Denial Of Service
Monthly
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio alloc_buddy_hugetlb_folio_with_mpol() can pass a NULL nodemask to alloc_fresh_hugetlb_folio() as a fallback to allocate from all nodes. If order is gigantic, alloc_fresh_hugetlb_folio() propagates the NULL nodemask down to hugetlb_cma_alloc_frozen_folio() via alloc_gigantic_frozen_folio(). Additionally, hugetlb_cma_alloc_frozen_folio() previously attempted allocation on hugetlb_cma[nid] without verifying if nid is included in the caller's nodemask. Adding a node_isset(nid, *nodemask) check ensures the initial preferred node allocation honors the memory policy / nodemask. However, hugetlb_cma_alloc_frozen_folio() dereferences the nodemask in node_isset(nid, *nodemask) and for_each_node_mask(node, *nodemask), leading to a null pointer dereference kernel panic when nodemask is NULL. Fix this by checking if nodemask is NULL in hugetlb_cma_alloc_frozen_folio() and defaulting it to cpuset_current_mems_allowed. Enclose the allocation attempts within the cpuset seqcount retry loop so that if the cpuset changes concurrently during allocation, the attempts are retried using the updated nodemask. This ensures that the initial node check and fallback loop safely honor the task's cpuset without violating cpuset constraints or causing NULL pointer dereferences or unexpected allocation failures. From a userspace perspective, this bug allows an unprivileged user to crash the kernel (trigger a panic) by requesting a gigantic hugepage allocation with MPOL_PREFERRED_MANY on a system where CMA is only configured on a subset of NUMA nodes. This can be reproduced by booting a VM with two NUMA nodes, restricting CMA to Node 1 (e.g., hugetlb_cma=1:1G default_hugepagesz=1G hugepagesz=1G hugepages=0), and running a program that allocates a 1GB hugepage area without reserving, restricts allocation to Node 0 using mbind() with MPOL_PREFERRED_MANY, and triggers a page fault: void *ptr = mmap(NULL, 1UL << 30, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB | MAP_HUGE_1GB | MAP_NORESERVE, -1, 0); unsigned long nodemask = 1; /* Node 0 */ mbind(ptr, 1UL << 30, MPOL_PREFERRED_MANY, &nodemask, sizeof(nodemask) * 8, 0); memset(ptr, 0, 1UL << 30); /* Trigger fault */ This results in a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:hugetlb_cma_alloc_frozen_folio+0x75/0x120 Call Trace: <TASK> only_alloc_fresh_hugetlb_folio.isra.0+0x2c/0x160 alloc_surplus_hugetlb_folio+0x6d/0x100 alloc_hugetlb_folio+0x3c5/0x660 hugetlb_no_page+0x3d9/0x650
In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invalid IRQ value When an invalid value is passed via the "eisa_irq_edge=" kernel command line parameter (e.g. "eisa_irq_edge=16,5"), eisa_irq_setup() prints an error message and continues without advancing the current position. As a result the same invalid value is parsed again and again, causing an infinite loop while the kernel boots. Advance to the next comma-separated entry, or stop parsing when there is no next entry, before continuing so that the remaining entries are processed normally.
In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec_file: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexec_extra_fdt_size_ppc64(). On platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving 'rmem' unallocated as NULL. Passing it directly leads to a kernel panic when evaluating 'rmem->nr_ranges'. Add a NULL check for 'rmem' to prevent this crash.
In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec_file: Prevent kexec range truncation Sashiko AI review pointed out the following issue. The __merge_memory_ranges() function incorrectly handles overlapping memory ranges when merging them. Although sort_memory_ranges() sorts all ranges by their start address in ascending order beforehand, the merge logic remains defective in two ways: 1. It compares the current range's start against the previous element (i-1) instead of the running target index (idx) 2. It unconditionally overwrites 'ranges[idx].end' with 'ranges[i].end'. This logic flaw leads to critical memory truncation when a larger memory range completely subsumes subsequent smaller ranges. For example, consider a sorted input array with three ranges: Range A (idx=0): [0x1000 - 0x9000] Range B (i=1): [0x2000 - 0x5000] (completely inside Range A) Range C (i=2): [0x6000 - 0x8000] (completely inside Range A) 1. When i=1 (Range B): ranges[1].start (0x2000) <= ranges[0].end + 1 (0x9001) is TRUE. The code executes: ranges[0].end = ranges[1].end, which erroneously shrinks Range A's end from 0x9000 down to 0x5000. 2. When i=2 (Range C): ranges[2].start (0x6000) <= ranges[1].end + 1 (0x5001) is FALSE. The code falls into the else block, creating a broken new range. As a result, valid memory fragments [0x5001 - 0x5fff] and [0x8001 - 0x9000] are completely lost from the kexec exclude lists, potentially allowing the crash kernel to overwrite active memory, causing data corruption or crashes. Fix this by ensuring the start of the current range is compared against the end of the active merged range (idx), and use max() to safely prevent the outer boundary from being truncated.
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL The ap_driver structure has two fields which are function pointers to callbacks: * .on_config_changed: called at the start of the AP bus scan function to notify the device driver that the host AP configuration has changed and the associated AP devices will be added or removed accordingly. This gives the implementor a chance to evaluate the configuration changes and respond to them before the associated devices are added or removed. * .on_scan_complete: Called at the end of the AP bus scan function to notify the device driver that the host AP configuration has changed and the AP devices have been added or removed accordingly. This gives the implementor the opportunity to respond to the changes after the associated devices are added or removed. These two callbacks are implemented in the vfio_ap device driver via the vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete functions respectively. Within the call stack of these two callback functions the matrix_mdev->kvm->lock mutex is taken without checking whether matrix_mdev->kvm is NULL or not. If matrix_mdev->kvm has never been set, trying to take the lock will trigger a NULL pointer dereference. This patch adds checks for matrix_mdev->kvm == NULL before taking the matrix_mdev->kvm->lock mutex. Note that the matrix_mdev->kvm->lock mutex taken in the vfio_ap_mdev_hot_plug_config function is moved to the calling function along with the matrix_dev->mdevs_lock which is needed there to access the fields of the matrix_mdev. It makes little sense to make the change the check for matrix_mdev->kvm there before taking the kvm->lock mutex only to have to move it out via another patch, so it is done in this patch. It is important to make note of the following: 1. The matrix_dev->guests_lock is acquired at the start of both callback functions. This ensures that matrix_mdev will not be removed via the vfio_ap_mdev_remove function because it too takes matrix_dev_guests_lock before removing the object; so, matrix_mdev will be available for the duration of the callback functions. 2. The matrix_dev->mdevs_lock mutex must be taken in order to access fields within the matrix_mdev structure 3. matrix_mdev->kvm->lock mutex must be taken before the matrix_dev->mdevs_lock to prevent a lockdep splat. 4: The kvm->lock must be held while plugging the guest's AP configuration into its SIE state description via the vfio_ap_mdev_update_guest_apcb function. 5. The vfio_ap_mdev_update_guest_apcb checks matrix_mdev->kvm to verify it is not NULL before doing the hot plug of the guest's AP configuration.
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in status_show() during queue probe When vfio_ap_mdev_probe_queue() creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore call dev_get_drvdata() and get NULL, which is then passed directly to vfio_ap_mdev_for_queue() where q->apqn is unconditionally dereferenced, causing a NULL pointer dereference. Fix this by acquiring the update locks before calling sysfs_create_group(). The status_show() function acquires guests_lock before reading the driver data, so any concurrent read will block until after dev_set_drvdata() has been called and the update locks are released. As a bonus, the APQN no longer needs to be read from the queue struct after allocation - it can be read directly from apdev before allocation and stored in a local variable, which is then assigned to q->apqn once the allocation succeeds.
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: dps310: fix NULL pointer dereference on ACPI probe When the device is enumerated through its ACPI HID (IFX3100), i2c_client_get_device_id() returns NULL: the ACPI-derived client name does not match the driver's i2c_device_id table. dps310_probe() then dereferences that NULL pointer in "iio->name = id->name" and crashes the kernel during probe. The IIO device name is always "dps310", so set it directly and drop the now-unused device-id lookup.
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Free guest debug data on vcpu destroy kvm_s390_clear_bp_data() is only called from kvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are still armed - the normal case when the VMM just exits or crashes - leaks hw_bp_info, hw_wp_info and all old_data buffers, since generic KVM frees the vCPU right after kvm_arch_vcpu_destroy(). That is bounded by MAX_BP_COUNT entries, so roughly 8 KiB per vCPU, but it is unbounded over VM lifetimes. The allocations are GFP_KERNEL_ACCOUNT, so the charge also outlives the exiting process and pins dying memcgs. Fix by clearing the debug data on vCPU destruction. Calling it unconditionally is fine: struct kvm_vcpu is zero allocated, so for a vCPU that never enabled debugging the counters are 0 and the pointers NULL.
In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure kthread_run() returns an ERR_PTR on failure, not NULL. When start_streaming() fails, data->kthread_vid_cap is left holding this error pointer instead of being cleared. This causes two subsequent bugs: 1. A future call to start_streaming() sees a non-NULL kthread_vid_cap and returns 0 (success) immediately, without actually starting the capture thread. 2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which is false for an error pointer, and proceeds to call kthread_stop() on the error pointer, leading to a kernel crash. Fix this by resetting kthread_vid_cap to NULL on failure before jumping to the error path.
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add timeout while stop_streaming When stop_streaming is called, an infinite loop may occur in some cases. Add a bounded poll of the queue status: loop until the queues drain, sleeping briefly between polls, and bail out once VPU_DEC_STOP_TIMEOUT elapses.
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqd_mgr->debugfs_show_mqd() is incorrectly placed outside the if (pqn->q) block that initializes mqd_mgr. The queue list can contain entries where pqn->q is NULL (kernel queues where only pqn->kq is valid). In the original code: if (pqn->q) { ... mqd_mgr = q->device->dqm->mqd_mgrs[mqd_type]; size = mqd_mgr->mqd_stride(...); } for (xcc = 0; xcc < num_xccs; xcc++) { // WRONG: outside if block mqd = q->mqd + size * xcc; r = mqd_mgr->debugfs_show_mqd(m, mqd); } When iterating over a queue node where pqn->q is NULL: 1. The if (pqn->q) block is skipped 2. mqd_mgr remains uninitialized (NULL from declaration) 3. The for loop executes anyway 4. mqd_mgr->debugfs_show_mqd(m, mqd) dereferences NULL The crash manifests as: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode RIP: 0010:0x0 Call Trace: pqm_debugfs_mqds+0x10c/0x1d0 [amdgpu] kfd_debugfs_mqds_by_process+0x9b/0x110 [amdgpu] seq_read_iter+0x132/0x4b0 ... Fix by moving the for loop inside the if (pqn->q) block, so mqd_mgr and related variables are only used when properly initialized. (cherry picked from commit 8bfe29d5c798940f797aa24135d2734c3ffce9de)
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Both create_queue_cpsch() and create_queue_nocpsch() unconditionally call mqd_mgr->restore_mqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restore_mqd is not implemented for the given queue type, a user holding CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. Note that checkpoint_mqd is likewise unimplemented on GFX12, so no legitimate CRIU image can reach this path - only a hand-crafted restore payload. Add a NULL guard for restore_mqd immediately after mqd_mgr is resolved, unwinding via the existing error labels and returning -EOPNOTSUPP if the callback is not implemented. This mirrors the existing checkpoint_mqd guard in checkpoint_mqd().
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamond_merge_regions() internal loop Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races", v1.1. Sashiko found a few issues in DAMON that could cause infinite loop, NULL dereference and monitoring results degradation. The first two sounds scary but the infinite loop happens only under unreasonable user setup. The NULL dereference is only in a unit test. Monitoring results degradation is trivial since it is only best-effort, and those happens from only unlikely races. Still those are bugs that better to fix if possible. Fix those. This patch (of 6): Due to online parameter update like events, the number of DAMON regions could be higher than the user-set upper limit. kdamond_merge_regions() repeats merge regions until the number meets the limit, while doubling the merge threshold up to the theoretical maximum threshold. It is tried only up to the theoretical maximum threshold because even the aggressive merging can fail from reducing the number of regions under the user-defined upper limit. For example, there could be many user-defined non-contiguous regions that cannot be merged. The threshold based loop break condition is evaluated by comparing the threshold for the next merging try against the theoretical maximum threshold. If max_thres is larger than UINT_MAX / 2, doubling the threshold could make it overflow, and bypass the loop break condition. In the case, if the number of regions cannot be reduced under the upper limit like explained above, the loop will run infinitely. Prevent the case by doing the break condition check before doubling the threshold. Also, prevent the threshold exceeding the maximum threshold, as it could overflow and apply the wrong merge threshold. This issue is unlikely to occur in real world, since having the max_thres higher than UINT_MAX / 2 require unrealistically large aggregation intervals compared to the sampling interval. Also, it requires an unrealistically large number of uncontiguous regions setup. Nonetheless, the consequence is bad and the fix is simple. The issue was discovered [1] by Sashiko.
