcmd_wait() to return stale success from the completion register when firmware crashes or a device command times out, instead of propagating -ENXIO or -ETIMEDOUT. Because the error path is bypassed, the driver fails to queue health_work recovery, leaving the device in an inconsistent state and producing an availability (denial-of-service) condition. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and the issue is not on the CISA KEV list.
Remote denial of service in the Linux kernel's ksmbd in-kernel SMB3 server allows an attacker to trigger a NULL-pointer dereference and kernel panic during SMB2 CREATE lease processing. After a SESSION_LOGOFF, a stale opinfo remains linked in the per-ClientGuid lease list with its conn pointer cleared; a subsequent session reusing the same ClientGuid and taking a lease on a different inode causes compare_guid_key() to dereference the NULL conn->ClientGUID. Exploitation requires only a successful SMB2 SESSION_SETUP against a share with 'durable handles = yes'; no public exploit is identified at time of analysis and EPSS risk is low (0.17%).
Kernel-panic denial of service in the Linux kernel's in-kernel SMB server (ksmbd) allows the file-pointer table to retain a durable-handle file object with a NULL tcon after a client issues SMB2 SESSION_LOGOFF; any subsequent read of /proc/fs/ksmbd/files then dereferences the NULL fp->tcon in proc_show_files() and crashes the host. Affected are kernels running ksmbd on shares configured with 'durable handles = yes'. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), consistent with a stability/robustness bug rather than a weaponizable RCE.
Denial of service in the Linux kernel ALSA PCM subsystem allows a local low-privileged user with sound-device access to crash the system on RISC-V hardware. During the transition to iov_iter for PCM data transfer, the silencing path (data = NULL) reused the interleaved iov_iter setup, producing a bogus iterator that triggers a NULL pointer dereference; on most other architectures it was benign, but RISC-V faults. No public exploit is identified at time of analysis, and EPSS risk is low at 0.17% (6th percentile). The kernel tags flag potential information disclosure, though the concretely described symptom is a crash.
Denial-of-service and memory corruption in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver occurs when RBUF_EEE_EN and RBUF_PM_EN are set in RBUF_ENERGY_CTRL and MAC Energy-Efficient Ethernet becomes active, silently halting the RX path while the link stays up and, on some boards, triggering a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. It affects Linux systems using Broadcom GENET NICs (e.g. Raspberry Pi 4B/BCM2711, Broadcom 4908-family SoCs), and is triggered by default now that phy_support_eee() enables EEE automatically, or on older kernels once TX LPI is enabled via ethtool. No public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile), and the CISA-KEV / attacker-controlled framing implied by the CVSS 9.8 does not match the local hardware-interaction nature of the bug.
Denial of service in the Linux kernel's IPv6 In-situ OAM (IOAM) processing path allows remote attackers to crash the system via a NULL pointer dereference in ipv6_hop_ioam(). The function dereferences the result of __in6_dev_get(skb->dev) to read cnf.ioam6_enabled without checking for NULL, so a packet carrying an IOAM Hop-by-Hop option that arrives while addrconf_ifdown() concurrently clears dev->ip6_ptr via RCU can trigger a kernel panic. EPSS is low (0.18%), no public exploit or CISA KEV entry exists, and the fix ships in multiple stable kernel releases; the availability-only impact (CVSS 7.5, A:H) reflects a crash rather than code execution or data exposure.
Use-after-free (CWE-416) in the Linux kernel nvme-pci driver allows a local attacker or triggerable hardware condition to crash the kernel or potentially corrupt memory. The nvme_free_host_mem() function frees dev->hmb_sgt but never clears the pointer, so a double-call during an error path in nvme_probe() dereferences the freed and zeroed DMA structure, causing a NULL pointer dereference in iommu_dma_free_noncontiguous(). Observed reliably on Thunderbolt-attached NVMe devices with PCIe link instability; no public exploit or active exploitation identified at time of analysis.
