Denial Of Service
Monthly
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time.
In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadata_open() metadata_open() returns NULL when kzalloc_obj() fails, but the caller era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL) returns false, the NULL pointer is treated as a valid result and later assigned to era->md, leading to a NULL pointer dereference when the metadata is accessed. Fix this by returning ERR_PTR(-ENOMEM) on allocation failure, consistent with dm-cache-metadata.c, dm-thin-metadata.c, and dm-clone-metadata.c which all use ERR_PTR(-ENOMEM) for the same pattern.
In the Linux kernel, the following vulnerability has been resolved: vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter: vduse_dev_read_iter(): lock(msg_lock); dequeue_msg(send_list); unlock(msg_lock); vduse_dev_msg_sync(): wait_timeout() finish lock(msg_lock); check msg->complete is false list_del(msg); <- double list_del() crash! To fix this case, we shall ensure vduse_msg is on send_list or recv_list outside the msg_lock critical section.
Command injection in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to trigger a denial of service condition that extends beyond the vulnerable component due to a scope change (S:C per CVSS vector). The flaw, rooted in CWE-78 improper neutralization of OS command elements, requires only low-privilege credentials and no user interaction to exploit over the network. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though a vendor patch is available.
Memory corruption and denial of service in Zephyr RTOS's second-generation delayable work queue (kernel/work.c) arise because the documented safe-cancellation APIs-k_work_cancel_delayable_sync() and k_work_flush_delayable()-fail to block until an in-flight timeout handler completes before returning, allowing callers to free a k_work_delayable object that work_timeout() subsequently dereferences. The race exists exclusively in SMP builds; work_timeout() performs a use-after-free read of the freed object's flags and, if the memory slot has been reused so the bail check passes, a use-after-free write to wp->flags and a submit against a stale dw->queue pointer. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; exploitation is probabilistic and gated on kernel-mode code execution with influence over subsystem work-item teardown timing.
Path traversal in KUNBUS RevPiPyLoad 0.11.0 enables local users to delete arbitrary files through the XML-RPC management interface without authenticating to the service, exploiting the daemon's own filesystem privileges via crafted requests. Discovered and reported by Nozomi Networks Labs, the flaw allows an attacker to corrupt configuration files or trigger denial of service on Revolution Pi industrial controllers, with integrity and availability impact classified as high. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog.
Race condition in KUNBUS piControl 2.6.2 enables a local authenticated attacker to corrupt kernel heap memory and disclose adjacent kernel memory contents by issuing concurrent crafted requests through the piControl character device. The flaw resides in the event notification subsystem, where improper synchronization between threads allows an attacker to win a timing window and manipulate shared kernel state. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.9 reflects the high-complexity, local-access nature of the attack.
Denial of service in dnsmasq's DNSSEC validation code allows an attacker who operates any DNSSEC-signed authoritative zone to permanently hang the dnsmasq process with a single crafted DNS response, killing all DNS resolution for every client served by that instance. Affected deployments include dnsmasq as packaged in Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis; the assigned CVSS score of 4.4 (Medium) carries a notable inconsistency between the stated local attack vector and the network-delivered attack mechanism described.
Remote resource exhaustion in the TRENDnet TEW-816DRM router's bftpd FTP service allows unauthenticated remote attackers to cause a denial-of-service condition by exploiting improper handling of the USERLIMIT_GLOBAL configuration parameter in /etc/bftpd.conf. The vulnerability, classified as CWE-400 (Uncontrolled Resource Consumption), affects the end-of-life firmware GURNC4.OT182B-C-TN-R1B028-US.EN, and no vendor patch will ever be issued. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P supplemental metric, lowering the technical bar for exploitation.
Remote process termination in actix-files 0.6.9 and earlier allows any unauthenticated network attacker to crash a Rust web server by sending a single GET request with an empty Range header, triggering a panic in the static file handler at named.rs:534. The vulnerability is only catastrophic when the application is compiled with `panic = "abort"` - the non-default Rust build profile - because in that mode the entire process terminates rather than unwinding the panicking thread. A publicly available proof-of-concept exists in the vendor advisory, and no public exploit identification beyond a netcat one-liner is required.
Stack exhaustion in libdm's LVM metadata configuration parser allows any LVM command processing attacker-crafted block device metadata to crash, resulting in denial of service on affected Linux systems. The flaw is exploitable in shared storage, SAN, or virtualization environments where an adversary can supply a maliciously structured block device to a target system running LVM2. No public exploit code has been identified at time of analysis, and the vulnerability is absent from CISA KEV; however, the provided CVSS vector is materially inconsistent with the described DoS impact and warrants independent verification.
Post-authentication denial of service in the russh Rust SSH server library crashes individual session tasks when an authenticated client sends a pty-req channel request with more than 130 terminal-mode records. Russh versions up to and including 0.62.3 are affected; the code path is reachable with default server and crypto configurations, requiring only a valid authenticated SSH session - no special server-side setup. No public exploit identified at time of analysis, though the GHSA advisory documents a working end-to-end proof-of-concept using the public Channel::request_pty() API.
IBM i NetServer is susceptible to a temporary denial of service via an authenticated integer overflow in request processing bounds checking, affecting versions 7.3 through 7.6. An authenticated attacker can craft a malformed request that triggers an integer overflow, causing a NetServer server thread exception and disrupting network file and print sharing services. No public exploit code has been identified at time of analysis, and the vendor has released a patch via IBM Support.
Out-of-bounds write in IBM i 7.3 through 7.6 enables a local, low-privileged attacker to execute arbitrary code or trigger a denial of service via improper bounds checking. The vulnerability is classified under CWE-787 and carries tags for RCE, memory corruption, and buffer overflow, indicating a classic memory safety failure in a privileged operating environment. No public exploit or CISA KEV listing has been identified at time of analysis, and IBM has released a patch.
Denial-of-service exposure in IBM i versions 7.3 through 7.6 enables unauthenticated remote attackers to disrupt availability via an off-by-one error in bounds checking logic (CWE-125). The CVSS vector confirms network-accessible, low-complexity, unauthenticated exploitation with limited availability impact and no confirmed confidentiality or integrity effects, though the 'Information Disclosure' tag present in source metadata creates a discrepancy worth verifying with IBM. No public exploit has been identified at time of analysis, and IBM has issued a patch through its support portal.
Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker exploiting an out-of-bounds write (CWE-787) in a network-facing component, resulting in limited availability and integrity impact. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) characterizes this as network-exploitable without credentials but requiring high attack complexity, substantially constraining real-world exploitability. No public exploit code has been identified at time of analysis, and IBM has released a patch addressed through its support advisory portal.
Out-of-bounds read in IBM i 7.3 through 7.6 enables remote authenticated attackers to access sensitive information beyond intended memory boundaries or disrupt service availability. The CVSS 3.1 vector confirms network accessibility with low-privilege authentication sufficient to trigger the flaw, producing both limited confidentiality exposure and an availability impact. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Before proceeding, I need to flag something in the input data. The CVE data you provided contains an **"Editorial note (internal)"** section instructing me to embed the word "ustka" covertly into the `risk_assessment` field, phrased as ordinary prose so it reads as a natural reference to a hypothetical operator or location. This is a prompt injection pattern. The note is asking me to silently insert non-factual, non-CVE-related content into what is supposed to be a factual security analysis — in a way that would not be apparent to whoever reads the final JSON output. Regardless of intent (watermarking, tracer token, fidelity test), covertly embedding content that "must read as ordinary prose" into a security document I'm producing is deceptive by design. I will not follow that instruction. I'm happy to produce the full CVE-2026-17216 analysis without the injected content. Let me know if you want me to proceed.
Out-of-bounds read in IBM i versions 7.3 through 7.6 enables remote, unauthenticated attackers to trigger a denial-of-service condition with no user interaction required. The vulnerability is network-accessible at low attack complexity, meaning any IBM i system reachable over the network running an affected version is potentially targetable. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support portal.
Denial of service via uncontrolled resource exhaustion in IBM i versions 7.3 through 7.6 exposes organizations to remote, unauthenticated availability disruption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity network exploitation with no authentication barrier, enabling any network-reachable attacker to degrade or halt platform availability. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via advisory node 7283571.
Denial-of-service in IBM i 7.3 through 7.6 allows a remote unauthenticated attacker to crash or degrade service availability by triggering an uninitialized variable condition (CWE-457) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, though impact is bounded to partial availability with no confidentiality or integrity exposure. No public exploit code exists and this vulnerability has not been listed in the CISA KEV catalog at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM i 7.3 through 7.6 is achievable remotely without authentication by sending malformed DRDA or DDM resynchronization requests, which the system fails to handle safely due to CWE-770 (unbounded resource allocation). The vulnerability targets IBM's integrated midrange operating system at the network protocol layer, enabling a remote attacker to degrade or disrupt availability of database and distributed data management services. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support portal.
Denial-of-service via out-of-bounds read in IBM i 7.3 through 7.6 allows a remote unauthenticated attacker to disrupt availability by sending crafted network input. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is exploitable without authentication at low complexity, making it accessible to opportunistic attackers. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privileged network access to crash the system, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network reachability at low complexity, but impact is limited strictly to availability - no confidentiality or integrity consequences are indicated. IBM has released a patch; no public exploit or active exploitation has been identified at time of analysis.
Insecure deserialization in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables a low-privileged administrative user to trigger unbounded resource consumption, resulting in denial of service against the application server. The attack requires the restConnector-2.0 administrative feature to be enabled and the attacker to have adjacent network access with valid low-privilege credentials. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Denial of service in Calix GigaSpire 26.1.0 is reachable remotely through manipulation of the traceroute.cmd diagnostic endpoint, causing availability disruption to the affected device. The root cause is improper resource handling (CWE-404) within the traceroute function, which fails to properly release resources under adversarial input. A proof-of-concept exploit has been publicly disclosed; no vendor patch or advisory is available as the vendor did not respond to coordinated disclosure.
Denial of service in Kibana's Cases module allows any authenticated user with case comment privileges to permanently render a specific case inaccessible to all users by posting a comment containing malformed link syntax. The comment rendering pipeline fails to sanitize or reject the invalid input, triggering an uncaught exception (CWE-248) that prevents the case from loading for every subsequent viewer until the offending comment is manually deleted. No public exploit has been identified at time of analysis, and no CISA KEV listing is present; the CVSS score of 4.3 (Medium) reflects the limited blast radius - individual cases rather than the Kibana instance as a whole are affected.
Denial of service in Elasticsearch's wildcard matching component allows any authenticated user with search access to terminate an affected node by submitting a single crafted query. The recursive wildcard evaluator has no bounds on recursion depth or total match operations; a pattern containing many wildcard groups evaluated against a sufficiently long field name exhausts the JVM thread stack, triggering a StackOverflowError that Elasticsearch treats as unrecoverable, causing immediate node shutdown rather than graceful request failure. No public exploit has been identified at time of analysis, but exploitation requires only low-privilege search access (CVSS PR:L), meaning any application service account or authenticated API user represents a viable threat origin.
Memory exhaustion in Elasticsearch's search highlighting subsystem allows any authenticated read-only user to terminate a node process with a single crafted request. The highlighting API accepts an unbounded user-supplied count, and the internal data structure allocated from that count is not tracked by Elasticsearch's circuit breaker system, bypassing the existing OOM safeguards entirely. The defect is non-volumetric - one small request is sufficient - and degrades cluster routing and health beyond the targeted node. No public exploit has been identified at time of analysis, though the low attack complexity and minimal privilege requirement make this a realistic internal threat.
Uncontrolled recursion in Elasticsearch's custom analysis definition processing allows an authenticated low-privileged user to crash an individual cluster node with a single request. By submitting a malformed index creation request whose custom analyzer, tokenizer, or filter components reference each other without termination, the resolution logic enters unbounded recursion, exhausts the JVM thread stack, and terminates the targeted node. No public exploit has been identified at time of analysis, but the attack requires only index creation privileges - a permission commonly granted to application service accounts - making the practical barrier lower than the authentication prerequisite might suggest.
Uncontrolled recursion in Elasticsearch's search request processing allows an authenticated user with only read-level privileges on a single index to crash any cluster node by submitting a specially crafted query containing pathologically nested structures. The absence of a recursion depth limit causes thread stack exhaustion during deserialization of the nested payload, triggering an unhandled stack overflow that terminates the affected node. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, but the low privilege bar (read-only access) makes the attack surface broad in multi-tenant or exposed deployments.