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege authenticated access to degrade availability by invoking the updateComponents function of basic_functions.ts with manipulated input. Impact is confined to a low availability effect (VA:L) with no confidentiality or integrity loss, and the vendor was notified through a public issue report but has not responded or produced a fix. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because a2ui is a niche, early-version open-source project with minimal deployment, the practical risk is low to moderate despite the CVSS 4.0 base score of 5.3.
Malformed PIM Sparse Mode messages can crash the Pimsm agent on Arista EOS switches, causing a sustained denial of service when an unauthenticated, network-adjacent attacker repeatedly sends the triggering traffic. Exploitation is constrained to devices where both PIM Sparse Mode and MLAG are configured simultaneously - a non-default combination, and the attacker must be Layer-2 adjacent rather than Internet-reachable. Impact is availability-only: the Pimsm agent auto-restarts, so a single malformed message causes only a brief multicast-routing interruption, while continuous repetition is required to keep the agent in a restart loop. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing); risk is bounded rather than urgent.
An out-of-bounds read in the HTTP Cache-Control response header parser of the QtNetwork module lets a hostile or compromised HTTP server crash 64-bit client applications built on Qt 6.0.0-6.8.8 or 6.9.0-6.11.1 that use QNetworkAccessManager. The trigger is an excessively large Cache-Control header value returned to the requesting client; because the over-read is read-only, the outcome is limited to a denial of service (application crash) with no information disclosure and no code execution, and only the client side of the connection is affected - 32-bit builds are not affected. No public exploit code has been identified at time of analysis, and exploitation is not on-demand against an arbitrary target: the victim application must be induced to connect to an untrusted, attacker-controlled, or compromised server (reflected as AT:P in the CVSS 4.0 vector), which keeps real-world risk at a low-to-moderate level despite the presence of RCE and Information Disclosure tags in some feeds.
Unauthenticated HTTP/2 requests to Fastify routes that register response trailers crash the entire Node.js process, dropping all in-flight requests and repeating the outage on every restart. The flaw affects Fastify versions before 5.12.5 and requires two non-default, application-specific conditions: the server must have HTTP/2 enabled and at least one route must call reply.trailer(). No public exploit code or confirmed active exploitation is identified at time of analysis, and the 5.9 CVSS score reflects a bounded availability-only impact rather than a high-severity compromise. Fastify 5.12.5 contains the fix.
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 rpcb_register_inet4() and rpcb_register_inet6() store the result of rpc_sockaddr2uaddr() into map->r_addr without checking it for NULL. rpc_sockaddr2uaddr() returns NULL when its final kstrdup() fails, and the unchecked NULL is then carried into the synchronous RPCBPROC_SET encode path: rpcb_register_call() -> rpc_call_sync() -> rpcb_enc_getaddr() -> encode_rpcb_string(), whose first statement is strlen(string), dereferencing NULL and oopsing the kernel. The crash reproduces under failslab on v6.12; with KASAN the NULL dereference surfaces as a fault on the shadow of address zero: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 [#1] PREEMPT SMP KASAN RIP: 0010:strlen (lib/string.c:409) Call Trace: encode_rpcb_string (net/sunrpc/rpcb_clnt.c:890) rpcb_enc_getaddr (net/sunrpc/rpcb_clnt.c:910) rpcauth_wrap_req_encode (net/sunrpc/auth.c:745) call_encode (net/sunrpc/clnt.c:1966) __rpc_execute (net/sunrpc/sched.c:952) rpc_run_task (net/sunrpc/clnt.c:1243) rpc_call_sync (net/sunrpc/clnt.c:1272) rpcb_v4_register (net/sunrpc/rpcb_clnt.c:500) svc_generic_rpcbind_set nfsd_rpcbind_set svc_register svc_setup_socket svc_addsock write_ports nfsctl_transaction_write vfs_write The crash is reachable when an in-kernel RPC service (nfsd, lockd, nfs-callback) registers with the local rpcbind under enough memory pressure for the small GFP_KERNEL kstrdup() in rpc_sockaddr2uaddr() to fail. The asynchronous getport path already handles this exact failure mode by returning -ENOMEM; only the two register helpers omit the check. Mirror that handling: bail out with -ENOMEM when rpc_sockaddr2uaddr() returns NULL, before the address is fed into the encoder.
Algorithmic complexity attacks against DNSSEC validation in NLnet Labs Unbound 1.26.0 and earlier let remote unauthenticated attackers degrade resolver performance by steering queries to malicious zones that amplify validation work - TagTrap (floods of mismatched DNSKEY/RRSIG/DS records), DelegationTrap (deeply nested chain-of-trust validation), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (Unbound's default DNSSEC validation of the ADDITIONAL section). Exploitation requires a DNSSEC-validating Unbound resolver and attacker control of the zone being resolved, and impact is limited to resource exhaustion (CVSS 5.3, availability Low) rather than compromise or a guaranteed crash. No public exploit identified at time of analysis, and the attacker must be able to drive query volume through the resolver for meaningful effect.
Denial of service in NLnet Labs Unbound 1.12.0 through 1.26.0 arises from a use-after-free in the DNS-over-HTTPS (DoH) code path, reachable only in builds compiled with --with-libnghttp2 when failure conditions such as an RPZ drop action or heavy-traffic stream jostling occur. A remote, unauthenticated attacker can trigger the flaw with a single DoH connection and appropriate traffic, causing memory corruption that, under a hardened allocator, results in controlled termination of the Unbound process. No public exploit code has been identified at time of analysis; the impact is confined to availability (CVSS 5.9, C:N/I:N/A:H) with no confidentiality or integrity effect.
Sustained high-rate streams of distinct uncached names over TCP or DNS-over-TLS can monopolize a single NLnet Labs Unbound worker's event loop, degrading resolver availability for other clients in Unbound versions up to and including 1.26.0. The issue is remotely reachable and unauthenticated (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), but the attacker must hold a connection and keep write throughput ahead of the server's drain/processing so the unbounded consecutive-read loop never yields; impact is confined to the affected worker, is degradation rather than a crash, and ends once the traffic stops, while connection caps, query-rate limits, and upstream rate-limiting reduce feasibility. No public exploit identified at time of analysis, and no evidence of confirmed actively exploited (CISA KEV) status; the vendor's CVSS of 5.3 is consistent with this modest degradation-of-service profile.
CPU exhaustion denial of service in jwcrypto's JWK.import_key() allows a remote unauthenticated attacker to supply a crafted JWK with an arbitrarily large key_ops array and trigger O(n²) duplicate-detection work, consuming CPU proportional to the square of the array length. Any Python application that passes externally-supplied JWK material to this API - via ECDH-ES key agreement, OIDC dynamic client registration, DPoP proof parsing, or ACME account key registration - is vulnerable. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS rates this at 5.9 (Medium) with AC:H reflecting the requirement that attacker-controlled key material must reach the vulnerable code path.
Unauthenticated denial of service in GitLab CE/EE caused by flawed resource accounting in the GraphQL complexity calculation logic, allowing a crafted query to consume disproportionate server resources. Exploitation affects GitLab 18.4.6 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1 - any Internet- or network-reachable instance with the GraphQL API enabled. Public exploit code exists (a HackerOne report is cited as the source), but there is no CISA KEV listing confirming active in-the-wild exploitation at time of analysis.
Improper validation of parameters in GitLab CE/EE's Terraform state upload functionality allows an authenticated user holding project-level permissions to read restricted file contents on the server or cause denial of service. Affected releases are all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, with fixes published in the 19.3.2 patch release. Public exploit details exist via a HackerOne report, but the CVSS base score is only 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N); there is no CISA KEV listing and no EPSS data was provided.
Denial of service in the Seraphinite Accelerator WordPress plugin (all versions before 2.29.24) lets any authenticated low-privilege account - a Subscriber, for instance - invoke a state-update AJAX action that performs no capability check and plant a malformed value, which triggers an uncaught error on every subsequent wp-admin page load and locks all administrators out of the dashboard. The public-facing site remains online and the condition is reversible by clearing the corrupted plugin state, but administrators lose access to their own admin area for as long as it persists. Publicly available exploit code exists, EPSS is low at 0.17% (7th percentile), and there is no CISA KEV confirmation of active exploitation; this is a moderate, security-team-actionable but not emergency-priority issue.
Unbounded buffering of unacknowledged KV-transfer acknowledgements in the MoRIIO connector of vLLM 0.26.0 and 0.27.0 allows a remote, unauthenticated client to grow worker memory indefinitely and degrade or crash LLM inference serving. The root cause is CWE-400 uncontrolled resource consumption in moriio_connector.py, where acknowledgements whose transfer mapping is not yet populated are appended to _pending_unmapped_acks with no TTL or size cap across request_finished, get_finished and _handle_release_message. Impact is availability-only (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N/VA:L); no public exploit code and no CISA KEV
A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server.
A heap-based buffer overflow in the Samsung Escargot JavaScript engine is reachable when a crafted bytecode-cache file is parsed, driven by an integer wraparound (CWE-190) in the string-table length handling inside CodeCacheReader::loadStringTable. Exploitation requires local write access to the engine's bytecode-cache directory (CVSS 5.5, AV:L/PR:L), and the impact is limited to availability - a crash or memory-corruption-induced denial of service with no confidentiality or integrity loss. No public exploit code or CISA KEV listing was identified at time of analysis, and the upstream fix (Samsung PR #1650) adds a bounds check rejecting any maxLength above STRING_MAXIMUM_LENGTH.
Denial of service through catastrophic regular-expression backtracking affects the A2UI web_core and React renderer packages through version 0.10.6, where the Basic Catalog 'regex' function and TextField validation compile and execute attacker-supplied patterns without any safety check. An application that renders attacker-influenced A2UI schemas or expressions can have its JavaScript event loop pinned, freezing the UI or a headless renderer for an attacker-chosen duration at negligible cost to the attacker. Exploitation is remote and unauthenticated per the supplied CVSS 4.0 vector, the upstream fix is visible in pull request #2366, and no public exploit code or CISA KEV entry was reported at time of analysis.
An authenticated administrator of a Netcore NR255-V router running firmware 1.5.130703 can crash the device by sending a crafted HTTP request to the route_policy_add.cgi handler that omits the required exit_port parameter, triggering a null pointer dereference (CWE-476) and a denial-of-service condition. The flaw is remotely reachable over the network but sits behind the management interface's high-privilege authentication requirement (CVSS 4.0 PR:H), and it affects availability only — there is no confidentiality or integrity impact. No public exploit code is confirmed in the provided intelligence, the issue is not listed in CISA KEV, and no EPSS score was supplied; the assigned CVSS 4.0 base score is 6.9.
Crafted
Let me produce the JSON. Key facts: Arista EOS DHCP relay, unauthenticated attacker with adjacent network access (AV:A), sends crafted DHCP reply from non-helper address, relay forwards without source validation. Impact: malicious network config to clients → traffic interception or DoS. CWE-345 insufficient verification of data authenticity. CVSS 4.0 base given: AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H → 6.5. Tags: "Denial Of Service" — arguably mislabeled since it's more about spoofing/rogue DHCP. Could emit mislabeled_tag? It's a tag issue; the impact includes DoS but primary is spoofing/traffic interception. Hmm — "Denial Of Service" tag is not exactly wrong but incomplete. Could flag missing_tag "dhcp"? The suggested slug format e.g. "dhcp". Hmm, the missing_tag must be clearly applicable platform/technique/vendor tag. "arista"? Actually vendor tag "arista" would be applicable. Let me think: rules say emit only when unambiguously implied. Vendor "arista" is unambiguously the vendor. But is it a "platform/technique/vendor tag"? Yes, vendor. Hmm, risk of noise. Maybe emit missing_tag target "DHCP" suggested "dhcp" — that's the core protocol. And maybe missing tag "arista". I'll be conservative: one missing_tag for "Arista" → "arista"? Hmm. I think the more defensible one is the product/vendor: the description omits... actually tags list only "Denial Of Service". A DHCP-related tag seems reasonable. I'll include a missing_tag for "DHCP" (slug "dhcp") with high confidence? It's a protocol tag though; typical tag taxonomy includes platform/vendor/technique. DHCP is more a protocol. I'll include "arista" as missing vendor tag — high confidence. Actually maybe both. Let me include just one to avoid noise: missing_tag target "Arista", suggested "arista". Hmm, but also could flag mislabeled_tag "Denial Of Service" — reason: advisory primarily concerns DHCP spoofing/malicious config injection, DoS is secondary. Is that "clearly wrong and verifiable"? No
Use-after-free in Chrome's Skia graphics library allows an attacker who has already compromised the renderer process to read cross-origin data after a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. Chromium rates the bug High severity because it can breach the same-origin boundary, even though the CVSS base score is only 3.1 (confidentiality-limited, no integrity or availability impact). No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the attack is not automatable per CISA's SSVC assessment.