Remote denial of service in the Linux kernel's SMC-D (Shared Memory Communications over ISM) client allows a malicious peer to crash the system via a null-pointer dereference during SMC-Dv2 connection setup. When a client sends an SMC-Dv2-only proposal and no SMC-Dv1 device is selected, a peer that replies with an ACCEPT containing CHID value 0 matches the reserved empty slot 0 of the ism_dev[] array, causing a null-ptr-deref on ism_dev[0]->lgr_lock in smc_conn_create(). No public exploit identified at time of analysis; EPSS is low (0.17%) and it is not listed in CISA KEV, but the fix is upstream in the kernel stable tree.
Use-after-free in the Linux kernel's in-kernel OpenVPN data channel offload (ovpn) TCP transport allows a local attacker to corrupt kernel memory by racing a TCP socket close against peer removal. The flaw lives in ovpn_tcp_close(), which caches a peer pointer under an RCU read lock but then escapes and dereferences sock->peer after the lock is dropped and without holding lock_sock(), so ovpn_socket_release() can free the socket concurrently. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the CVSS 8.4 rating reflects full high impact to confidentiality, integrity, and availability if the race is won. A vendor patch is available.
Remote kernel crash in the Linux kernel's mac80211 WiFi stack affects WiFi 7 (802.11be) clients: the ieee80211_ml_epcs() handler fails to bounds-check the 4-bit link_id (0-15) extracted from an EPCS PER_STA_PROFILE subelement, but sdata->link[] holds only 15 entries (indices 0-14), so link_id=15 reads out of bounds. A connected access point can send an EPCS Enable Response action frame with link_id=15 to read a garbage pointer that bypasses the NULL check and is dereferenced in ieee80211_sta_wmm_params(), crashing the kernel. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and this is a denial-of-service (kernel panic) rather than the code-execution/data-disclosure implied by the vendor CVSS.
Local denial of service in the Linux kernel's AF_IUCV networking stack allows any unprivileged user on an s390/IBM Z host to crash the machine by racing recvmsg() against getsockopt(SO_MSGSIZE) on a HiperSockets (HIPER) socket. The .getsockopt handler dereferenced iucv->hs_dev->mtu without holding lock_sock(), so a concurrent iucv_sock_close() (triggered from recvmsg) could set hs_dev to NULL between the check and the dereference, producing a NULL pointer dereference oops. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the upstream fix wraps the entire getsockopt switch in lock_sock()/release_sock() to mirror the existing setsockopt locking.
Use-after-free in the Linux kernel net/handshake subsystem (kernel 6.4 through the fixed 7.x builds) lets a concurrent handshake consumer free a struct socket and its backing file while the netlink accept path (handshake_nl_accept_doit) is dereferencing them, producing a NULL pointer read or freed-memory access. The flaw is a race between handshake_req_next() dropping hn_lock and the accept side reaching FD_PREPARE(), during which tls_handshake_cancel() plus sockfd_put()/__fput_sync() can release the object. No CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and the tags classify the practical impact as Denial of Service.
Denial-of-service (kernel crash) in the Linux kernel Bluetooth L2CAP subsystem lets an in-range attacker trigger memory corruption by sending a crafted Enhanced Credit-Based (ECRED) connection response that reuses an already-assigned destination CID, corrupting the list_for_each_entry_safe cursor during channel teardown. All Linux systems with Bluetooth enabled and processing LE CoC ECRED channels are affected until patched. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile); the issue is not listed in CISA KEV.
Denial of service in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver allows the port reset recovery path to trigger a NULL pointer dereference and kernel crash. The flaw occurs when mana_per_port_queue_reset_work_handler() runs after a prior detach succeeded but a subsequent attach failed, leaving apc->tx_qp and apc->rxqs freed; a second unconditional mana_detach() then dereferences NULL during queue teardown. No public exploit has been identified, EPSS is low (0.20%, 10th percentile), and the CVSS 3.1 score is 7.5 driven purely by availability impact.