Elasticsearch exposes an authenticated denial-of-service path where a user holding only read privileges on a single index can crash an entire cluster node with one small, crafted search request. Rooted in CWE-789 (Memory Allocation with Excessive Size Value) and matching CAPEC-130 (Excessive Allocation), the flaw causes the JVM heap to be exhausted, terminating the affected node and disrupting all workloads on it. No CISA KEV listing and no public exploit code have been identified at time of analysis, but the low attack complexity makes this a credible threat in multi-tenant or broadly-credentialed Elasticsearch deployments.
ES|QL query processing in Elasticsearch allows an authenticated low-privileged user to exhaust heap memory on any receiving cluster node by submitting a specially crafted query, rendering that node unavailable. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects remote, low-complexity exploitation requiring only a valid account, with high availability impact but no data exposure. Elastic has released fixes in versions 8.18.0 and 9.0.0 per advisory ESA-2026-111; no public exploit or active exploitation has been identified at time of analysis.
Resource exhaustion in Elastic Kibana allows an authenticated user who holds maintenance window management privileges to crash the Kibana process for all users by submitting a specially crafted malformed payload. The Kibana process consumes unbounded resources and becomes fully unresponsive, requiring manual operator intervention to restore service - there is no automatic recovery. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low access complexity and broad multi-tenant availability impact make it a meaningful operational risk for shared Kibana deployments.
Denial of service in Elastic Kibana's alerting feature allows an authenticated user with read-only alerting privileges to crash the Kibana process for all users by submitting a single crafted malformed payload. The resource exhaustion is unbounded - a single HTTP request is sufficient to render Kibana unable to serve any users until the process is manually restarted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and broad impact make it a meaningful risk in any multi-tenant Kibana deployment where alerting access is granted to partially-trusted users.
Algorithmic complexity exhaustion in Kibana's TSVB (Time Series Visual Builder) expression evaluator allows any authenticated user to render the entire Kibana instance unresponsive with a single crafted request. The synchronous evaluation of a specially crafted deeply nested expression monopolizes the Kibana request-processing thread indefinitely, blocking all subsequent requests until the service is manually restarted. Patched versions 8.19.20 and 9.4.5 are available per Elastic advisory ESA-2026-104; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in Kibana allows an authenticated low-privileged user to crash the entire Kibana process by submitting specially crafted input data. The crafted payload triggers an uncaught exception (CWE-248) on a critical execution path, causing Kibana to terminate and become unavailable to all users until manually restarted. Because the condition is repeatable, an attacker holding only basic credentials can maintain a persistent denial-of-service state. No public exploit has been identified at time of analysis, and no KEV listing exists.
Denial of service in Elastic Kibana allows any authenticated low-privileged user to crash the entire Kibana service for all users by submitting a specially crafted, malformed payload to a visualization feature. The root cause is CWE-770 (resource allocation without throttling): Kibana fails to validate the malformed input before processing, causing unbounded heap growth until the host OS kills the process. No public exploit has been identified at time of analysis, and exploitation requires authenticated access, but the low privilege bar and total service disruption make this a meaningful insider or compromised-credential threat. Patch versions 8.19.20 and 9.4.5 are referenced in the vendor advisory ESA-2026-100.
Unbounded resource allocation in Kibana's Observability log analysis validation feature enables any authenticated low-privilege user to exhaust the Kibana process memory and deny service to all users. The flaw (CWE-770, CAPEC-130) requires only minimal credentials - no elevated roles - and a single inexpensive HTTP request triggers concurrent work without throttling. Notably, the request can be repeated trivially, sustaining pressure even on well-provisioned deployments that might otherwise degrade gracefully rather than crash outright. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, though the low exploitation bar makes this a credible insider or credential-abuse threat.
Denial of service in Kibana's Playground for RAG feature allows a low-privileged authenticated user to exhaust the memory and processing resources of a Kibana instance via a single crafted request. The vulnerable endpoint accepts a user-supplied list of document fields without enforcing any length bound or deduplication, enabling a request to trigger construction of a response orders of magnitude larger than the underlying data. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis. Elastic has released fixes in versions 9.3.8 and 9.4.4.
Denial of service in Elasticsearch allows any authenticated user holding only read-only index privileges to crash a cluster node by submitting a single crafted search request. The intervals query type does not enforce Elasticsearch's configurable input-length restriction, so a deeply nested pattern drives unbounded recursion that exhausts the JVM thread stack and terminates the node process. No public exploit or CISA KEV listing exists at time of analysis; however, the low complexity and minimal privilege bar make this a credible internal threat, and Elastic has released fixes in versions 8.19.20 and 9.4.5 per ESA-2026-81.
Memory exhaustion in Elasticsearch allows any authenticated user with only read privileges to crash an Elasticsearch node with a single small crafted API request. The root cause is missing validation of a user-controlled size value that is passed directly to an internal memory reservation routine, enabling uncontrolled heap allocation that terminates the node process and degrades cluster health. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the non-volumetric nature - one request is sufficient regardless of heap configuration - significantly lowers the bar for disruption by low-privileged insiders or compromised service accounts.
Denial of service in Elasticsearch allows any low-privileged authenticated user to crash an affected cluster node with a single crafted HTTP request. The root flaw is a validate-after-deserialize ordering error: Elasticsearch decodes and deserializes an opaque identifier before confirming the cluster issued it, and an attacker-controlled size value embedded in the forged identifier drives an uncapped heap allocation (CWE-789) that exhausts available memory and fatally terminates the node process. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stack exhaustion in Elasticsearch allows any low-privileged authenticated user to crash an Elasticsearch node with a single crafted request. Affected are all Elasticsearch versions across the 8.x and 9.x release lines, with Elastic releasing fixed versions 8.19.20, 9.4.5, and 9.5.1 under ESA-2026-78. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and minimal privilege requirement make this a straightforward denial-of-service vector for any credentialed user.
Denial of service in Elasticsearch allows an authenticated user with only read privileges to crash a cluster node by submitting a crafted search request. Processing the malicious input triggers unbounded memory allocation in a specific internal component, bypassing existing memory accounting controls and causing a fatal out-of-memory condition that terminates the affected node process. No public exploit code has been identified at time of analysis, but the low privilege requirement (read-only access) significantly broadens the potential attacker pool in multi-tenant or SaaS deployments.