Oracle VM VirtualBox 7.2.16 contains a flaw in the Core component that lets a high-privileged attacker who already has a logon on the host trigger a partial denial of service against the VirtualBox process itself. The attack is local (AV:L) and requires elevated privileges (PR:H), but carries a scope change (S:C), meaning the successful exploit can significantly affect additional products layered on the same infrastructure. CVSS 3.1 scores this 3.2 with availability-only impact; there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low for most deployments.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets an attacker who already holds a high-privileged logon on the host read a limited subset of VirtualBox-accessible data and trigger a partial denial of service against the hypervisor. The scope-change rating (S:C) indicates the impact can extend beyond VirtualBox itself to other products on or around the host, but exploitation requires local logon with elevated privileges and there is no indication of remote reach. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so real-world priority is driven by host-access hygiene rather than internet-facing exposure.
Denial of service in Oracle VM VirtualBox 7.2.16, where a local attacker who already holds a low-privileged logon session on the host can trigger a fault in the Core component that hangs or repeatedly crashes the VirtualBox process. Exploitation is difficult (AC:H) and requires active interaction from a different user on the same machine, and the impact is limited to availability — no confidentiality or integrity loss — giving a CVSS 3.1 base score of 4.4. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so treat it as a local reliability/DoS nuisance rather than a remote compromise risk.
Unauthenticated attackers with network access to HTTP endpoints can cause a partial denial of service in Oracle Helidon versions 4.0.0 through 4.5.4 by abusing the WebSocket component. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only partial impact) and requires no credentials or user interaction, making it trivially automatable against any reachable WebSocket-enabled service. No public exploit code, EPSS score, or CISA KEV listing was provided in the available intelligence, so active exploitation is not confirmed.
Unauthenticated HTTP requests can drive Oracle Helidon 3.0.0 through 3.2.20 into a partial denial-of-service condition through the helidon-media-multipart component, which handles multipart/form-data parsing. The flaw is network-reachable with no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) and impacts availability only — confidentiality and integrity are unaffected. Oracle rates it easily exploitable in its CPU advisory, but no KEV listing or public exploit code was present in the supplied intelligence feeds, so no public exploit identified at time of analysis.
Unauthenticated attackers with network access to an HTTP endpoint on Oracle Helidon 4.0.0 through 4.5.4 can trigger a partial denial of service in the framework's JSON component, degrading availability of the hosted application. The flaw is rated CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is described by Oracle as easily exploitable, though no public proof-of-concept, EPSS score, or CISA KEV entry was supplied in the input data, so active exploitation is unconfirmed.
A partial denial-of-service flaw in the Core component of Oracle Coherence lets a low-privileged, network-positioned attacker degrade availability of the distributed data grid by sending crafted HTTP requests. Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product are listed as affected by Oracle and mirrored by EUVD (EUVD-2026-79717). The CVSS 3.1 base score is only 4.3 because impact is limited to availability (A:L) with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was present in the supplied intelligence.
Partial denial of service in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 (Access SDK component) can be triggered by a low-privileged, authenticated attacker who reaches the product over HTTP. The flaw is rated CVSS 3.1 base 3.1 with an availability-only, partial impact, and Oracle characterizes it as difficult to exploit (AC:H), so successful disruption requires favorable timing or state rather than a simple repeatable request. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so there is no indication of active exploitation at time of analysis.
A denial-of-service flaw in the Oracle Net Services component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets an unauthenticated attacker with network access over TCPS hang or repeatedly crash the Net Services layer, degrading or halting database connectivity. Exploitation is network-reachable and low-complexity but requires interaction from a person other than the attacker, and it yields availability impact only (CVSS 3.1 base 6.5, C:N/I:N/A:H). No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated network attackers with access to the TLS interface of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can trigger a hang or repeatedly crash the Forge component while also reading a limited subset of application-accessible data. Oracle's advisory rates it 6.5 (AV:N/AC:H/PR:N/UI:N/C:L/A:H), so impact is dominated by availability loss rather than data compromise, and the high attack complexity suggests exploitation requires carefully crafted conditions rather than a trivial request. No public exploit code or CISA KEV entry is present in the available intelligence, and the vulnerability is not confirmed as actively exploited at time of analysis.
Unauthenticated attackers with network access to the HTTP interface of the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can exploit a difficult-to-trigger flaw to read the full set of data the platform can reach and to partially degrade its availability. The vendor rates this 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), so the damage ceiling is high confidentiality loss rather than code execution. No public exploit code and no CISA KEV entry appear in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed — the practical driver for patching is the exposure of complete catalogue and index data, not observed attacks.
A buffer overflow in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways allows an authenticated administrator to crash or destabilize the appliance, producing a denial-of-service condition. All maintenance branches 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 are affected per ENISA EUVD tracking. The CVSS base of 5.5 with PR:H reflects that high administrative privileges are required, so this is not an unauthenticated remote outage; no public exploit code or CISA KEV listing was identified at time of analysis.
Unauthenticated denial of service in HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already sits on an adjacent network segment to crash the appliance, with the added consequence that the gateway cannot reboot itself and requires manual intervention to recover. Affected releases span the 9.4, 9.5, 9.6 and 9.7 maintenance trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively) per the ENISA EUVD record. The flaw is rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N, availability-only impact) and no public exploit code has been identified at time of analysis; there is no CISA KEV listing.
Improper input validation in the Android Cellular Modem component lets an attacker who is radio-adjacent to a device crash the modem stack, producing a denial of service against cellular voice and data with no user interaction required. The flaw carries a CVSS 3.1 base score of 5.7 (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and is classified as CWE-20; only availability is affected. Google's Pixel/Android security bulletin for September 2026 (2026-09-01) is the vendor reference, but no CISA KEV listing, no public proof-of-concept, and no EPSS data were supplied, so opportunistic mass exploitation is not indicated at time of analysis. Because exploitation is confined to the radio adjacency and the impact is availability-only, this is a moderate-priority hardening item rather than a headline emergency.
Ingestion denial of service in Bugsink affects self-hosted instances running versions 2.2.1 and earlier, where any caller holding a valid project DSN can submit an event carrying an unusually large custom tag set and force the server to write excessive tag rows. Because Bugsink digests events through a single-writer database transaction, that oversized write blocks concurrent ingestion and temporarily starves the event pipeline of other projects and clients. Version 2.2.2 fixes this by enforcing a configurable MAX_EVENT_TAGS cap (default 100) before storage; the impact is strictly availability-limited, with no data exposure, event modification, or code execution, and no public exploit code or CISA KEV listing was identified at time of analysis.
Denial of service in Open5GS 2.7.7 and earlier lets a remote attacker crash the SGW-U/UPF process by sending a crafted PFCP Session Establishment or Modification Request containing a malformed Outer Header Creation IE. The handler fails to validate the Outer Header Creation description bits and payload length, so a failed GTP-U peer connection leaves a node with an unset address family in the peer list; a subsequent request referencing the same address reaches ogs_pfcp_far_f_teid_hash_set and aborts the process. Publicly available exploit code exists (GitHub issue #4699) and an upstream fix commit has been published, but the flaw is not listed in CISA KEV.
Resource exhaustion in the Security component of Mozilla Firefox before 156 and Firefox ESR before 153.3 lets a remote, unauthenticated attacker cause a denial-of-service against the browser, provided the victim renders attacker-controlled web content in an affected build (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Impact is availability-only: confidentiality and integrity are unaffected and there is no sandbox or scope escape, so at worst the tab or browser becomes unresponsive or crashes. The issue is fixed in Firefox 156 and Firefox ESR 153.3, EPSS is low at 0.14% (4th percentile), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in Mozilla Firefox's SVG rendering component allows a remote, unauthenticated attacker to crash or hang the browser process by convincing a victim to load a crafted SVG document. The flaw is an unbounded resource allocation issue (CWE-770) that affects Firefox versions before 156 and Firefox ESR versions before 153.3 on default configurations; exploitation requires user interaction (UI:R), and impact is limited to availability with no confidentiality or integrity effect. No public exploit code has been identified and the flaw is not confirmed as actively exploited (CISA KEV), while EPSS is very low at 0.15% (5th percentile), consistent with a genuine but low-priority availability issue that Firefox's multiprocess architecture typically confines and recovers from.
Denial of service in the Mozilla Firefox Audio/Video component lets a remote attacker crash or hang the browser by having a victim load crafted media content in a version prior to Firefox 156. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), so exploitation is unauthenticated by vector but depends entirely on convincing the target to render attacker-controlled audio or video; impact is limited to availability with no confidentiality or integrity loss. This is a moderate, availability-only issue that is unlikely to be a high priority for most organizations; no public exploit has been identified at time of analysis and EPSS is 0.14% (4th percentile), and the vendor-released fix is Firefox 156.
A memory leak in the gss-ntlmssp NTLM target-info parser allows a malicious or man-in-the-middle NTLM server to gradually exhaust memory on the client by sending a crafted NTLM CHALLENGE message containing duplicated string-valued AV_PAIR entries. Each duplicate causes the parser to allocate a new string buffer without freeing the previous one, so repeated authentications accumulate leaked allocations and eventually degrade or crash the client, producing a denial of service. The impact is availability-only and low severity (CVSS 3.7, A:L), exploitation requires an attacker to control the NTLM challenge, and no public exploit code or CISA KEV listing was identified at time of analysis.
MISP 2.5.45 and earlier fails to apply its authentication-failure logging throttle on two API auth paths — requests presenting no API key and requests presenting a key of incorrect length — allowing an unauthenticated remote caller to write an unbounded number of durable auth_fail entries into the database. Repeated requests can exhaust storage and degrade or deny availability of the platform (CWE-770). No public exploit code and no CISA KEV entry were present in the supplied intelligence; an upstream fix commit (2bf887433) is available from the vendor.
A null pointer dereference in GNU Binutils 2.47 lets a locally-supplied malformed ELF object crash the toolchain when the linker or related BFD-consuming utilities reach the elf_x86_allocate_dynrelocs() dynamic-relocation allocator in bfd/elfxx-x86.c. Only availability is impacted — the fault aborts the affected utility and no memory corruption, information disclosure, or code execution has been demonstrated, which is consistent with the CVSS 4.0 base score of 1.9 (AV:L/PR:L, VA:L only). Publicly available exploit code exists in a GitHub proof-of-concept repository linked from the NVD record, but there is no indication of active exploitation or CISA KEV listing; upgrading to Binutils 2.48 resolves the issue.
A null pointer dereference in GNU Binutils 2.47 allows a local attacker to crash affected utilities by supplying a crafted ELF file. The flaw resides in elf_x86_64_common_section_index() in bfd/elf64-x86-64.c, part of the ELF section-handling path, and only denies availability of the tool process - there is no confidentiality or integrity impact. Publicly available proof-of-concept code exists and the issue is fixed in version 2.48, but real-world risk is low given the local attack vector, minimal impact, and low EPSS-relevant severity.
A NULL pointer dereference in GNU Binutils 2.47 lets a locally-supplied, malformed ELF object crash BFD-based tools such as ld, objdump or readelf when they parse the crafted symbol tables. Only availability is affected — the process dies with a segmentation fault and there is no confidentiality or integrity impact. Publicly available exploit code exists (a PoC is published in a GitHub repository referenced from the Sourceware bug report), but there is no CISA KEV listing and no vendor patch at the time of analysis, since the project has reportedly not yet responded to the bug report.
Denial of service in GNU Binutils 2.47: running a BFD-based utility such as objdump, readelf, nm, or ld against a crafted ELF object drives execution into the .eh_frame ('Eh Frame Handler') parsing path, where _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c dereferences a NULL pointer and crashes the process. The vector is local only - a victim must be induced to process an attacker-supplied malformed binary - and the outcome is limited to availability loss of that single tool invocation, with no confidentiality or integrity impact, which is why the supplied CVSS v4.0 base is only 1.9 and EPSS sits at 0.11% (2nd percentile). Publicly available exploit code exists (referenced from the VulDB entry and a public GitHub proof-of-concept write-up), but there is no evidence of active exploitation and the issue is not in CISA KEV; CISA's SSVC framework classifies it as poc / not automatable / partial technical impact, and no vendor-released patch has appeared because the upstream bug report (sourceware bug 34446) has not yet been answered.