Denial of service in the Linux kernel's IPv6 routing stack allows remote attackers to trigger an infinite loop in fib6_select_path(), hanging a CPU in softirq context and causing a system-wide hang or hard lockup. The flaw exists because writers holding tb6_lock can list_del_rcu() a route's fib6_siblings entry without waiting for RCU readers, leaving the softirq-side path-selection walker traversing a stale sibling ring that never reaches its list terminator. A vendor patch is available; EPSS is low (0.21%) and there is no public exploit identified at time of analysis, but the network-triggerable, no-privilege CVSS 7.5 vector makes it a meaningful availability risk on multipath IPv6 deployments.
Local denial-of-service in the Linux kernel's HPFS (High Performance File System) driver allows a crash when hpfs_map_dnode_bitmap fails and the code subsequently calls hpfs_brelse4 on an uninitialized quad buffer head. Affected are Linux kernels prior to the fixed stable releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1) when an HPFS filesystem is mounted. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is very low (0.21%), consistent with a niche legacy-filesystem bug rather than a broadly weaponizable flaw.
Local privilege escalation or denial of service in the Linux kernel's zram block device (writeback path) stems from a use-after-free in zram_writeback_endio, where the bio completion handler calls wake_up() on wb_ctl->done_wait after the writeback task may have already observed num_inflight reach zero and freed wb_ctl via release_wb_ctl(). Affecting kernels around 6.19/7.0 with zram writeback in use, a local attacker who can drive zram writeback activity may trigger the race to corrupt kernel memory, crashing the system or potentially escalating privileges. There is no public exploit identified at time of analysis and EPSS is low (0.21%), consistent with a hard-to-win kernel race rather than a trivially weaponizable bug.
Memory-management memory corruption in the Linux kernel's reverse-mapping (rmap) code lets a local, low-privileged user crash the system by corrupting folio refcount/mapcount state. The flaw lives in try_to_unmap_one() (mm/rmap.c), where the nr_pages counter is not reset to 1 at the start of each page-table-walk iteration, so a stale batch count from a prior lazyfree folio unmap is reused against a device-exclusive PTE. No public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile); the demonstrated userspace-visible effect is a kernel crash (denial of service).
Local privilege escalation or denial of service in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem arises from a race condition where iso_sock_close() calls iso_sock_clear_timer() before taking the socket lock, letting a concurrent iso_conn_del() free the connection object and trigger a NULL pointer dereference or use-after-free. Any local user able to open and close AF_BLUETOOTH ISO sockets can race the two code paths; UAF of a kernel connection structure can escalate from a crash to memory corruption. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Privilege-independent local crash in the Linux kernel's parport (parallel port) subsystem allows a race between port registration and client-driver attachment, where drivers such as lp bind to ports that are not yet fully initialised or are being torn down, causing a NULL/use-after-free style kernel crash. Affects systems where parport_pc and lp are built as modules and loaded concurrently during boot with PC-style parallel-port hardware present. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not listed in CISA KEV, consistent with the vendor 'Denial Of Service' tag rather than code execution.
Local denial-of-service (and potential information disclosure) in the Linux kernel's dwc2 USB host controller driver, where debug code dereferences the 'urb' structure after it has already been handed back via usb_hcd_giveback_urb(), causing a use-after-free read of freed memory. The flaw affects systems using the DesignWare HS OTG USB 2.0 controller driver (common on ARM SoCs such as Raspberry Pi). It is patched upstream, has no public exploit identified at time of analysis, and carries a low EPSS score (0.21%).
Memory corruption in the Linux kernel's mac802154 IEEE 802.15.4 link-layer security (llsec) subsystem allows an adjacent attacker to trigger a slab use-after-free and data corruption by sending 802.15.4 frames to a host with link-layer security enabled. The llsec encrypt/decrypt routines perform in-place crypto on socket buffer data that may be shared across skb clones, so modifying it corrupts memory still referenced by other clones. No public exploit has been identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not in CISA KEV, but a vendor patch is available.