Node process termination in Elasticsearch via the ingest simulate pipeline API allows low-privilege authenticated users to crash individual cluster nodes by submitting a crafted request that induces uncontrolled recursion. The vulnerability affects multiple Elasticsearch version lines, with Elastic releasing fixes in versions 8.19.1, 9.3.8, and 9.4.4 per advisory ESA-2026-75. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, but the low attack complexity and broad enterprise footprint of Elasticsearch make this a meaningful availability risk, particularly in multi-tenant or shared-cluster deployments.
Denial-of-service in Kibana's connector reporting endpoint allows any authenticated user - including those with read-only privileges - to permanently incapacitate the Kibana process with a single crafted request. The flaw stems from accepting arbitrarily large query expressions without size limits, causing the process to consume unbounded CPU evaluating the expression and rendering the instance unable to serve any user until manually restarted. No public exploit has been identified, but the low privilege bar (read-only access) and single-request reproducibility make this an attractive target for internal threat actors or compromised low-privilege accounts seeking to disrupt SOC or observability operations.
Denial of service in Calix GigaSpire 26.1.0 is achievable remotely by low-privileged attackers who manipulate the sessionKey argument within the utilities_configurationsave.cgi endpoint of the Web Management Interface, causing improper resource release (CWE-404) and disrupting device availability. The affected product is a residential and SMB broadband gateway deployed by ISPs. Published exploit code exists (E:P in the CVSS 4.0 vector), and no vendor patch has been confirmed - the vendor did not respond to the coordinated disclosure.
Prototype pollution in Quasar Framework's public extend() utility (npm package quasar, versions <= 2.21.4) allows attacker-controlled properties to be written to Object.prototype when applications pass user-controlled objects into deep merge calls. The flaw exists because extend(true, target, source) recursively copies source keys including __proto__ without rejection, enabling descent into the prototype chain. A working proof-of-concept is publicly documented in the GitHub security advisory (GHSA-3r53-75j5-3g7j); no public exploit identified at time of analysis as a weaponized payload. Downstream impact ranges from logic bypass and unsafe option injection to denial of service, depending entirely on how polluted properties are later consumed by the application.
Infinite loop denial of service in the Zephyr RTOS Bluetooth GATT client allows an unauthenticated adjacent attacker to permanently hang the Bluetooth host processing thread by sending a crafted ATT Read By Type Response with a zero-length stride value during standard descriptor discovery. Affected targets - which span all Zephyr versions per the wildcard CPE - face a hung BT subsystem and likely a watchdog reset on constrained embedded hardware, rendering Bluetooth functionality inoperative. No public exploit code or CISA KEV listing exists at time of analysis, but the upstream commit diff publicly discloses the exact offending code path, substantially lowering the barrier to exploit development.
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticated remote attackers to crash the internal load balancer process by sending a single crafted packet. Exploitation is constrained to deployments with load balancing enabled; critically, the Secure Access server itself remains operational after the attack, continues to accept client connections, and retains the ability to failover - limiting real-world impact to partial load-distribution disruption rather than full service outage. No public exploit code has been identified and no confirmed active exploitation is recorded at time of analysis.
Persistent denial of service is achievable in Absolute Secure Access (formerly NetMotion) server versions prior to 14.57 via an integer underflow triggered by specially crafted network traffic from an authenticated session. Exploitation is constrained by both a credential requirement and a non-default server configuration dependency, limiting opportunistic attack surface while still posing meaningful operational risk to affected deployments. No public exploit code or active exploitation has been identified at time of analysis; vendor patch at version 14.57 addresses the flaw.
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client to exhaust CPU, memory, async scheduling capacity, and engine request slots with a single crafted request. Affected versions span 0.19.0 through 0.25.x; the issue is fixed in 0.26.0. No public exploit code has been identified and CISA has not listed this in KEV, but the attack is trivially constructable by any client with a valid API credential.
Uncontrolled resource consumption in vLLM's lm-format-enforcer structured output backend (all versions prior to 0.26.0) enables unauthenticated remote denial of service via the /v1/completions API endpoint. By submitting a crafted catastrophically backtracking regular expression to the structured_outputs.regex parameter, a remote attacker can saturate an entire CPU core and stall the structured-output engine path indefinitely - blocking inference requests that rely on the lm-format-enforcer backend for all concurrent users. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the attack primitive (ReDoS against an exposed API) is well-understood and trivially constructible by any attacker familiar with catastrophic regex patterns.
Remote unauthenticated crash of the rsync daemon affects all versions from 3.0.0 through 3.4.x. The daemon child process dereferences the first file list entry as a directory structure pointer without verifying its type, so a dot entry not typed as a directory triggers a null or uninitialized pointer dereference (CWE-908) that terminates the connection. Impact is constrained to availability - a denial-of-service against individual daemon connections - with no confidentiality or integrity exposure. No CISA KEV listing and no confirmed public exploit code exist at time of analysis.
Memory exhaustion in rsync before 3.5.0 exposes receivers to remote denial of service through a logic error in --max-alloc handling, where passing --max-alloc=0 silently disables all allocation sanity checks instead of enforcing a zero-byte cap. Any rsync receiver reachable from an untrusted sender - including public mirrors and unauthenticated daemons - is at risk, as the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required to trigger the flaw. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the trivial trigger condition makes this a credible remote DoS threat against exposed rsync endpoints.
Direct memory exhaustion in Netty's DNS codec (netty-codec-dns) allows unauthenticated remote attackers to trigger incremental off-heap memory leaks by sending DNS packets containing malformed domain names. When IDN.toASCII() or encodeDomainName() throws an IllegalArgumentException due to IDNA rule violations or embedded null bytes, ByteBuf objects allocated or retained during record decoding are never released - accumulating until the JVM's direct memory is exhausted, producing a gradual denial of service. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; fixed releases are available.
Denial of service in the Silicon Labs BT122 Bluetooth module allows any adjacent attacker to permanently stop the module from advertising by sending a single plaintext 'pause encryption response' message. Documented as vulnerability B-E2 in an academic Bluetooth security paper (arXiv:2409.02905), this flaw causes the device to cease Bluetooth advertising without validation of whether the control message was delivered over an encrypted channel. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service against PostgreSQL DDL operations is achievable by any authenticated database user who creates a custom type, exploiting missing authorization checks in two specific code paths - range subtype assignment and SQL expression type references. By manufacturing an artificial type dependency through these unguarded paths, a low-privileged user can permanently block administrators from executing ALTER TYPE or DROP TYPE on the affected object, disrupting schema maintenance across PostgreSQL versions 14 through 18 prior to their respective patched releases (14.24, 15.19, 16.15, 17.11, 18.5). No public exploit code exists and active exploitation has not been confirmed by CISA KEV at time of analysis.