Use-after-free in GPAC's scenegraph node handling allows a remote attacker to trigger memory corruption by delivering a crafted media file that is processed by the affected application. The vulnerability exists in `gf_node_get_name_and_id()` in `scenegraph/base_scenegraph.c`, where a node pointer could be dereferenced after being freed due to missing null/reference-count guards in the BIFS decoder's command assignment path. Exploitation requires user interaction (opening a malicious file), a publicly available proof-of-concept exists (poc_16_bt.zip), and no confirmed active exploitation is recorded in CISA KEV.
Use-after-free in GPAC's LASeR scene graph command processing subsystem allows remote attackers to corrupt heap memory by supplying a crafted media file, potentially leading to process crash or code execution. Affected are GPAC builds up to commit f1219cde; the flaw stems from direct node-pointer assignment without proper reference counting in the LASeR decoder and scene graph command application paths. A public proof-of-concept exploit is confirmed available; vendor-released patch exists at commit e34f4ba and release abi-16.24.
A resource-exhaustion (denial of service) flaw in vLLM's OpenAI-compatible /v1/chat/completions endpoint lets a caller- or model-supplied Jinja chat_template drive nested range() loops whose evaluation cost grows as O(N^depth), tying up a request-runtime worker thread for tens of seconds. vLLM releases up to and including 0.27.1 are affected (EUVD lists 0.27.0 and 0.27.1), with the CPE range expressed as vllm-project:vllm:* so earlier releases are plausibly in scope too. Publicly available exploit code exists, and CVSS 4.0 rates the issue only 2.1 with availability impact rated Low; a fix PR that introduces a minijinja evaluation 'fuel' budget is still awaiting acceptance.
Use-after-free in zstd-jni's Dictionary Sharing component allows remote attackers to corrupt native heap memory through the ZstdCompressCtx.loadDict() and ZstdDecompressCtx.loadDict() APIs in versions up to 1.5.7-13. The defect is a logic inversion in shared-lock accounting: the code releases the reference count on the incoming dictionary parameter rather than on the previously held dictionary reference, causing the old native buffer to remain referenced after it can be freed by another thread. A public proof-of-concept exists via GitHub issue #404, and vendor released a confirmed fix in version 1.5.7-14.
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service.
Prolink's 13A Smart Plug (model DS-3202M-UKv3) paired with the mEzee 2.6.7 mobile app mishandles packets received during the Wi-Fi provisioning phase, letting an attacker within radio range crash the plug or redirect it to connect to an attacker-controlled device instead of the legitimate access point. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only per the published vector), while the practical attack surface is narrower because it exists only while the plug is actively being set up. Exploitation status at time of analysis: no public exploit identified at time of analysis, though a public GitHub repository ('crossprobe') is linked in the CVE record and appears to be proof-of-concept research tooling; the CVE is not listed in CISA KEV and no EPSS score was supplied.
Null pointer dereference in GNU Binutils 2.47 allows a local low-privileged user to crash Binutils toolchain utilities by supplying a crafted input file that triggers the vulnerable `_bfd_write_merged_section` function in `bfd/merge.c`. The Section Merge component of the BFD (Binary File Descriptor) library fails to validate a pointer before dereference, resulting in a denial of service. A proof-of-concept exploit has been publicly disclosed via VulDB and the GNU Binutils bugzilla, and no vendor patch is available as the project has not yet responded to the disclosure.
Null pointer dereference in GNU Binutils 2.47 allows a local attacker with low privileges to crash binutils tools by supplying a crafted ELF binary with a malformed SHT_GROUP section, triggering the defect in `bfd_elf_set_group_contents` within `bfd/elf.c`. A public proof-of-concept has been disclosed and the upstream project has not yet responded to the coordinated disclosure. No public exploit identified for active exploitation (not in CISA KEV); CVSS 4.0 rates this 1.9, reflecting its extremely limited real-world impact.
Null pointer dereference in GNU Binutils 2.47 crashes the ELF linker when processing orphan sections via a crafted object file. The flaw resides in the `elf_orphan_compatible` function in `ld/ldelf.c`, exploitable by any local user who can invoke the `ld` linker against a specially crafted ELF input. A public proof-of-concept has been posted to the upstream Bugzilla tracker (attachment #16882 / bug #34450), but as of this analysis the GNU Binutils project has not yet released a patch or responded to the disclosure.
Use-after-free in GPAC 26.07.0's MP4Box component allows a local user to crash the application by supplying a crafted MP4 file containing a malformed BIFS scene graph. The flaw resides in gf_node_deactivate_ex() within scenegraph/base_scenegraph.c, where a scenegraph node with a zero instance count could be dereferenced after release because an assertion (gf_assert) was used instead of a guarded early return. A public POC exploit exists; impact is limited strictly to availability (application crash) with no confidentiality or integrity consequence.
Use-after-free in GPAC 26.07.0's MP4Box scenegraph engine allows a local low-privileged user to crash the application by processing a crafted scene file. The vulnerability exists in gf_node_unregister() within scenegraph/base_scenegraph.c, triggered when proto default field nodes (SFNODE/MFNODE typed) are not properly unregistered before scenegraph teardown, leaving dangling pointers subsequently dereferenced. A public proof-of-concept exploit (poc_09_add.zip) is available, though exploitation is limited to local availability impact with no confirmed active exploitation. No special privileges beyond running MP4Box are required.
XML External Entity (XXE) injection in IBM MQ's mqweb MFT REST API allows network-accessible, low-privileged attackers holding MFT publish authority to read sensitive files from the MQ server filesystem or cause denial of service. Affected deployments span seven release trains across LTS and CD channels from version 9.1 through 10.0.0.0. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained by both authentication and a specific MFT publish privilege requirement.
Uncontrolled resource consumption in IBM Cloud Pak for Business Automation enables authenticated network users to exhaust service resources and trigger a denial of service condition. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, each capped at specific interim fix levels. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.
Integer overflow (CWE-190) in macOS allows a locally present application to crash an affected component or the operating system, producing a denial-of-service condition rather than code execution or data theft. Apple fixed the flaw with improved input validation in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 per advisories 149035, 149042 and 149043. Exploitation requires a malicious app to be running on the target Mac and the user to interact with it (AV:L/UI:R); no public exploit code has been identified and EPSS is only 0.19% (9th percentile), so this is a routine patch-cycle item rather than an urgent one.
Loading attacker-controlled web content on an unpatched Apple device can trigger a null pointer dereference in the WebKit rendering pipeline, crashing the browser or app that renders the page and producing a denial-of-service on iPhone, iPad, Mac, Apple Watch and Apple Vision Pro. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27 and watchOS 27. The flaw scores CVSS 6.5 with a user-interaction requirement (UI:R), EPSS is only 0.20% (10th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
A buffer overflow in multiple Apple operating systems — iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8 and earlier — allows a locally executing app to crash the affected system or process, producing a denial of service. The flaw stems from insufficient bounds checking (CWE-120) and is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, availability-only impact), meaning an attacker must already have the ability to run code as a low-privileged app on the device. Apple has released patches and there is no CISA KEV listing, no public exploit code identified, and EPSS is low at 0.21% (12th percentile), so real-world exploitation pressure is currently minimal.
Local denial-of-service in Apple iOS, iPadOS, and visionOS lets an app already executing on the device exhaust resources or crash a system service by abusing an OS interface that failed to enforce required entitlement checks, producing an availability-only impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation is constrained to locally installed, attacker-controlled or compromised apps (PR:L, AV:L), so there is no remote or unauthenticated path and no data exposure or code-integrity loss. Apple addressed the flaw by adding entitlement validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27; no public exploit code has been identified at the time of analysis and EPSS is low at 0.16% (6th percentile), consistent with a narrow local-only attack surface.
A use-after-free (CWE-416) in Apple's memory management code allows a locally running application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS to crash the affected system, producing an unexpected termination or reboot. The flaw affects all platforms before the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and rates CVSS 5.5 (AV:L/PR:L/UI:N, availability-only impact). No public exploit code or active exploitation has been identified, and EPSS is low at 0.21% (11th percentile), so this is a patched, availability-only issue rather than an urgent remote-code-execution threat.
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
Unexpected system termination can be triggered on Apple devices by a locally executed app that exploits a use-after-free memory corruption in shared system code, which Apple addressed through improved memory management. The flaw affects essentially every current Apple OS branch below the fixed releases — iOS/iPadOS 26.6+, macOS 15.8/26.6+/27, tvOS 26.6+/27, visionOS 26.6+/27 and watchOS 26.6+/27 — with CVSS 5.5 reflecting an availability-only impact and a local attack vector. EPSS is low (0.24%, 16th percentile), no public exploit code has been identified, and there is no CISA KEV entry, so this is a routine patch-cycle item rather than an urgent threat.
A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.
Improper resource handling in FFmpeg 8.0.x's HLS playlist parser allows remote attackers to cause denial of service by supplying a crafted HLS playlist containing malformed `duration` or `target_duration` field values. The flaw resides in `parse_playlist()` within `libavformat/hlsproto.c` and requires passive user interaction - the target application must process the attacker-controlled `.m3u8` playlist. No public exploit code or active exploitation (CISA KEV) is known; vendor-confirmed fixes are available in FFmpeg 8.1 and 9.0.
Authenticated denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) lets a remote attacker with a valid database session crash the engine by triggering a null pointer dereference. The impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity of stored data are not directly at risk, but any application or Db2 Connect client depending on the affected instance loses service. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, SSVC rates exploitation and automatable both as none/no, and no EPSS score was supplied in the intelligence feed.
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) can be driven into a denial-of-service condition by a remote attacker who holds valid database credentials, through uncontrolled consumption of server resources. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so the impact is loss of availability only - no confidentiality or integrity exposure is claimed. Patch exists via IBM support document 7286983; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'.
Physically attached USB hosts can crash Zephyr RTOS builds that use the ITE it82xx2 USB device-controller driver, because the driver re-initializes an already-pending delayed work item during a disable-then-enable cycle, corrupting kernel timeout and workqueue linked lists and causing a kernel panic. Affected builds are those running Zephyr 3.7.0 through versions below 4.4.2 with the it82xx2 UDC driver enabled, typically on hardware that faces a removable USB host — kiosks, field instrumentation, or development boards. Exploitation requires a direct physical USB connection (CVSS AV:P, score 4.6), delivers denial of service only with no confidentiality or integrity impact, and is not currently listed as actively exploited or accompanied by published exploit code.
A use-after-free write in the Zephyr RTOS ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) affects Zephyr 4.0.0 through 4.4.1 and allows a malicious USB host to create a kernel heap-corruption primitive on the device side. When a multi-packet OUT transfer is received on a non-control endpoint, the driver re-arms the endpoint to keep filling the same net_buf while simultaneously handing that buffer to the upper USB device stack, which may free and recycle it while DMA continues; the completing packet is also submitted a second time, corrupting the event slist and causing a double net_buf_unref(). Exploitation is physical (USB attach) with no authentication or user interaction required, giving a reliable denial of service and plausible adjacent-pool memory corruption; no public exploit code or CISA KEV listing was identified for this CVE at time of analysis.
A use-after-free and double-free race in Zephyr's TLS socket session cache lets a malicious or compromised TLS peer corrupt the mbedTLS heap and crash an affected device. The flaw is reachable only by applications that explicitly enable the TLS_SESSION_CACHE socket option (off by default) and run concurrent TLS client connections from multiple threads, since the process-global client_cache defaults to a single shared slot. A vendor fix exists in commit 7f9d8ee (shipping in Zephyr 4.4.2 per the EUVD version range), and no public exploit code or active exploitation has been identified.
Remote denial of service in the Zephyr RTOS IPv6 Neighbor Discovery stack: an adjacent, unauthenticated attacker sends a Router Advertisement whose Reachable Time field is set to 1, which collapses the randomized reachable-time calculation in net_if_ipv6_calc_reachable_time() to exactly 0 ms. On builds compiled with CONFIG_ASSERT the zero value trips NET_ASSERT("Zero reachable timeout!") and kills the kernel, while assertion-free builds arm a K_MSEC(0) timer that fires immediately, pushing confirmed neighbors into perpetual STALE re-solicitation. Quoted CVSS is
Stack-based buffer overflow in MikroTik RouterOS's mtget binary TFTP RRQ builder allows any authenticated user, including those with only read-only group membership, to crash the mtget worker process by issuing a /tool fetch command with a crafted tftp:// URL path of 507 bytes or more. The overflow involves an unbounded rep movsb instruction that overwrites saved registers at a deterministic stack offset, causing a reproducible process crash without requiring network connectivity to an actual TFTP server. No public exploit code has been identified at time of analysis, and vendor patches are available in RouterOS 7.23.4 (long-term) and 7.24.2 (stable).