Out-of-bounds memory writes in the Linux kernel's gcov code-coverage instrumentation can corrupt memory and crash the system when inflate_fast() (zlib decompression) runs concurrently on multiple CPUs, most notably during IPComp/IPsec (xfrm_input) packet decompression. GCC merges the global GCOV branch counter with loop induction variables, so simultaneous execution reloads the shared counter mid-loop and computes an index that wrote ~3.4 MB past a 65 KB buffer. This only affects kernels built with GCOV profiling enabled; there is no public exploit identified at time of analysis and EPSS is very low (0.17%).
Memory corruption in the Linux kernel's exFAT filesystem driver allows a crafted exFAT image to trigger a use-after-free in exfat_find_dir_entry(): the buffer_head backing the directory entry (bh) is released via brelse() before the fall-through TYPE_EXTEND branch still reads through the ep pointer into bh->b_data. Any system that mounts an attacker-supplied exFAT volume (e.g. a USB stick or disk image with a long filename engineered to force same-hash collisions down the TYPE_EXTEND path) is affected; the stale dereference can fault or corrupt kernel memory. No public exploit identified at time of analysis, and the input CVSS 9.8/AV:N score is not credible for a local filesystem-parsing bug that the reporter could only trigger under instrumentation (KASAN + DEBUG_PAGEALLOC with a debug invalidate_bdev()).
Use-after-free in the Linux kernel NFS server (nfsd) pNFS layout code allows an NFSv4.1+ client to leave a freed layout state ID published in the client's IDR when nfsd4_layout_setlease() fails, so any later IDR walk (states_show, client teardown) dereferences a dangling slab pointer. The affected component is the pNFS block/SCSI/flexfiles layout server path on kernels between commit c5c707f96fc9 and the fixed stable releases. No public exploit has been identified and it is not in CISA KEV; the practical impact is kernel memory corruption leading to crash (DoS) and possible information disclosure per the vendor tag, though the auto-assigned CVSS of 9.8 significantly overstates real-world exploitability.
Remote denial-of-service in the Linux kernel NFSv4 flexfiles (pNFS) client allows a malicious or compromised NFS server to crash a mounting client via a malformed flexfiles layout that declares a zero filehandle-version count. The flaw stems from ff_layout_alloc_lseg() accepting fh_count == 0, which produces a ZERO_SIZE_PTR that is later dereferenced during layoutreturn encoding, triggering a null-pointer-deref and kernel panic. No public exploit identified at time of analysis, though the commit includes a QEMU/KASAN reproducer; CVSS 7.5 reflects availability-only impact (A:H) with no confidentiality or integrity effect.
Remote denial of service in the Linux kernel's NFSv4/pNFS flexfiles client allows a malicious or compromised NFS metadata server to crash any mounted client by returning a GETDEVICEINFO response containing a zero-length r_addr or r_netid opaque. The decoder nfs4_decode_mp_ds_addr() only checks for negative lengths, so a zero-length value leaves the buffer pointer NULL and the subsequent strrchr(NULL, '.') triggers a kernel NULL-pointer dereference and panic. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a targeted server-side trust attack rather than mass exploitation.
Denial of service in the Linux kernel in-kernel SMB3 server (ksmbd) lets remote, unauthenticated clients crash the ksmbd worker via a crafted COMPOUND request. Because smb2_check_user_session() skips the SMB2_SESSION_VALID state check for non-first compound operations and treats a SessionId of 0xFFFFFFFFFFFFFFFF as automatically valid, a TREE_CONNECT chained onto a half-open session (created by an NTLM Type-1 negotiate blob, sess->user still NULL) reaches ksmbd_ipc_tree_connect_request() and dereferences a NULL pointer, wedging the worker for all clients. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis.