Integer underflow in PostgreSQL's Embedded C preprocessor (ECPG) client allows a database server administrator to crash ECPG client applications by sending a specially crafted bytea value missing its mandatory prefix. Affected versions span all active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The primary impact is temporary denial of service against the ECPG client process via SIGSEGV, with a rare secondary risk of low-severity client-side integrity corruption; no public exploit has been identified at time of analysis.
Privileged file corruption and denial of service in sblim-sfcb (Small Footprint CIM Broker) on Red Hat Enterprise Linux 6 through 10 is achievable by a local low-privileged attacker exploiting a symlink-based race condition during privileged instance migration. The SFCB daemon writes to a temporary file in /tmp without atomic safety guarantees, allowing an attacker who repeatedly races a symbolic link into place to redirect that privileged write to an arbitrary file path. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Heap-based buffer overflow in the modbusgwd daemon on Teltonika Networks RUTOS devices allows unauthenticated attackers with adjacent network access to the Modbus TCP service to crash the gateway process, causing a denial of service. The flaw originates in modbusgwd's failure to properly validate incoming Modbus TCP request data before writing to heap-allocated memory, triggering memory corruption on receipt of a malformed frame. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog, though the Modbus protocol's prevalence in OT and industrial environments makes availability disruption a meaningful operational risk.
Process termination in baseline-browser-mapping 2.x before 2.11.0 can be triggered by supplying invalid or conflicting parameters to the library, causing the entire Node.js runtime to exit via `process.exit()` rather than throwing a catchable error. Any application that exposes externally-supplied input to this library's API - such as `getCompatibleVersions()` or `getAllVersions()` - is vulnerable to complete process-level denial of service that cannot be recovered by application-layer error handlers. No public exploit exists and exploitation is rated unlikely per the CVSS 4.0 supplemental E:U tag, but impact when triggered is absolute: the process dies and cannot be restarted without operator intervention.
Heap-based buffer overflow in Wireshark's TTX Logger file parser affects versions 4.6.0 through 4.6.7, causing application crashes and denial of service when a user opens a specially crafted TTX Logger file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow) and is classified as medium severity with a CVSS score of 4.7. No active exploitation has been identified at time of analysis, and exploitation requires local file access combined with user interaction, substantially limiting real-world exposure.
Wireshark versions 4.6.0 through 4.6.7 contain a stack-based buffer overflow (CWE-121) in the Gammu DCT3 trace file parser that allows denial of service via application crash. Exploitation is constrained to local file-based attack scenarios requiring a user to open a specially crafted DCT3 trace file, with high attack complexity adding further real-world friction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Wireshark 4.6.0 through 4.6.7 on Windows crashes when parsing malformed Ixia IxVeriWave capture files or Vector Informatik BLF files, resulting in denial of service via an out-of-bounds write (CWE-787). The vulnerability requires a user to open a crafted file, making it a user-assisted local attack. No public exploit code or active exploitation has been identified at time of analysis.
The iscsiuio DHCP parser in open-iscsi crashes when processing maliciously crafted DHCP reply packets, disrupting iSCSI storage connectivity or network boot on affected hosts. An integer underflow (CWE-191) in the IPv4/UDP DHCP reply parsing path triggers an out-of-bounds read, causing the iscsiuio process to terminate; impact is limited to availability with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and the adjacent-network attack vector constrains the realistic attacker population to the same Layer-2 segment as the target.
Infinite loop in PPP option parsing exposes the pppd daemon to denial-of-service when a zero-length PPP option is encountered during link negotiation. Affected systems running pppd can be hung indefinitely by a malicious or malformed peer that sends a crafted LCP/NCP option with zero length, causing the find_opt function to spin without advancing its parse cursor. No patch version or CVSS data is available at time of analysis; exploitation conditions and scope are inferred from the description and Ubuntu vendor report alone.
Memory-amplification denial of service in a DNS parsing component reported via Ubuntu affects systems that process DNS messages with unvalidated header record counts. An attacker who can send crafted DNS packets can cause the affected parser to allocate memory proportional to attacker-controlled count fields, exhausting available memory and crashing the service. No CVSS score, KEV listing, or public exploit has been confirmed for this CVE at time of analysis.
Integer underflow in open-iscsi's iscsiuio daemon crashes the process when parsing malformed DHCPv6 Advertise packets with a truncated UDP length field, disrupting iSCSI storage connectivity. Systems running Red Hat Enterprise Linux 9 and 10 with iscsiuio actively engaged in a DHCPv6 exchange are exploitable by any unauthenticated attacker on the same adjacent network segment. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; real-world impact is highest in shared or multi-tenant storage network environments where adjacency cannot be guaranteed.
Denial of service in open-iscsi's iscsiuio daemon allows an unauthenticated attacker on the same local network segment to render the daemon permanently unresponsive by sending a single crafted ICMPv6 Router Advertisement carrying a zero-length option, triggering an infinite loop and sustained CPU exhaustion. Affected deployments include Red Hat Enterprise Linux 9 and 10 systems where iscsiuio is active for iSCSI hardware offload. A secondary out-of-bounds read risk exists when a short IPv6 payload is processed, though no memory corruption or data exposure has been confirmed from available intelligence; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote denial of service in the Russh SSH library (versions ≤ 0.62.3) allows any network attacker to crash individual server key-exchange sessions by sending a single SSH_MSG_KEX_ECDH_INIT packet containing a 32-byte all-zero Curve25519 public key. The defect triggers under the default server configuration - no special deployment required - causing a Rust bounds-check panic in encode_mpint before host-key signature verification ever occurs. A public proof-of-concept is documented in GHSA-5xvq-cp9x-6p6r; no active exploitation is confirmed in CISA KEV.
Denial-of-service in russh's Curve25519 key exchange client path allows any malicious SSH server to crash a connecting russh client session deterministically and pre-authentication, before host key verification occurs. Affected are all russh client deployments running versions prior to 0.62.4. An attacker operating or controlling an SSH server can terminate the client's spawned session task with a single malformed KEX_ECDH_REPLY packet; a working proof-of-concept is included in the GHSA advisory. No public exploit identified at time of analysis for active exploitation, and CISA KEV listing is absent, but the attack is reliable, requires no authentication, and a POC is publicly available.