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio alloc_buddy_hugetlb_folio_with_mpol() can pass a NULL nodemask to alloc_fresh_hugetlb_folio() as a fallback to allocate from all nodes. If order is gigantic, alloc_fresh_hugetlb_folio() propagates the NULL nodemask down to hugetlb_cma_alloc_frozen_folio() via alloc_gigantic_frozen_folio(). Additionally, hugetlb_cma_alloc_frozen_folio() previously attempted allocation on hugetlb_cma[nid] without verifying if nid is included in the caller's nodemask. Adding a node_isset(nid, *nodemask) check ensures the initial preferred node allocation honors the memory policy / nodemask. However, hugetlb_cma_alloc_frozen_folio() dereferences the nodemask in node_isset(nid, *nodemask) and for_each_node_mask(node, *nodemask), leading to a null pointer dereference kernel panic when nodemask is NULL. Fix this by checking if nodemask is NULL in hugetlb_cma_alloc_frozen_folio() and defaulting it to cpuset_current_mems_allowed. Enclose the allocation attempts within the cpuset seqcount retry loop so that if the cpuset changes concurrently during allocation, the attempts are retried using the updated nodemask. This ensures that the initial node check and fallback loop safely honor the task's cpuset without violating cpuset constraints or causing NULL pointer dereferences or unexpected allocation failures. From a userspace perspective, this bug allows an unprivileged user to crash the kernel (trigger a panic) by requesting a gigantic hugepage allocation with MPOL_PREFERRED_MANY on a system where CMA is only configured on a subset of NUMA nodes. This can be reproduced by booting a VM with two NUMA nodes, restricting CMA to Node 1 (e.g., hugetlb_cma=1:1G default_hugepagesz=1G hugepagesz=1G hugepages=0), and running a program that allocates a 1GB hugepage area without reserving, restricts allocation to Node 0 using mbind() with MPOL_PREFERRED_MANY, and triggers a page fault: void *ptr = mmap(NULL, 1UL << 30, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB | MAP_HUGE_1GB | MAP_NORESERVE, -1, 0); unsigned long nodemask = 1; /* Node 0 */ mbind(ptr, 1UL << 30, MPOL_PREFERRED_MANY, &nodemask, sizeof(nodemask) * 8, 0); memset(ptr, 0, 1UL << 30); /* Trigger fault */ This results in a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:hugetlb_cma_alloc_frozen_folio+0x75/0x120 Call Trace: <TASK> only_alloc_fresh_hugetlb_folio.isra.0+0x2c/0x160 alloc_surplus_hugetlb_folio+0x6d/0x100 alloc_hugetlb_folio+0x3c5/0x660 hugetlb_no_page+0x3d9/0x650
In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invalid IRQ value When an invalid value is passed via the "eisa_irq_edge=" kernel command line parameter (e.g. "eisa_irq_edge=16,5"), eisa_irq_setup() prints an error message and continues without advancing the current position. As a result the same invalid value is parsed again and again, causing an infinite loop while the kernel boots. Advance to the next comma-separated entry, or stop parsing when there is no next entry, before continuing so that the remaining entries are processed normally.
In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec_file: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexec_extra_fdt_size_ppc64(). On platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving 'rmem' unallocated as NULL. Passing it directly leads to a kernel panic when evaluating 'rmem->nr_ranges'. Add a NULL check for 'rmem' to prevent this crash.
In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec_file: Prevent kexec range truncation Sashiko AI review pointed out the following issue. The __merge_memory_ranges() function incorrectly handles overlapping memory ranges when merging them. Although sort_memory_ranges() sorts all ranges by their start address in ascending order beforehand, the merge logic remains defective in two ways: 1. It compares the current range's start against the previous element (i-1) instead of the running target index (idx) 2. It unconditionally overwrites 'ranges[idx].end' with 'ranges[i].end'. This logic flaw leads to critical memory truncation when a larger memory range completely subsumes subsequent smaller ranges. For example, consider a sorted input array with three ranges: Range A (idx=0): [0x1000 - 0x9000] Range B (i=1): [0x2000 - 0x5000] (completely inside Range A) Range C (i=2): [0x6000 - 0x8000] (completely inside Range A) 1. When i=1 (Range B): ranges[1].start (0x2000) <= ranges[0].end + 1 (0x9001) is TRUE. The code executes: ranges[0].end = ranges[1].end, which erroneously shrinks Range A's end from 0x9000 down to 0x5000. 2. When i=2 (Range C): ranges[2].start (0x6000) <= ranges[1].end + 1 (0x5001) is FALSE. The code falls into the else block, creating a broken new range. As a result, valid memory fragments [0x5001 - 0x5fff] and [0x8001 - 0x9000] are completely lost from the kexec exclude lists, potentially allowing the crash kernel to overwrite active memory, causing data corruption or crashes. Fix this by ensuring the start of the current range is compared against the end of the active merged range (idx), and use max() to safely prevent the outer boundary from being truncated.
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL The ap_driver structure has two fields which are function pointers to callbacks: * .on_config_changed: called at the start of the AP bus scan function to notify the device driver that the host AP configuration has changed and the associated AP devices will be added or removed accordingly. This gives the implementor a chance to evaluate the configuration changes and respond to them before the associated devices are added or removed. * .on_scan_complete: Called at the end of the AP bus scan function to notify the device driver that the host AP configuration has changed and the AP devices have been added or removed accordingly. This gives the implementor the opportunity to respond to the changes after the associated devices are added or removed. These two callbacks are implemented in the vfio_ap device driver via the vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete functions respectively. Within the call stack of these two callback functions the matrix_mdev->kvm->lock mutex is taken without checking whether matrix_mdev->kvm is NULL or not. If matrix_mdev->kvm has never been set, trying to take the lock will trigger a NULL pointer dereference. This patch adds checks for matrix_mdev->kvm == NULL before taking the matrix_mdev->kvm->lock mutex. Note that the matrix_mdev->kvm->lock mutex taken in the vfio_ap_mdev_hot_plug_config function is moved to the calling function along with the matrix_dev->mdevs_lock which is needed there to access the fields of the matrix_mdev. It makes little sense to make the change the check for matrix_mdev->kvm there before taking the kvm->lock mutex only to have to move it out via another patch, so it is done in this patch. It is important to make note of the following: 1. The matrix_dev->guests_lock is acquired at the start of both callback functions. This ensures that matrix_mdev will not be removed via the vfio_ap_mdev_remove function because it too takes matrix_dev_guests_lock before removing the object; so, matrix_mdev will be available for the duration of the callback functions. 2. The matrix_dev->mdevs_lock mutex must be taken in order to access fields within the matrix_mdev structure 3. matrix_mdev->kvm->lock mutex must be taken before the matrix_dev->mdevs_lock to prevent a lockdep splat. 4: The kvm->lock must be held while plugging the guest's AP configuration into its SIE state description via the vfio_ap_mdev_update_guest_apcb function. 5. The vfio_ap_mdev_update_guest_apcb checks matrix_mdev->kvm to verify it is not NULL before doing the hot plug of the guest's AP configuration.
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in status_show() during queue probe When vfio_ap_mdev_probe_queue() creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore call dev_get_drvdata() and get NULL, which is then passed directly to vfio_ap_mdev_for_queue() where q->apqn is unconditionally dereferenced, causing a NULL pointer dereference. Fix this by acquiring the update locks before calling sysfs_create_group(). The status_show() function acquires guests_lock before reading the driver data, so any concurrent read will block until after dev_set_drvdata() has been called and the update locks are released. As a bonus, the APQN no longer needs to be read from the queue struct after allocation - it can be read directly from apdev before allocation and stored in a local variable, which is then assigned to q->apqn once the allocation succeeds.
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: dps310: fix NULL pointer dereference on ACPI probe When the device is enumerated through its ACPI HID (IFX3100), i2c_client_get_device_id() returns NULL: the ACPI-derived client name does not match the driver's i2c_device_id table. dps310_probe() then dereferences that NULL pointer in "iio->name = id->name" and crashes the kernel during probe. The IIO device name is always "dps310", so set it directly and drop the now-unused device-id lookup.
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Free guest debug data on vcpu destroy kvm_s390_clear_bp_data() is only called from kvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are still armed - the normal case when the VMM just exits or crashes - leaks hw_bp_info, hw_wp_info and all old_data buffers, since generic KVM frees the vCPU right after kvm_arch_vcpu_destroy(). That is bounded by MAX_BP_COUNT entries, so roughly 8 KiB per vCPU, but it is unbounded over VM lifetimes. The allocations are GFP_KERNEL_ACCOUNT, so the charge also outlives the exiting process and pins dying memcgs. Fix by clearing the debug data on vCPU destruction. Calling it unconditionally is fine: struct kvm_vcpu is zero allocated, so for a vCPU that never enabled debugging the counters are 0 and the pointers NULL.
In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure kthread_run() returns an ERR_PTR on failure, not NULL. When start_streaming() fails, data->kthread_vid_cap is left holding this error pointer instead of being cleared. This causes two subsequent bugs: 1. A future call to start_streaming() sees a non-NULL kthread_vid_cap and returns 0 (success) immediately, without actually starting the capture thread. 2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which is false for an error pointer, and proceeds to call kthread_stop() on the error pointer, leading to a kernel crash. Fix this by resetting kthread_vid_cap to NULL on failure before jumping to the error path.
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add timeout while stop_streaming When stop_streaming is called, an infinite loop may occur in some cases. Add a bounded poll of the queue status: loop until the queues drain, sleeping briefly between polls, and bail out once VPU_DEC_STOP_TIMEOUT elapses.
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqd_mgr->debugfs_show_mqd() is incorrectly placed outside the if (pqn->q) block that initializes mqd_mgr. The queue list can contain entries where pqn->q is NULL (kernel queues where only pqn->kq is valid). In the original code: if (pqn->q) { ... mqd_mgr = q->device->dqm->mqd_mgrs[mqd_type]; size = mqd_mgr->mqd_stride(...); } for (xcc = 0; xcc < num_xccs; xcc++) { // WRONG: outside if block mqd = q->mqd + size * xcc; r = mqd_mgr->debugfs_show_mqd(m, mqd); } When iterating over a queue node where pqn->q is NULL: 1. The if (pqn->q) block is skipped 2. mqd_mgr remains uninitialized (NULL from declaration) 3. The for loop executes anyway 4. mqd_mgr->debugfs_show_mqd(m, mqd) dereferences NULL The crash manifests as: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode RIP: 0010:0x0 Call Trace: pqm_debugfs_mqds+0x10c/0x1d0 [amdgpu] kfd_debugfs_mqds_by_process+0x9b/0x110 [amdgpu] seq_read_iter+0x132/0x4b0 ... Fix by moving the for loop inside the if (pqn->q) block, so mqd_mgr and related variables are only used when properly initialized. (cherry picked from commit 8bfe29d5c798940f797aa24135d2734c3ffce9de)
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Both create_queue_cpsch() and create_queue_nocpsch() unconditionally call mqd_mgr->restore_mqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restore_mqd is not implemented for the given queue type, a user holding CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. Note that checkpoint_mqd is likewise unimplemented on GFX12, so no legitimate CRIU image can reach this path - only a hand-crafted restore payload. Add a NULL guard for restore_mqd immediately after mqd_mgr is resolved, unwinding via the existing error labels and returning -EOPNOTSUPP if the callback is not implemented. This mirrors the existing checkpoint_mqd guard in checkpoint_mqd().
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamond_merge_regions() internal loop Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races", v1.1. Sashiko found a few issues in DAMON that could cause infinite loop, NULL dereference and monitoring results degradation. The first two sounds scary but the infinite loop happens only under unreasonable user setup. The NULL dereference is only in a unit test. Monitoring results degradation is trivial since it is only best-effort, and those happens from only unlikely races. Still those are bugs that better to fix if possible. Fix those. This patch (of 6): Due to online parameter update like events, the number of DAMON regions could be higher than the user-set upper limit. kdamond_merge_regions() repeats merge regions until the number meets the limit, while doubling the merge threshold up to the theoretical maximum threshold. It is tried only up to the theoretical maximum threshold because even the aggressive merging can fail from reducing the number of regions under the user-defined upper limit. For example, there could be many user-defined non-contiguous regions that cannot be merged. The threshold based loop break condition is evaluated by comparing the threshold for the next merging try against the theoretical maximum threshold. If max_thres is larger than UINT_MAX / 2, doubling the threshold could make it overflow, and bypass the loop break condition. In the case, if the number of regions cannot be reduced under the upper limit like explained above, the loop will run infinitely. Prevent the case by doing the break condition check before doubling the threshold. Also, prevent the threshold exceeding the maximum threshold, as it could overflow and apply the wrong merge threshold. This issue is unlikely to occur in real world, since having the max_thres higher than UINT_MAX / 2 require unrealistically large aggregation intervals compared to the sampling interval. Also, it requires an unrealistically large number of uncontiguous regions setup. Nonetheless, the consequence is bad and the fix is simple. The issue was discovered [1] by Sashiko.