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash the per-connection server child with a single malformed packet. The flaw stems from an unsigned integer underflow and a size_t-to-int truncation that fools the allocator into returning a ~512-byte block while the caller believes it received ~4 GB, causing an attacker-controlled heap overflow past a 544-byte allocation. Publicly available exploit code exists (a VulnCheck proof of concept) demonstrating reliable DoS; heap metadata corruption and consequences beyond DoS are theorized but not demonstrated, and there is no public exploit identified for code execution.
Denial of service and heap corruption in OpenPLC_v3 lets an authenticated web-interface user overflow the 100-byte MB_device.dev_name buffer via an oversized device_name field on the /modbus endpoint. Because getData() in modbus_master.cpp copies delimiter-bounded characters with no bounds check, a ~200-byte value writes 100 bytes past the allocation, overwriting adjacent Modbus config fields (protocol, dev_address, ip_port) and crashing the PLC control loop. No public exploit identified at time of analysis, though VulnCheck published a detailed technical advisory; the affected repository is archived and no vendor-released patch was identified.
Unauthenticated remote denial of service in the JLine3 remote-telnet server module (versions before 3.30.14, 4.0.16, and 4.2.1) lets an attacker crash the JVM by flooding the Telnet NEW-ENVIRON negotiation with unbounded unique environment-variable pairs. Because TelnetIO.readNEVariables() stores every pair in an uncapped HashMap on ConnectionData before login, roughly 3-4 MB of traffic can exhaust a 512 MB heap and force an OutOfMemoryError. No public exploit code is identified, but the vendor advisory (GHSA-47qp-hqvx-6r3f) documents proof-of-concept methodology; the flaw is not listed in CISA KEV and no EPSS score was supplied.
Denial of service in the JLine3 Telnet server (jline-remote-telnet module) lets an unauthenticated remote attacker exhaust server CPU by abusing the Telnet NAWS window-size option. Because TelnetIO enforces only a lower bound on terminal dimensions, a client can advertise a 65535x65535 terminal and repeatedly alternate values to force continuous, expensive redisplay/rendering cycles. Publicly available exploit code exists (a raw two-packet Telnet PoC is published in the vendor GHSA advisory), and there is no public exploit identified as being actively exploited; the issue is fixed in 3.30.14, 4.0.16, and 4.2.1.
Denial of service in IBM Engineering Lifecycle Management's DOORS component exposes unauthenticated remote attackers to crash or degrade the service by submitting XML payloads exploiting recursive entity expansion. Affected deployments span three active release branches - 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 including Interim Fix 001. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.36% (28th percentile) confirms low current exploitation activity, but the unauthenticated network vector makes remediation advisable for internet-facing or low-trust-network deployments.
Uncontrolled memory consumption in IBM PowerVM NovaLink lets a remote, unauthenticated attacker send a specially-crafted request that drives the server to exhaust memory resources, degrading or halting availability of the virtualization management layer. The CVSS 3.1 base score is 7.5 (High) with an availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and a vendor patch is available.
Wallet-draining denial of service in ZenHive mpp (Elixir library) versions 0.2.0 through 0.5.x affects deployments configured as a Tempo fee payer (fee_payer: true), where the MPP.Methods.Tempo method co-signs and broadcasts a client-supplied EVM transaction without verifying the client's gas_limit is high enough to complete execution. An unauthenticated remote client can submit a signed transferWithMemo transaction with gas_limit set just below the required amount, causing an on-chain out-of-gas revert that still charges the sponsor's fee-payer wallet while the attacker pays nothing. There is no public exploit identified at time of analysis and this is not on CISA KEV, but repeated low-cost requests can exhaust the sponsor wallet and stop the server from funding gas for legitimate payment requests.
Remote denial of service in the h2o HTTP server (all versions prior to commit 9265bdd) allows unauthenticated attackers to exhaust server memory by combining HPACK header-decompression amplification with Slowloris-style HTTP/2 stream stalling. By opening many streams that stall mid-request, an attacker forces the server to retain large volumes of amplified decoded header state, degrading or crashing the service. There is no public exploit identified at time of analysis, and the CVSS 7.5 (A:H only) reflects an availability-only impact with no confidentiality or integrity effect.