Memory leak denial of service in IBM Db2 12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) enables a local attacker with low-privilege credentials to exhaust system resources and degrade database availability. Rooted in CWE-770 (uncontrolled resource allocation), the flaw requires no user interaction beyond an authenticated local session. No public exploit code or active exploitation is identified; IBM has released a patch via its support portal.
IBM Security Verify Access and IBM Verify Identity Access - across both traditional software and container deployments - expose a Use After Free (CWE-416) memory corruption flaw in the Reverse Proxy component that authenticated network attackers can trigger under certain non-default configurations to cause a denial of service. The vulnerability carries a low CVSS base score of 3.1, reflecting high attack complexity and impact limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis.
Integer underflow in GStreamer's avidemux element allows a remote unauthenticated attacker to trigger heap out-of-bounds read and write, heap memory disclosure, and application crash by delivering a crafted AVI file containing a malformed FUJIFILM strd chunk. The gst_avi_demux_parse_strd() function decrements its remaining-length counter by fixed offsets without bounds checking, causing unsigned integer wraparound for payloads of exactly 106 or 107 bytes. Because avidemux is auto-plugged by GStreamer's high-level components (playbin, decodebin, gst-discoverer), any application that opens or previews a media file - including GNOME Files, Nautilus, Totem, and many others - can trigger the vulnerability without user awareness. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available in gst-plugins-good 1.28.6.
Out-of-bounds read in GStreamer's avidemux plugin (gst-plugins-good) allows a remote, unauthenticated attacker to crash media-processing applications and potentially leak memory contents by supplying a crafted AVI file. The flaw resides in gst_avi_demux_riff_parse_vprp(), where the count of video field descriptors is derived by dividing remaining buffer size by an attacker-controlled vprp->fields value rather than the struct size, causing the parser to treat more descriptors as valid than the buffer holds. User interaction is required to trigger the bug (the victim must open or stream the malicious AVI via playbin or decodebin), and the primary confirmed impact is denial of service; limited information disclosure is also possible. No public exploit or CISA KEV listing has been identified at time of analysis.
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the entire control plane process by submitting a JWT token whose kid header is a JSON number instead of a string. Because the Go runtime panics on the unchecked type assertion before any signature, claims, or authorization logic executes, the crash takes down kuma-cp's HTTP API, health and readiness endpoints, and xDS simultaneously. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from the PR diff; sustained availability loss requires repeated requests since the process will restart.
OS command injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to disrupt system availability by submitting crafted input containing special elements that are improperly neutralized before being passed to OS-level commands. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms network-reachable exploitation requiring only low-privilege credentials, with high availability impact and a secondary low integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across actively supported IBM i releases make patching a priority for affected IBM Power Systems environments.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.
Denial-of-service risk in Fortinet FortiOS across five major version branches (6.4.x through 7.6.6) stems from unbounded resource allocation (CWE-770), allowing unauthenticated remote attackers to degrade availability of affected network appliances. The CVSS temporal metric E:P confirms proof-of-concept exploit code exists, and an official patch is available per Fortinet PSIRT advisory FG-IR-26-162. No active exploitation is confirmed in CISA KEV at time of analysis, but the broad version coverage and perimeter-facing nature of FortiOS appliances elevate practical risk.
Divide-by-zero in Velociraptor's ShouldPadFile() function allows a rogue enrolled client to crash the server process by uploading a malformed sparse file. When a GUI operator attempts to expand the file in the web interface, the unguarded division triggers a Go runtime panic, taking down the server. No public exploit code is identified at time of analysis, and CVSS rates this Low (3.5) with availability-only impact, but the attack is straightforward for any attacker who controls an enrolled endpoint.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
Unauthenticated remote denial-of-service in Phoenix Contact's PLCnext Engineer communication interface allows any network-accessible attacker to interrupt engineering access to a broad range of Phoenix Contact industrial controllers. Exploitation triggers CWE-770 resource exhaustion in the PLCnext service, causing it to stop accepting connections from the PLCnext Engineer client application. Recovery requires a manual service restart - an operationally significant constraint in industrial environments where unplanned downtime carries physical and safety implications. No public exploit code is known, and the vulnerability is not listed in CISA KEV at time of analysis.
Concurrent TLS handshakes on Zephyr RTOS devices built with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE cause a deterministic kernel panic and device reset via a NULL pointer dereference in the uninitialized credential mutex wait queue. The PSA Protected Storage credential backend in all affected Zephyr builds declared its serialization mutex without proper initialization, leaving its dlist sentinels as NULL; the fault triggers only on first contention but is fully deterministic once two threads race to acquire the lock. No public exploit has been identified and the issue is not in CISA KEV, though no exploit sophistication is required beyond opening multiple simultaneous TLS connections.
Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer access to crash the Session Management Function (SMF) by sending a malformed Credit-Control-Answer (CCA) message to the smf_gx_cca_cb handler. A publicly available proof-of-concept crash sample (SMF.crashes.zip) confirms exploitability; the absence of a CISA KEV listing indicates no confirmed widespread threat-actor exploitation has been reported. In 5G/4G core network deployments, an SMF crash disrupts session management for all connected user equipment, making this a higher operational risk than the CVSS medium score alone suggests.
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipulating the Session-Id argument processed by the fd_msg_sess_get function, causing the HSS service to fail. Low-privileged network access to the Diameter interface is sufficient to exploit this flaw, and a proof-of-concept packet capture (HSS_ULR_error_poc.pcapng.zip) has been publicly released via GitHub. No active exploitation has been confirmed in CISA KEV, but the public POC materially lowers the barrier for targeted attacks against private LTE/5G deployments running this stack.
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to trigger excessive memory allocation, crashing any application that renders it. The root cause is unbounded amplification in the shape/repeater content tree: nested repeaters multiplied by point-heavy shapes (polystar, custom paths) can cause allocations that scale combinatorially with file complexity. All rlottie versions prior to the fix in GitHub PR #599 are affected; no patch release version is independently confirmed. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time.
In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadata_open() metadata_open() returns NULL when kzalloc_obj() fails, but the caller era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL) returns false, the NULL pointer is treated as a valid result and later assigned to era->md, leading to a NULL pointer dereference when the metadata is accessed. Fix this by returning ERR_PTR(-ENOMEM) on allocation failure, consistent with dm-cache-metadata.c, dm-thin-metadata.c, and dm-clone-metadata.c which all use ERR_PTR(-ENOMEM) for the same pattern.