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege authenticated access to degrade availability by invoking the updateComponents function of basic_functions.ts with manipulated input. Impact is confined to a low availability effect (VA:L) with no confidentiality or integrity loss, and the vendor was notified through a public issue report but has not responded or produced a fix. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because a2ui is a niche, early-version open-source project with minimal deployment, the practical risk is low to moderate despite the CVSS 4.0 base score of 5.3.
Malformed PIM Sparse Mode messages can crash the Pimsm agent on Arista EOS switches, causing a sustained denial of service when an unauthenticated, network-adjacent attacker repeatedly sends the triggering traffic. Exploitation is constrained to devices where both PIM Sparse Mode and MLAG are configured simultaneously - a non-default combination, and the attacker must be Layer-2 adjacent rather than Internet-reachable. Impact is availability-only: the Pimsm agent auto-restarts, so a single malformed message causes only a brief multicast-routing interruption, while continuous repetition is required to keep the agent in a restart loop. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing); risk is bounded rather than urgent.
An out-of-bounds read in the HTTP Cache-Control response header parser of the QtNetwork module lets a hostile or compromised HTTP server crash 64-bit client applications built on Qt 6.0.0-6.8.8 or 6.9.0-6.11.1 that use QNetworkAccessManager. The trigger is an excessively large Cache-Control header value returned to the requesting client; because the over-read is read-only, the outcome is limited to a denial of service (application crash) with no information disclosure and no code execution, and only the client side of the connection is affected - 32-bit builds are not affected. No public exploit code has been identified at time of analysis, and exploitation is not on-demand against an arbitrary target: the victim application must be induced to connect to an untrusted, attacker-controlled, or compromised server (reflected as AT:P in the CVSS 4.0 vector), which keeps real-world risk at a low-to-moderate level despite the presence of RCE and Information Disclosure tags in some feeds.
Unauthenticated HTTP/2 requests to Fastify routes that register response trailers crash the entire Node.js process, dropping all in-flight requests and repeating the outage on every restart. The flaw affects Fastify versions before 5.12.5 and requires two non-default, application-specific conditions: the server must have HTTP/2 enabled and at least one route must call reply.trailer(). No public exploit code or confirmed active exploitation is identified at time of analysis, and the 5.9 CVSS score reflects a bounded availability-only impact rather than a high-severity compromise. Fastify 5.12.5 contains the fix.
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 rpcb_register_inet4() and rpcb_register_inet6() store the result of rpc_sockaddr2uaddr() into map->r_addr without checking it for NULL. rpc_sockaddr2uaddr() returns NULL when its final kstrdup() fails, and the unchecked NULL is then carried into the synchronous RPCBPROC_SET encode path: rpcb_register_call() -> rpc_call_sync() -> rpcb_enc_getaddr() -> encode_rpcb_string(), whose first statement is strlen(string), dereferencing NULL and oopsing the kernel. The crash reproduces under failslab on v6.12; with KASAN the NULL dereference surfaces as a fault on the shadow of address zero: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 [#1] PREEMPT SMP KASAN RIP: 0010:strlen (lib/string.c:409) Call Trace: encode_rpcb_string (net/sunrpc/rpcb_clnt.c:890) rpcb_enc_getaddr (net/sunrpc/rpcb_clnt.c:910) rpcauth_wrap_req_encode (net/sunrpc/auth.c:745) call_encode (net/sunrpc/clnt.c:1966) __rpc_execute (net/sunrpc/sched.c:952) rpc_run_task (net/sunrpc/clnt.c:1243) rpc_call_sync (net/sunrpc/clnt.c:1272) rpcb_v4_register (net/sunrpc/rpcb_clnt.c:500) svc_generic_rpcbind_set nfsd_rpcbind_set svc_register svc_setup_socket svc_addsock write_ports nfsctl_transaction_write vfs_write The crash is reachable when an in-kernel RPC service (nfsd, lockd, nfs-callback) registers with the local rpcbind under enough memory pressure for the small GFP_KERNEL kstrdup() in rpc_sockaddr2uaddr() to fail. The asynchronous getport path already handles this exact failure mode by returning -ENOMEM; only the two register helpers omit the check. Mirror that handling: bail out with -ENOMEM when rpc_sockaddr2uaddr() returns NULL, before the address is fed into the encoder.
Algorithmic complexity attacks against DNSSEC validation in NLnet Labs Unbound 1.26.0 and earlier let remote unauthenticated attackers degrade resolver performance by steering queries to malicious zones that amplify validation work - TagTrap (floods of mismatched DNSKEY/RRSIG/DS records), DelegationTrap (deeply nested chain-of-trust validation), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (Unbound's default DNSSEC validation of the ADDITIONAL section). Exploitation requires a DNSSEC-validating Unbound resolver and attacker control of the zone being resolved, and impact is limited to resource exhaustion (CVSS 5.3, availability Low) rather than compromise or a guaranteed crash. No public exploit identified at time of analysis, and the attacker must be able to drive query volume through the resolver for meaningful effect.
Denial of service in NLnet Labs Unbound 1.12.0 through 1.26.0 arises from a use-after-free in the DNS-over-HTTPS (DoH) code path, reachable only in builds compiled with --with-libnghttp2 when failure conditions such as an RPZ drop action or heavy-traffic stream jostling occur. A remote, unauthenticated attacker can trigger the flaw with a single DoH connection and appropriate traffic, causing memory corruption that, under a hardened allocator, results in controlled termination of the Unbound process. No public exploit code has been identified at time of analysis; the impact is confined to availability (CVSS 5.9, C:N/I:N/A:H) with no confidentiality or integrity effect.
Sustained high-rate streams of distinct uncached names over TCP or DNS-over-TLS can monopolize a single NLnet Labs Unbound worker's event loop, degrading resolver availability for other clients in Unbound versions up to and including 1.26.0. The issue is remotely reachable and unauthenticated (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), but the attacker must hold a connection and keep write throughput ahead of the server's drain/processing so the unbounded consecutive-read loop never yields; impact is confined to the affected worker, is degradation rather than a crash, and ends once the traffic stops, while connection caps, query-rate limits, and upstream rate-limiting reduce feasibility. No public exploit identified at time of analysis, and no evidence of confirmed actively exploited (CISA KEV) status; the vendor's CVSS of 5.3 is consistent with this modest degradation-of-service profile.
CPU exhaustion denial of service in jwcrypto's JWK.import_key() allows a remote unauthenticated attacker to supply a crafted JWK with an arbitrarily large key_ops array and trigger O(n²) duplicate-detection work, consuming CPU proportional to the square of the array length. Any Python application that passes externally-supplied JWK material to this API - via ECDH-ES key agreement, OIDC dynamic client registration, DPoP proof parsing, or ACME account key registration - is vulnerable. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS rates this at 5.9 (Medium) with AC:H reflecting the requirement that attacker-controlled key material must reach the vulnerable code path.
Unauthenticated denial of service in GitLab CE/EE caused by flawed resource accounting in the GraphQL complexity calculation logic, allowing a crafted query to consume disproportionate server resources. Exploitation affects GitLab 18.4.6 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1 - any Internet- or network-reachable instance with the GraphQL API enabled. Public exploit code exists (a HackerOne report is cited as the source), but there is no CISA KEV listing confirming active in-the-wild exploitation at time of analysis.
Improper validation of parameters in GitLab CE/EE's Terraform state upload functionality allows an authenticated user holding project-level permissions to read restricted file contents on the server or cause denial of service. Affected releases are all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, with fixes published in the 19.3.2 patch release. Public exploit details exist via a HackerOne report, but the CVSS base score is only 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N); there is no CISA KEV listing and no EPSS data was provided.
Denial of service in the Seraphinite Accelerator WordPress plugin (all versions before 2.29.24) lets any authenticated low-privilege account - a Subscriber, for instance - invoke a state-update AJAX action that performs no capability check and plant a malformed value, which triggers an uncaught error on every subsequent wp-admin page load and locks all administrators out of the dashboard. The public-facing site remains online and the condition is reversible by clearing the corrupted plugin state, but administrators lose access to their own admin area for as long as it persists. Publicly available exploit code exists, EPSS is low at 0.17% (7th percentile), and there is no CISA KEV confirmation of active exploitation; this is a moderate, security-team-actionable but not emergency-priority issue.
Unbounded buffering of unacknowledged KV-transfer acknowledgements in the MoRIIO connector of vLLM 0.26.0 and 0.27.0 allows a remote, unauthenticated client to grow worker memory indefinitely and degrade or crash LLM inference serving. The root cause is CWE-400 uncontrolled resource consumption in moriio_connector.py, where acknowledgements whose transfer mapping is not yet populated are appended to _pending_unmapped_acks with no TTL or size cap across request_finished, get_finished and _handle_release_message. Impact is availability-only (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N/VA:L); no public exploit code and no CISA KEV
A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server.
A heap-based buffer overflow in the Samsung Escargot JavaScript engine is reachable when a crafted bytecode-cache file is parsed, driven by an integer wraparound (CWE-190) in the string-table length handling inside CodeCacheReader::loadStringTable. Exploitation requires local write access to the engine's bytecode-cache directory (CVSS 5.5, AV:L/PR:L), and the impact is limited to availability - a crash or memory-corruption-induced denial of service with no confidentiality or integrity loss. No public exploit code or CISA KEV listing was identified at time of analysis, and the upstream fix (Samsung PR #1650) adds a bounds check rejecting any maxLength above STRING_MAXIMUM_LENGTH.
Denial of service through catastrophic regular-expression backtracking affects the A2UI web_core and React renderer packages through version 0.10.6, where the Basic Catalog 'regex' function and TextField validation compile and execute attacker-supplied patterns without any safety check. An application that renders attacker-influenced A2UI schemas or expressions can have its JavaScript event loop pinned, freezing the UI or a headless renderer for an attacker-chosen duration at negligible cost to the attacker. Exploitation is remote and unauthenticated per the supplied CVSS 4.0 vector, the upstream fix is visible in pull request #2366, and no public exploit code or CISA KEV entry was reported at time of analysis.
An authenticated administrator of a Netcore NR255-V router running firmware 1.5.130703 can crash the device by sending a crafted HTTP request to the route_policy_add.cgi handler that omits the required exit_port parameter, triggering a null pointer dereference (CWE-476) and a denial-of-service condition. The flaw is remotely reachable over the network but sits behind the management interface's high-privilege authentication requirement (CVSS 4.0 PR:H), and it affects availability only — there is no confidentiality or integrity impact. No public exploit code is confirmed in the provided intelligence, the issue is not listed in CISA KEV, and no EPSS score was supplied; the assigned CVSS 4.0 base score is 6.9.
Crafted
Let me produce the JSON. Key facts: Arista EOS DHCP relay, unauthenticated attacker with adjacent network access (AV:A), sends crafted DHCP reply from non-helper address, relay forwards without source validation. Impact: malicious network config to clients → traffic interception or DoS. CWE-345 insufficient verification of data authenticity. CVSS 4.0 base given: AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H → 6.5. Tags: "Denial Of Service" — arguably mislabeled since it's more about spoofing/rogue DHCP. Could emit mislabeled_tag? It's a tag issue; the impact includes DoS but primary is spoofing/traffic interception. Hmm — "Denial Of Service" tag is not exactly wrong but incomplete. Could flag missing_tag "dhcp"? The suggested slug format e.g. "dhcp". Hmm, the missing_tag must be clearly applicable platform/technique/vendor tag. "arista"? Actually vendor tag "arista" would be applicable. Let me think: rules say emit only when unambiguously implied. Vendor "arista" is unambiguously the vendor. But is it a "platform/technique/vendor tag"? Yes, vendor. Hmm, risk of noise. Maybe emit missing_tag target "DHCP" suggested "dhcp" — that's the core protocol. And maybe missing tag "arista". I'll be conservative: one missing_tag for "Arista" → "arista"? Hmm. I think the more defensible one is the product/vendor: the description omits... actually tags list only "Denial Of Service". A DHCP-related tag seems reasonable. I'll include a missing_tag for "DHCP" (slug "dhcp") with high confidence? It's a protocol tag though; typical tag taxonomy includes platform/vendor/technique. DHCP is more a protocol. I'll include "arista" as missing vendor tag — high confidence. Actually maybe both. Let me include just one to avoid noise: missing_tag target "Arista", suggested "arista". Hmm, but also could flag mislabeled_tag "Denial Of Service" — reason: advisory primarily concerns DHCP spoofing/malicious config injection, DoS is secondary. Is that "clearly wrong and verifiable"? No
Use-after-free in Chrome's Skia graphics library allows an attacker who has already compromised the renderer process to read cross-origin data after a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. Chromium rates the bug High severity because it can breach the same-origin boundary, even though the CVSS base score is only 3.1 (confidentiality-limited, no integrity or availability impact). No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the attack is not automatable per CISA's SSVC assessment.