Local privilege escalation and silent denial-of-service in the Wazuh Windows agent (versions 4.6.0 through 4.14.4) arise from a heap-based buffer overflow in the syscheck registry-monitoring component. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, a low-privileged local user who creates a 255-character registry subkey under a monitored wildcard path can trigger an out-of-bounds heap write, either blinding the agent or potentially executing code as SYSTEM. Proof-of-concept exploit code exists (SSVC: poc), but it is not in CISA KEV and EPSS is very low (0.09%, 1st percentile), consistent with the local-only, non-automatable attack profile.
Denial of service in the h2o HTTP server (all versions prior to commit 6b5370d) allows remote unauthenticated attackers to crash the server by requesting static files whose on-stack path construction via alloca can reach ~600KB, exceeding musl libc's default 128KB pthread stack and triggering a guard-page segmentation fault. The flaw is a CWE-770 uncontrolled resource allocation issue affecting availability only (CVSS 7.5, A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but exploitation is trivial where h2o is built against musl libc.
Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corrupt connection state and crash the process prior to commit 8b178e6. Quicly's packet decoder accepts Connection IDs up to 255 bytes (permitted for unknown QUIC versions) but its version-1 CID buffers are only 20 bytes, and the library - unlike its bundled CLI - never rejected over-length CIDs, letting an oversized CID overrun the buffer within its allocated chunk and trigger assertion failures. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote denial of service in quicly, the IETF QUIC implementation used by the H2O HTTP server, allows unauthenticated attackers to crash the process by sending more than 32KB of valid handshake messages over the CRYPTO stream within a single packet number space, tripping a reachable assertion (CWE-617). Affects all builds prior to commit 937d0e9. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the network-reachable, no-privilege nature makes it trivially triggerable once understood.
Memory exhaustion in Quicly's QUIC flow control handling allows an unauthenticated remote peer to force disproportionate receive buffer allocation in the H2O HTTP server by sending STREAM frames containing a single byte placed at the maximum permitted stream offset. The library pre-allocates buffers up to the largest received offset to accommodate out-of-order delivery, so a handful of crafted packets can cause the server to allocate memory far exceeding what the transferred data warrants. Under H2O's default stream concurrency settings, this attack multiplies per-connection memory usage by roughly 4x, making memory exhaustion achievable at low bandwidth cost. No public exploit identified at time of analysis; EPSS is 0.25% (16th percentile) and CISA SSVC lists exploitation as 'none', suggesting no observed real-world abuse.
Denial of service in NASA's Core Flight System (cFS) Health & Safety (HS) application allows a remote attacker to crash the application through a NULL pointer dereference triggered while processing a routine Housekeeping Telemetry request. All HS versions prior to v7.0.1 are affected; the crash produces a segmentation fault that halts the health-monitoring task. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a CISA ICS advisory (ICSA-26-197-03) and vendor-tagged fix release exist.
Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server with a single 28-byte UDP datagram when the proxyproto plugin is enabled. The malformed PROXY protocol v2 header triggers a nil pointer dereference in the PacketConn.ReadFrom log path, killing the process before per-request recovery can intervene. No public exploit identified at time of analysis, though the fixing PR includes a reproducer test that encodes the exact crashing byte sequence; not listed in CISA KEV.
Memory exhaustion denial-of-service affects HTTP/2 server implementations that fail to cap buffered response data under stalled flow-control conditions. A remote unauthenticated attacker opens many simultaneous HTTP/2 streams while advertising SETTINGS_INITIAL_WINDOW_SIZE = 0 or withholding WINDOW_UPDATE frames, forcing the server to accumulate unbounded in-memory response buffers it cannot transmit. Under permissive resource limits this can trigger OOM kills, swap exhaustion, and full system unresponsiveness; under tighter limits, connection and worker pool exhaustion degrades availability for legitimate clients. Reported 2026-07-16 by Okta Red Team and coordinated as CERT VU#885548 covering at least three CVE IDs (CVE-2026-59762, CVE-2026-59173, CVE-2026-44909) across multiple vendor implementations. No public exploit code identified at time of analysis, and CISA KEV listing not confirmed.