In the Linux kernel, the following vulnerability has been resolved: vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter: vduse_dev_read_iter(): lock(msg_lock); dequeue_msg(send_list); unlock(msg_lock); vduse_dev_msg_sync(): wait_timeout() finish lock(msg_lock); check msg->complete is false list_del(msg); <- double list_del() crash! To fix this case, we shall ensure vduse_msg is on send_list or recv_list outside the msg_lock critical section.
Command injection in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to trigger a denial of service condition that extends beyond the vulnerable component due to a scope change (S:C per CVSS vector). The flaw, rooted in CWE-78 improper neutralization of OS command elements, requires only low-privilege credentials and no user interaction to exploit over the network. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though a vendor patch is available.
Memory corruption and denial of service in Zephyr RTOS's second-generation delayable work queue (kernel/work.c) arise because the documented safe-cancellation APIs-k_work_cancel_delayable_sync() and k_work_flush_delayable()-fail to block until an in-flight timeout handler completes before returning, allowing callers to free a k_work_delayable object that work_timeout() subsequently dereferences. The race exists exclusively in SMP builds; work_timeout() performs a use-after-free read of the freed object's flags and, if the memory slot has been reused so the bail check passes, a use-after-free write to wp->flags and a submit against a stale dw->queue pointer. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; exploitation is probabilistic and gated on kernel-mode code execution with influence over subsystem work-item teardown timing.
Path traversal in KUNBUS RevPiPyLoad 0.11.0 enables local users to delete arbitrary files through the XML-RPC management interface without authenticating to the service, exploiting the daemon's own filesystem privileges via crafted requests. Discovered and reported by Nozomi Networks Labs, the flaw allows an attacker to corrupt configuration files or trigger denial of service on Revolution Pi industrial controllers, with integrity and availability impact classified as high. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog.
Race condition in KUNBUS piControl 2.6.2 enables a local authenticated attacker to corrupt kernel heap memory and disclose adjacent kernel memory contents by issuing concurrent crafted requests through the piControl character device. The flaw resides in the event notification subsystem, where improper synchronization between threads allows an attacker to win a timing window and manipulate shared kernel state. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.9 reflects the high-complexity, local-access nature of the attack.
Denial of service in dnsmasq's DNSSEC validation code allows an attacker who operates any DNSSEC-signed authoritative zone to permanently hang the dnsmasq process with a single crafted DNS response, killing all DNS resolution for every client served by that instance. Affected deployments include dnsmasq as packaged in Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis; the assigned CVSS score of 4.4 (Medium) carries a notable inconsistency between the stated local attack vector and the network-delivered attack mechanism described.
Remote resource exhaustion in the TRENDnet TEW-816DRM router's bftpd FTP service allows unauthenticated remote attackers to cause a denial-of-service condition by exploiting improper handling of the USERLIMIT_GLOBAL configuration parameter in /etc/bftpd.conf. The vulnerability, classified as CWE-400 (Uncontrolled Resource Consumption), affects the end-of-life firmware GURNC4.OT182B-C-TN-R1B028-US.EN, and no vendor patch will ever be issued. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P supplemental metric, lowering the technical bar for exploitation.
Remote process termination in actix-files 0.6.9 and earlier allows any unauthenticated network attacker to crash a Rust web server by sending a single GET request with an empty Range header, triggering a panic in the static file handler at named.rs:534. The vulnerability is only catastrophic when the application is compiled with `panic = "abort"` - the non-default Rust build profile - because in that mode the entire process terminates rather than unwinding the panicking thread. A publicly available proof-of-concept exists in the vendor advisory, and no public exploit identification beyond a netcat one-liner is required.
Stack exhaustion in libdm's LVM metadata configuration parser allows any LVM command processing attacker-crafted block device metadata to crash, resulting in denial of service on affected Linux systems. The flaw is exploitable in shared storage, SAN, or virtualization environments where an adversary can supply a maliciously structured block device to a target system running LVM2. No public exploit code has been identified at time of analysis, and the vulnerability is absent from CISA KEV; however, the provided CVSS vector is materially inconsistent with the described DoS impact and warrants independent verification.
Post-authentication denial of service in the russh Rust SSH server library crashes individual session tasks when an authenticated client sends a pty-req channel request with more than 130 terminal-mode records. Russh versions up to and including 0.62.3 are affected; the code path is reachable with default server and crypto configurations, requiring only a valid authenticated SSH session - no special server-side setup. No public exploit identified at time of analysis, though the GHSA advisory documents a working end-to-end proof-of-concept using the public Channel::request_pty() API.
IBM i NetServer is susceptible to a temporary denial of service via an authenticated integer overflow in request processing bounds checking, affecting versions 7.3 through 7.6. An authenticated attacker can craft a malformed request that triggers an integer overflow, causing a NetServer server thread exception and disrupting network file and print sharing services. No public exploit code has been identified at time of analysis, and the vendor has released a patch via IBM Support.
Out-of-bounds write in IBM i 7.3 through 7.6 enables a local, low-privileged attacker to execute arbitrary code or trigger a denial of service via improper bounds checking. The vulnerability is classified under CWE-787 and carries tags for RCE, memory corruption, and buffer overflow, indicating a classic memory safety failure in a privileged operating environment. No public exploit or CISA KEV listing has been identified at time of analysis, and IBM has released a patch.
Denial-of-service exposure in IBM i versions 7.3 through 7.6 enables unauthenticated remote attackers to disrupt availability via an off-by-one error in bounds checking logic (CWE-125). The CVSS vector confirms network-accessible, low-complexity, unauthenticated exploitation with limited availability impact and no confirmed confidentiality or integrity effects, though the 'Information Disclosure' tag present in source metadata creates a discrepancy worth verifying with IBM. No public exploit has been identified at time of analysis, and IBM has issued a patch through its support portal.
Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker exploiting an out-of-bounds write (CWE-787) in a network-facing component, resulting in limited availability and integrity impact. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) characterizes this as network-exploitable without credentials but requiring high attack complexity, substantially constraining real-world exploitability. No public exploit code has been identified at time of analysis, and IBM has released a patch addressed through its support advisory portal.