Oracle VM VirtualBox 7.2.16 contains a flaw in the Core component that lets a high-privileged attacker who already has a logon on the host trigger a partial denial of service against the VirtualBox process itself. The attack is local (AV:L) and requires elevated privileges (PR:H), but carries a scope change (S:C), meaning the successful exploit can significantly affect additional products layered on the same infrastructure. CVSS 3.1 scores this 3.2 with availability-only impact; there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low for most deployments.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets an attacker who already holds a high-privileged logon on the host read a limited subset of VirtualBox-accessible data and trigger a partial denial of service against the hypervisor. The scope-change rating (S:C) indicates the impact can extend beyond VirtualBox itself to other products on or around the host, but exploitation requires local logon with elevated privileges and there is no indication of remote reach. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so real-world priority is driven by host-access hygiene rather than internet-facing exposure.
Denial of service in Oracle VM VirtualBox 7.2.16, where a local attacker who already holds a low-privileged logon session on the host can trigger a fault in the Core component that hangs or repeatedly crashes the VirtualBox process. Exploitation is difficult (AC:H) and requires active interaction from a different user on the same machine, and the impact is limited to availability — no confidentiality or integrity loss — giving a CVSS 3.1 base score of 4.4. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so treat it as a local reliability/DoS nuisance rather than a remote compromise risk.
Unauthenticated attackers with network access to HTTP endpoints can cause a partial denial of service in Oracle Helidon versions 4.0.0 through 4.5.4 by abusing the WebSocket component. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only partial impact) and requires no credentials or user interaction, making it trivially automatable against any reachable WebSocket-enabled service. No public exploit code, EPSS score, or CISA KEV listing was provided in the available intelligence, so active exploitation is not confirmed.
Unauthenticated HTTP requests can drive Oracle Helidon 3.0.0 through 3.2.20 into a partial denial-of-service condition through the helidon-media-multipart component, which handles multipart/form-data parsing. The flaw is network-reachable with no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) and impacts availability only — confidentiality and integrity are unaffected. Oracle rates it easily exploitable in its CPU advisory, but no KEV listing or public exploit code was present in the supplied intelligence feeds, so no public exploit identified at time of analysis.
Unauthenticated attackers with network access to an HTTP endpoint on Oracle Helidon 4.0.0 through 4.5.4 can trigger a partial denial of service in the framework's JSON component, degrading availability of the hosted application. The flaw is rated CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is described by Oracle as easily exploitable, though no public proof-of-concept, EPSS score, or CISA KEV entry was supplied in the input data, so active exploitation is unconfirmed.
A partial denial-of-service flaw in the Core component of Oracle Coherence lets a low-privileged, network-positioned attacker degrade availability of the distributed data grid by sending crafted HTTP requests. Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product are listed as affected by Oracle and mirrored by EUVD (EUVD-2026-79717). The CVSS 3.1 base score is only 4.3 because impact is limited to availability (A:L) with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was present in the supplied intelligence.
Partial denial of service in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 (Access SDK component) can be triggered by a low-privileged, authenticated attacker who reaches the product over HTTP. The flaw is rated CVSS 3.1 base 3.1 with an availability-only, partial impact, and Oracle characterizes it as difficult to exploit (AC:H), so successful disruption requires favorable timing or state rather than a simple repeatable request. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so there is no indication of active exploitation at time of analysis.
A denial-of-service flaw in the Oracle Net Services component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets an unauthenticated attacker with network access over TCPS hang or repeatedly crash the Net Services layer, degrading or halting database connectivity. Exploitation is network-reachable and low-complexity but requires interaction from a person other than the attacker, and it yields availability impact only (CVSS 3.1 base 6.5, C:N/I:N/A:H). No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated network attackers with access to the TLS interface of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can trigger a hang or repeatedly crash the Forge component while also reading a limited subset of application-accessible data. Oracle's advisory rates it 6.5 (AV:N/AC:H/PR:N/UI:N/C:L/A:H), so impact is dominated by availability loss rather than data compromise, and the high attack complexity suggests exploitation requires carefully crafted conditions rather than a trivial request. No public exploit code or CISA KEV entry is present in the available intelligence, and the vulnerability is not confirmed as actively exploited at time of analysis.
Unauthenticated attackers with network access to the HTTP interface of the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can exploit a difficult-to-trigger flaw to read the full set of data the platform can reach and to partially degrade its availability. The vendor rates this 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), so the damage ceiling is high confidentiality loss rather than code execution. No public exploit code and no CISA KEV entry appear in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed — the practical driver for patching is the exposure of complete catalogue and index data, not observed attacks.
A buffer overflow in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways allows an authenticated administrator to crash or destabilize the appliance, producing a denial-of-service condition. All maintenance branches 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 are affected per ENISA EUVD tracking. The CVSS base of 5.5 with PR:H reflects that high administrative privileges are required, so this is not an unauthenticated remote outage; no public exploit code or CISA KEV listing was identified at time of analysis.
Unauthenticated denial of service in HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already sits on an adjacent network segment to crash the appliance, with the added consequence that the gateway cannot reboot itself and requires manual intervention to recover. Affected releases span the 9.4, 9.5, 9.6 and 9.7 maintenance trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively) per the ENISA EUVD record. The flaw is rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N, availability-only impact) and no public exploit code has been identified at time of analysis; there is no CISA KEV listing.
Improper input validation in the Android Cellular Modem component lets an attacker who is radio-adjacent to a device crash the modem stack, producing a denial of service against cellular voice and data with no user interaction required. The flaw carries a CVSS 3.1 base score of 5.7 (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and is classified as CWE-20; only availability is affected. Google's Pixel/Android security bulletin for September 2026 (2026-09-01) is the vendor reference, but no CISA KEV listing, no public proof-of-concept, and no EPSS data were supplied, so opportunistic mass exploitation is not indicated at time of analysis. Because exploitation is confined to the radio adjacency and the impact is availability-only, this is a moderate-priority hardening item rather than a headline emergency.
Ingestion denial of service in Bugsink affects self-hosted instances running versions 2.2.1 and earlier, where any caller holding a valid project DSN can submit an event carrying an unusually large custom tag set and force the server to write excessive tag rows. Because Bugsink digests events through a single-writer database transaction, that oversized write blocks concurrent ingestion and temporarily starves the event pipeline of other projects and clients. Version 2.2.2 fixes this by enforcing a configurable MAX_EVENT_TAGS cap (default 100) before storage; the impact is strictly availability-limited, with no data exposure, event modification, or code execution, and no public exploit code or CISA KEV listing was identified at time of analysis.
Denial of service in Open5GS 2.7.7 and earlier lets a remote attacker crash the SGW-U/UPF process by sending a crafted PFCP Session Establishment or Modification Request containing a malformed Outer Header Creation IE. The handler fails to validate the Outer Header Creation description bits and payload length, so a failed GTP-U peer connection leaves a node with an unset address family in the peer list; a subsequent request referencing the same address reaches ogs_pfcp_far_f_teid_hash_set and aborts the process. Publicly available exploit code exists (GitHub issue #4699) and an upstream fix commit has been published, but the flaw is not listed in CISA KEV.
Resource exhaustion in the Security component of Mozilla Firefox before 156 and Firefox ESR before 153.3 lets a remote, unauthenticated attacker cause a denial-of-service against the browser, provided the victim renders attacker-controlled web content in an affected build (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Impact is availability-only: confidentiality and integrity are unaffected and there is no sandbox or scope escape, so at worst the tab or browser becomes unresponsive or crashes. The issue is fixed in Firefox 156 and Firefox ESR 153.3, EPSS is low at 0.14% (4th percentile), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in Mozilla Firefox's SVG rendering component allows a remote, unauthenticated attacker to crash or hang the browser process by convincing a victim to load a crafted SVG document. The flaw is an unbounded resource allocation issue (CWE-770) that affects Firefox versions before 156 and Firefox ESR versions before 153.3 on default configurations; exploitation requires user interaction (UI:R), and impact is limited to availability with no confidentiality or integrity effect. No public exploit code has been identified and the flaw is not confirmed as actively exploited (CISA KEV), while EPSS is very low at 0.15% (5th percentile), consistent with a genuine but low-priority availability issue that Firefox's multiprocess architecture typically confines and recovers from.
Denial of service in the Mozilla Firefox Audio/Video component lets a remote attacker crash or hang the browser by having a victim load crafted media content in a version prior to Firefox 156. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), so exploitation is unauthenticated by vector but depends entirely on convincing the target to render attacker-controlled audio or video; impact is limited to availability with no confidentiality or integrity loss. This is a moderate, availability-only issue that is unlikely to be a high priority for most organizations; no public exploit has been identified at time of analysis and EPSS is 0.14% (4th percentile), and the vendor-released fix is Firefox 156.
A memory leak in the gss-ntlmssp NTLM target-info parser allows a malicious or man-in-the-middle NTLM server to gradually exhaust memory on the client by sending a crafted NTLM CHALLENGE message containing duplicated string-valued AV_PAIR entries. Each duplicate causes the parser to allocate a new string buffer without freeing the previous one, so repeated authentications accumulate leaked allocations and eventually degrade or crash the client, producing a denial of service. The impact is availability-only and low severity (CVSS 3.7, A:L), exploitation requires an attacker to control the NTLM challenge, and no public exploit code or CISA KEV listing was identified at time of analysis.
MISP 2.5.45 and earlier fails to apply its authentication-failure logging throttle on two API auth paths — requests presenting no API key and requests presenting a key of incorrect length — allowing an unauthenticated remote caller to write an unbounded number of durable auth_fail entries into the database. Repeated requests can exhaust storage and degrade or deny availability of the platform (CWE-770). No public exploit code and no CISA KEV entry were present in the supplied intelligence; an upstream fix commit (2bf887433) is available from the vendor.
A null pointer dereference in GNU Binutils 2.47 lets a locally-supplied malformed ELF object crash the toolchain when the linker or related BFD-consuming utilities reach the elf_x86_allocate_dynrelocs() dynamic-relocation allocator in bfd/elfxx-x86.c. Only availability is impacted — the fault aborts the affected utility and no memory corruption, information disclosure, or code execution has been demonstrated, which is consistent with the CVSS 4.0 base score of 1.9 (AV:L/PR:L, VA:L only). Publicly available exploit code exists in a GitHub proof-of-concept repository linked from the NVD record, but there is no indication of active exploitation or CISA KEV listing; upgrading to Binutils 2.48 resolves the issue.
A null pointer dereference in GNU Binutils 2.47 allows a local attacker to crash affected utilities by supplying a crafted ELF file. The flaw resides in elf_x86_64_common_section_index() in bfd/elf64-x86-64.c, part of the ELF section-handling path, and only denies availability of the tool process - there is no confidentiality or integrity impact. Publicly available proof-of-concept code exists and the issue is fixed in version 2.48, but real-world risk is low given the local attack vector, minimal impact, and low EPSS-relevant severity.
A NULL pointer dereference in GNU Binutils 2.47 lets a locally-supplied, malformed ELF object crash BFD-based tools such as ld, objdump or readelf when they parse the crafted symbol tables. Only availability is affected — the process dies with a segmentation fault and there is no confidentiality or integrity impact. Publicly available exploit code exists (a PoC is published in a GitHub repository referenced from the Sourceware bug report), but there is no CISA KEV listing and no vendor patch at the time of analysis, since the project has reportedly not yet responded to the bug report.
Denial of service in GNU Binutils 2.47: running a BFD-based utility such as objdump, readelf, nm, or ld against a crafted ELF object drives execution into the .eh_frame ('Eh Frame Handler') parsing path, where _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c dereferences a NULL pointer and crashes the process. The vector is local only - a victim must be induced to process an attacker-supplied malformed binary - and the outcome is limited to availability loss of that single tool invocation, with no confidentiality or integrity impact, which is why the supplied CVSS v4.0 base is only 1.9 and EPSS sits at 0.11% (2nd percentile). Publicly available exploit code exists (referenced from the VulDB entry and a public GitHub proof-of-concept write-up), but there is no evidence of active exploitation and the issue is not in CISA KEV; CISA's SSVC framework classifies it as poc / not automatable / partial technical impact, and no vendor-released patch has appeared because the upstream bug report (sourceware bug 34446) has not yet been answered.