Memory-exhaustion denial of service in Meta's Proxygen HTTP library (versions v2017.01.16.00 through v2026.07.20.00) allows remote, unauthenticated attackers to force unbounded server-side buffering by abusing HTTP/2 flow control. Because the core HTTP session layer had no generalized slow-consumer detection, a client that advertises SETTINGS_INITIAL_WINDOW_SIZE of 0 or simply withholds WINDOW_UPDATE frames can stall many concurrent streams while fully-generated response bodies pile up in memory. No public exploit identified at time of analysis, but the technique is well-understood and the CVSS 7.5 availability impact is real against default deployments.
Denial of service in the Perl XML::Bare module (versions through 0.53) allows remote attackers to force an infinite loop by submitting malformed XML attributes to any application that parses attacker-controlled input with the library. The parserc_parse function fails to advance its cursor on certain malformed attribute forms, causing 100% CPU consumption and unresponsiveness. No public exploit identified at time of analysis, but the trivial reproducer strings published in the oss-security advisory make triggering it straightforward.
Denial of service in HTML::Bare through version 0.04, a Perl XML/HTML parsing module, allows remote unauthenticated attackers to hang the parsing process in an infinite loop by supplying malformed markup. The parserc_parse function fails to advance its attribute-parse cursor on certain malformed attribute forms - such as nameless attributes ("<a ='c'>") or unbalanced quotes ("<a b='''''''c'>") - causing the CPU to spin indefinitely. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 8th percentile), consistent with a resource-exhaustion bug rather than a high-value target.
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Uncontrolled memory allocation in Grafana Loki lets remote unauthenticated users issue queries with excessively large limit values, forcing the service to allocate large amounts of memory and potentially exhausting host resources. The impact is denial of service (CVSS 7.5, A:H only) and varies by deployment topology - a single-binary or under-provisioned deployment is far more exposed than a horizontally scaled microservices setup. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the input 'Information Disclosure' tag conflicts with the CVSS impact (C:N/I:N/A:H), which indicates an availability-only issue.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.
Denial of service in the Feast Feature Server (the Python feature-store serving component, also shipped within Red Hat OpenShift AI/RHOAI) lets remote unauthenticated attackers exhaust host resources through its `/ws/chat` WebSocket endpoint. Because the endpoint accepts unlimited concurrent connections and unbounded message traffic, opening many simultaneous sockets drains memory, CPU, and file descriptors until legitimate clients are locked out. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; the upstream fix in PR #192 caps connections, message size, and message rate.
Pre-authentication memory-exhaustion denial of service in Pomerium's identity-aware proxy (versions >= 0.32.6, < 0.32.8) lets remote unauthenticated attackers crash or degrade the proxy by delivering a zstd decompression bomb to the pre-auth `/.pomerium/callback` endpoint. Only deployments using the stateless/hosted authenticate flow (Pomerium Zero / authenticate.pomerium.app) are affected; self-hosted stateful deployments verify an HMAC signature first and are immune. A working proof-of-concept is included in the vendor advisory, though there is no public exploit identified as weaponized in the wild and no CISA KEV listing.
Remote unauthenticated Denial of Service in Datadog's dd-trace-rb Ruby tracing library (versions before 2.32.0) allows attackers to exhaust CPU and memory by sending HTTP requests with oversized or high-cardinality W3C `baggage` headers. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) limits were enforced only on injection and not extraction, the tracer allocates a hash-map entry per comma-separated pair on every request. Baggage propagation is enabled by default, so any internet-facing instrumented Ruby service is exposed; no public exploit was identified at time of analysis, and this CVE is not listed in CISA KEV.
Remote denial of service in Datadog's dd-trace-go APM library lets unauthenticated attackers exhaust CPU and memory on any instrumented HTTP service by sending an oversized W3C 'baggage' header. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safety limits were enforced only on baggage injection, not extraction, so a single crafted request with a huge number of comma-separated key-value pairs forces one hash-map allocation per pair on every request. Because baggage propagation is enabled by default, any internet-facing Go service using an affected tracer is exposed; there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote unauthenticated Denial of Service in the Datadog.Trace .NET tracing library (versions before 3.43.0) arises because W3C baggage HTTP headers are parsed on the extract path without enforcing the DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits that are only applied during injection. An attacker can send a single request with a baggage header containing an arbitrarily large number of comma-separated key-value pairs, forcing the tracer to allocate a hash-map entry per pair and exhausting CPU and memory. Because the baggage propagation style is enabled by default, any internet-facing service instrumented with an affected tracer is exposed; there is no public exploit identified at time of analysis and the CVSS is 7.5 (A:H only).
Remote unauthenticated Denial of Service in the Datadog dd-trace-js Node.js tracing library (versions < 5.100.0) allows attackers to exhaust CPU and memory by sending an HTTP request with an oversized W3C 'baggage' header. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) caps were enforced only on injection and not on the extraction path, the tracer allocates a hash-map entry per comma-separated pair on every request. With baggage propagation enabled by default, any internet-facing instrumented service is exposed. CVSS 3.1 base score is 7.5 (A:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote denial of service in Datadog's dd-trace-py Python tracing library (versions before 4.8.2) lets unauthenticated attackers exhaust CPU and memory by sending oversized W3C 'baggage' HTTP headers. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safeguards were enforced only on baggage injection, never on extraction, so a single crafted request with a huge number of comma-separated pairs forces the tracer to allocate a hash-map entry per pair on every request. Because the baggage propagation style is enabled by default, any reachable service instrumented with an affected tracer is exposed; no public exploit identified at time of analysis.
Remote denial of service in Datadog's dd-trace-java (dd-java-agent) tracing library affects any HTTP service instrumented with a version below 1.62.0 that has W3C baggage propagation enabled, which is the default. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) caps were enforced only on baggage injection and not on extraction, a remote unauthenticated attacker can send a single crafted 'baggage' header with a huge number of key-value pairs or one oversized value to exhaust CPU and memory. There is no public exploit identified at time of analysis and it is not on CISA KEV, but exploitation is trivially reliable (CVSS 7.5, AV:N/AC:L/PR:N).
Arbitrary file read and denial of service in Wekan (open-source Meteor kanban board) before version 9.31 allows an authenticated board member to read any file the server process can access by supplying attacker-controlled versions.original.path and versions.original.storage values to the /attachments/insert DDP method. Because the server-side insert permission rule only validates board write access and the filesystem store never confirms the path stays within the storage root, a low-privileged user can exfiltrate sensitive host files or hang the process by pointing at special files like /dev/zero. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a fixing commit and release (v9.31) are public.
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep, low-level command of the tunnel protocol to corrupt server-side memory management and keep the server down. The flaw carries a CVSS 4.0 base score of 8.7 driven entirely by an availability (VA:H) impact, with no confidentiality or integrity consequence. No public exploit identified at time of analysis and it is not listed in CISA KEV, so real-world exploitation appears unproven.
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel participant to permanently crash or wedge the server by abusing the tunnel protocol. The CVSS 4.0 vector (7.1, PR:L, VA:H) confirms an availability-only impact requiring some level of tunnel authentication, with no confidentiality or integrity effect despite a mislabeled 'Information Disclosure' tag. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Stack-based buffer overflow in TDengine (open-source IoT time-series database) versions 3.4.1.6 and earlier allows an authenticated user to trigger a one-byte out-of-bounds write by submitting SQL containing crafted escape sequences (\%, \_, or \x), leading to denial of service and potentially remote code execution. The flaw sits in the SQL parser's trimString() routine, which validates only a single byte of remaining space in the tmpTokenBuf stack buffer before writing escape-processed data. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in version 3.4.1.14.