Use-after-free in GPAC's scenegraph node handling allows a remote attacker to trigger memory corruption by delivering a crafted media file that is processed by the affected application. The vulnerability exists in `gf_node_get_name_and_id()` in `scenegraph/base_scenegraph.c`, where a node pointer could be dereferenced after being freed due to missing null/reference-count guards in the BIFS decoder's command assignment path. Exploitation requires user interaction (opening a malicious file), a publicly available proof-of-concept exists (poc_16_bt.zip), and no confirmed active exploitation is recorded in CISA KEV.
Use-after-free in GPAC's LASeR scene graph command processing subsystem allows remote attackers to corrupt heap memory by supplying a crafted media file, potentially leading to process crash or code execution. Affected are GPAC builds up to commit f1219cde; the flaw stems from direct node-pointer assignment without proper reference counting in the LASeR decoder and scene graph command application paths. A public proof-of-concept exploit is confirmed available; vendor-released patch exists at commit e34f4ba and release abi-16.24.
A resource-exhaustion (denial of service) flaw in vLLM's OpenAI-compatible /v1/chat/completions endpoint lets a caller- or model-supplied Jinja chat_template drive nested range() loops whose evaluation cost grows as O(N^depth), tying up a request-runtime worker thread for tens of seconds. vLLM releases up to and including 0.27.1 are affected (EUVD lists 0.27.0 and 0.27.1), with the CPE range expressed as vllm-project:vllm:* so earlier releases are plausibly in scope too. Publicly available exploit code exists, and CVSS 4.0 rates the issue only 2.1 with availability impact rated Low; a fix PR that introduces a minijinja evaluation 'fuel' budget is still awaiting acceptance.
Use-after-free in zstd-jni's Dictionary Sharing component allows remote attackers to corrupt native heap memory through the ZstdCompressCtx.loadDict() and ZstdDecompressCtx.loadDict() APIs in versions up to 1.5.7-13. The defect is a logic inversion in shared-lock accounting: the code releases the reference count on the incoming dictionary parameter rather than on the previously held dictionary reference, causing the old native buffer to remain referenced after it can be freed by another thread. A public proof-of-concept exists via GitHub issue #404, and vendor released a confirmed fix in version 1.5.7-14.
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service.
Prolink's 13A Smart Plug (model DS-3202M-UKv3) paired with the mEzee 2.6.7 mobile app mishandles packets received during the Wi-Fi provisioning phase, letting an attacker within radio range crash the plug or redirect it to connect to an attacker-controlled device instead of the legitimate access point. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only per the published vector), while the practical attack surface is narrower because it exists only while the plug is actively being set up. Exploitation status at time of analysis: no public exploit identified at time of analysis, though a public GitHub repository ('crossprobe') is linked in the CVE record and appears to be proof-of-concept research tooling; the CVE is not listed in CISA KEV and no EPSS score was supplied.
Null pointer dereference in GNU Binutils 2.47 allows a local low-privileged user to crash Binutils toolchain utilities by supplying a crafted input file that triggers the vulnerable `_bfd_write_merged_section` function in `bfd/merge.c`. The Section Merge component of the BFD (Binary File Descriptor) library fails to validate a pointer before dereference, resulting in a denial of service. A proof-of-concept exploit has been publicly disclosed via VulDB and the GNU Binutils bugzilla, and no vendor patch is available as the project has not yet responded to the disclosure.
Null pointer dereference in GNU Binutils 2.47 allows a local attacker with low privileges to crash binutils tools by supplying a crafted ELF binary with a malformed SHT_GROUP section, triggering the defect in `bfd_elf_set_group_contents` within `bfd/elf.c`. A public proof-of-concept has been disclosed and the upstream project has not yet responded to the coordinated disclosure. No public exploit identified for active exploitation (not in CISA KEV); CVSS 4.0 rates this 1.9, reflecting its extremely limited real-world impact.
Null pointer dereference in GNU Binutils 2.47 crashes the ELF linker when processing orphan sections via a crafted object file. The flaw resides in the `elf_orphan_compatible` function in `ld/ldelf.c`, exploitable by any local user who can invoke the `ld` linker against a specially crafted ELF input. A public proof-of-concept has been posted to the upstream Bugzilla tracker (attachment #16882 / bug #34450), but as of this analysis the GNU Binutils project has not yet released a patch or responded to the disclosure.
Use-after-free in GPAC 26.07.0's MP4Box component allows a local user to crash the application by supplying a crafted MP4 file containing a malformed BIFS scene graph. The flaw resides in gf_node_deactivate_ex() within scenegraph/base_scenegraph.c, where a scenegraph node with a zero instance count could be dereferenced after release because an assertion (gf_assert) was used instead of a guarded early return. A public POC exploit exists; impact is limited strictly to availability (application crash) with no confidentiality or integrity consequence.
Use-after-free in GPAC 26.07.0's MP4Box scenegraph engine allows a local low-privileged user to crash the application by processing a crafted scene file. The vulnerability exists in gf_node_unregister() within scenegraph/base_scenegraph.c, triggered when proto default field nodes (SFNODE/MFNODE typed) are not properly unregistered before scenegraph teardown, leaving dangling pointers subsequently dereferenced. A public proof-of-concept exploit (poc_09_add.zip) is available, though exploitation is limited to local availability impact with no confirmed active exploitation. No special privileges beyond running MP4Box are required.
XML External Entity (XXE) injection in IBM MQ's mqweb MFT REST API allows network-accessible, low-privileged attackers holding MFT publish authority to read sensitive files from the MQ server filesystem or cause denial of service. Affected deployments span seven release trains across LTS and CD channels from version 9.1 through 10.0.0.0. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained by both authentication and a specific MFT publish privilege requirement.
Uncontrolled resource consumption in IBM Cloud Pak for Business Automation enables authenticated network users to exhaust service resources and trigger a denial of service condition. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, each capped at specific interim fix levels. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.
Integer overflow (CWE-190) in macOS allows a locally present application to crash an affected component or the operating system, producing a denial-of-service condition rather than code execution or data theft. Apple fixed the flaw with improved input validation in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 per advisories 149035, 149042 and 149043. Exploitation requires a malicious app to be running on the target Mac and the user to interact with it (AV:L/UI:R); no public exploit code has been identified and EPSS is only 0.19% (9th percentile), so this is a routine patch-cycle item rather than an urgent one.
Loading attacker-controlled web content on an unpatched Apple device can trigger a null pointer dereference in the WebKit rendering pipeline, crashing the browser or app that renders the page and producing a denial-of-service on iPhone, iPad, Mac, Apple Watch and Apple Vision Pro. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27 and watchOS 27. The flaw scores CVSS 6.5 with a user-interaction requirement (UI:R), EPSS is only 0.20% (10th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
A buffer overflow in multiple Apple operating systems — iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8 and earlier — allows a locally executing app to crash the affected system or process, producing a denial of service. The flaw stems from insufficient bounds checking (CWE-120) and is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, availability-only impact), meaning an attacker must already have the ability to run code as a low-privileged app on the device. Apple has released patches and there is no CISA KEV listing, no public exploit code identified, and EPSS is low at 0.21% (12th percentile), so real-world exploitation pressure is currently minimal.
Local denial-of-service in Apple iOS, iPadOS, and visionOS lets an app already executing on the device exhaust resources or crash a system service by abusing an OS interface that failed to enforce required entitlement checks, producing an availability-only impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation is constrained to locally installed, attacker-controlled or compromised apps (PR:L, AV:L), so there is no remote or unauthenticated path and no data exposure or code-integrity loss. Apple addressed the flaw by adding entitlement validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27; no public exploit code has been identified at the time of analysis and EPSS is low at 0.16% (6th percentile), consistent with a narrow local-only attack surface.
A use-after-free (CWE-416) in Apple's memory management code allows a locally running application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS to crash the affected system, producing an unexpected termination or reboot. The flaw affects all platforms before the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and rates CVSS 5.5 (AV:L/PR:L/UI:N, availability-only impact). No public exploit code or active exploitation has been identified, and EPSS is low at 0.21% (11th percentile), so this is a patched, availability-only issue rather than an urgent remote-code-execution threat.
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
Unexpected system termination can be triggered on Apple devices by a locally executed app that exploits a use-after-free memory corruption in shared system code, which Apple addressed through improved memory management. The flaw affects essentially every current Apple OS branch below the fixed releases — iOS/iPadOS 26.6+, macOS 15.8/26.6+/27, tvOS 26.6+/27, visionOS 26.6+/27 and watchOS 26.6+/27 — with CVSS 5.5 reflecting an availability-only impact and a local attack vector. EPSS is low (0.24%, 16th percentile), no public exploit code has been identified, and there is no CISA KEV entry, so this is a routine patch-cycle item rather than an urgent threat.
A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.
Improper resource handling in FFmpeg 8.0.x's HLS playlist parser allows remote attackers to cause denial of service by supplying a crafted HLS playlist containing malformed `duration` or `target_duration` field values. The flaw resides in `parse_playlist()` within `libavformat/hlsproto.c` and requires passive user interaction - the target application must process the attacker-controlled `.m3u8` playlist. No public exploit code or active exploitation (CISA KEV) is known; vendor-confirmed fixes are available in FFmpeg 8.1 and 9.0.
Authenticated denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) lets a remote attacker with a valid database session crash the engine by triggering a null pointer dereference. The impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity of stored data are not directly at risk, but any application or Db2 Connect client depending on the affected instance loses service. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, SSVC rates exploitation and automatable both as none/no, and no EPSS score was supplied in the intelligence feed.
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) can be driven into a denial-of-service condition by a remote attacker who holds valid database credentials, through uncontrolled consumption of server resources. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so the impact is loss of availability only - no confidentiality or integrity exposure is claimed. Patch exists via IBM support document 7286983; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'.
Physically attached USB hosts can crash Zephyr RTOS builds that use the ITE it82xx2 USB device-controller driver, because the driver re-initializes an already-pending delayed work item during a disable-then-enable cycle, corrupting kernel timeout and workqueue linked lists and causing a kernel panic. Affected builds are those running Zephyr 3.7.0 through versions below 4.4.2 with the it82xx2 UDC driver enabled, typically on hardware that faces a removable USB host — kiosks, field instrumentation, or development boards. Exploitation requires a direct physical USB connection (CVSS AV:P, score 4.6), delivers denial of service only with no confidentiality or integrity impact, and is not currently listed as actively exploited or accompanied by published exploit code.
A use-after-free write in the Zephyr RTOS ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) affects Zephyr 4.0.0 through 4.4.1 and allows a malicious USB host to create a kernel heap-corruption primitive on the device side. When a multi-packet OUT transfer is received on a non-control endpoint, the driver re-arms the endpoint to keep filling the same net_buf while simultaneously handing that buffer to the upper USB device stack, which may free and recycle it while DMA continues; the completing packet is also submitted a second time, corrupting the event slist and causing a double net_buf_unref(). Exploitation is physical (USB attach) with no authentication or user interaction required, giving a reliable denial of service and plausible adjacent-pool memory corruption; no public exploit code or CISA KEV listing was identified for this CVE at time of analysis.
A use-after-free and double-free race in Zephyr's TLS socket session cache lets a malicious or compromised TLS peer corrupt the mbedTLS heap and crash an affected device. The flaw is reachable only by applications that explicitly enable the TLS_SESSION_CACHE socket option (off by default) and run concurrent TLS client connections from multiple threads, since the process-global client_cache defaults to a single shared slot. A vendor fix exists in commit 7f9d8ee (shipping in Zephyr 4.4.2 per the EUVD version range), and no public exploit code or active exploitation has been identified.
Remote denial of service in the Zephyr RTOS IPv6 Neighbor Discovery stack: an adjacent, unauthenticated attacker sends a Router Advertisement whose Reachable Time field is set to 1, which collapses the randomized reachable-time calculation in net_if_ipv6_calc_reachable_time() to exactly 0 ms. On builds compiled with CONFIG_ASSERT the zero value trips NET_ASSERT("Zero reachable timeout!") and kills the kernel, while assertion-free builds arm a K_MSEC(0) timer that fires immediately, pushing confirmed neighbors into perpetual STALE re-solicitation. Quoted CVSS is
Stack-based buffer overflow in MikroTik RouterOS's mtget binary TFTP RRQ builder allows any authenticated user, including those with only read-only group membership, to crash the mtget worker process by issuing a /tool fetch command with a crafted tftp:// URL path of 507 bytes or more. The overflow involves an unbounded rep movsb instruction that overwrites saved registers at a deterministic stack offset, causing a reproducible process crash without requiring network connectivity to an actual TFTP server. No public exploit code has been identified at time of analysis, and vendor patches are available in RouterOS 7.23.4 (long-term) and 7.24.2 (stable).