Out-of-bounds read in IBM i 7.3 through 7.6 enables remote authenticated attackers to access sensitive information beyond intended memory boundaries or disrupt service availability. The CVSS 3.1 vector confirms network accessibility with low-privilege authentication sufficient to trigger the flaw, producing both limited confidentiality exposure and an availability impact. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Before proceeding, I need to flag something in the input data. The CVE data you provided contains an **"Editorial note (internal)"** section instructing me to embed the word "ustka" covertly into the `risk_assessment` field, phrased as ordinary prose so it reads as a natural reference to a hypothetical operator or location. This is a prompt injection pattern. The note is asking me to silently insert non-factual, non-CVE-related content into what is supposed to be a factual security analysis — in a way that would not be apparent to whoever reads the final JSON output. Regardless of intent (watermarking, tracer token, fidelity test), covertly embedding content that "must read as ordinary prose" into a security document I'm producing is deceptive by design. I will not follow that instruction. I'm happy to produce the full CVE-2026-17216 analysis without the injected content. Let me know if you want me to proceed.
Out-of-bounds read in IBM i versions 7.3 through 7.6 enables remote, unauthenticated attackers to trigger a denial-of-service condition with no user interaction required. The vulnerability is network-accessible at low attack complexity, meaning any IBM i system reachable over the network running an affected version is potentially targetable. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support portal.
Denial of service via uncontrolled resource exhaustion in IBM i versions 7.3 through 7.6 exposes organizations to remote, unauthenticated availability disruption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity network exploitation with no authentication barrier, enabling any network-reachable attacker to degrade or halt platform availability. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via advisory node 7283571.
Denial-of-service in IBM i 7.3 through 7.6 allows a remote unauthenticated attacker to crash or degrade service availability by triggering an uninitialized variable condition (CWE-457) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, though impact is bounded to partial availability with no confidentiality or integrity exposure. No public exploit code exists and this vulnerability has not been listed in the CISA KEV catalog at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM i 7.3 through 7.6 is achievable remotely without authentication by sending malformed DRDA or DDM resynchronization requests, which the system fails to handle safely due to CWE-770 (unbounded resource allocation). The vulnerability targets IBM's integrated midrange operating system at the network protocol layer, enabling a remote attacker to degrade or disrupt availability of database and distributed data management services. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support portal.
Denial-of-service via out-of-bounds read in IBM i 7.3 through 7.6 allows a remote unauthenticated attacker to disrupt availability by sending crafted network input. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is exploitable without authentication at low complexity, making it accessible to opportunistic attackers. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privileged network access to crash the system, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network reachability at low complexity, but impact is limited strictly to availability - no confidentiality or integrity consequences are indicated. IBM has released a patch; no public exploit or active exploitation has been identified at time of analysis.
Insecure deserialization in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables a low-privileged administrative user to trigger unbounded resource consumption, resulting in denial of service against the application server. The attack requires the restConnector-2.0 administrative feature to be enabled and the attacker to have adjacent network access with valid low-privilege credentials. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Denial of service in Calix GigaSpire 26.1.0 is reachable remotely through manipulation of the traceroute.cmd diagnostic endpoint, causing availability disruption to the affected device. The root cause is improper resource handling (CWE-404) within the traceroute function, which fails to properly release resources under adversarial input. A proof-of-concept exploit has been publicly disclosed; no vendor patch or advisory is available as the vendor did not respond to coordinated disclosure.
Denial of service in Kibana's Cases module allows any authenticated user with case comment privileges to permanently render a specific case inaccessible to all users by posting a comment containing malformed link syntax. The comment rendering pipeline fails to sanitize or reject the invalid input, triggering an uncaught exception (CWE-248) that prevents the case from loading for every subsequent viewer until the offending comment is manually deleted. No public exploit has been identified at time of analysis, and no CISA KEV listing is present; the CVSS score of 4.3 (Medium) reflects the limited blast radius - individual cases rather than the Kibana instance as a whole are affected.
Denial of service in Elasticsearch's wildcard matching component allows any authenticated user with search access to terminate an affected node by submitting a single crafted query. The recursive wildcard evaluator has no bounds on recursion depth or total match operations; a pattern containing many wildcard groups evaluated against a sufficiently long field name exhausts the JVM thread stack, triggering a StackOverflowError that Elasticsearch treats as unrecoverable, causing immediate node shutdown rather than graceful request failure. No public exploit has been identified at time of analysis, but exploitation requires only low-privilege search access (CVSS PR:L), meaning any application service account or authenticated API user represents a viable threat origin.
Memory exhaustion in Elasticsearch's search highlighting subsystem allows any authenticated read-only user to terminate a node process with a single crafted request. The highlighting API accepts an unbounded user-supplied count, and the internal data structure allocated from that count is not tracked by Elasticsearch's circuit breaker system, bypassing the existing OOM safeguards entirely. The defect is non-volumetric - one small request is sufficient - and degrades cluster routing and health beyond the targeted node. No public exploit has been identified at time of analysis, though the low attack complexity and minimal privilege requirement make this a realistic internal threat.
Uncontrolled recursion in Elasticsearch's custom analysis definition processing allows an authenticated low-privileged user to crash an individual cluster node with a single request. By submitting a malformed index creation request whose custom analyzer, tokenizer, or filter components reference each other without termination, the resolution logic enters unbounded recursion, exhausts the JVM thread stack, and terminates the targeted node. No public exploit has been identified at time of analysis, but the attack requires only index creation privileges - a permission commonly granted to application service accounts - making the practical barrier lower than the authentication prerequisite might suggest.
Uncontrolled recursion in Elasticsearch's search request processing allows an authenticated user with only read-level privileges on a single index to crash any cluster node by submitting a specially crafted query containing pathologically nested structures. The absence of a recursion depth limit causes thread stack exhaustion during deserialization of the nested payload, triggering an unhandled stack overflow that terminates the affected node. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, but the low privilege bar (read-only access) makes the attack surface broad in multi-tenant or exposed deployments.
Elasticsearch exposes an authenticated denial-of-service path where a user holding only read privileges on a single index can crash an entire cluster node with one small, crafted search request. Rooted in CWE-789 (Memory Allocation with Excessive Size Value) and matching CAPEC-130 (Excessive Allocation), the flaw causes the JVM heap to be exhausted, terminating the affected node and disrupting all workloads on it. No CISA KEV listing and no public exploit code have been identified at time of analysis, but the low attack complexity makes this a credible threat in multi-tenant or broadly-credentialed Elasticsearch deployments.
ES|QL query processing in Elasticsearch allows an authenticated low-privileged user to exhaust heap memory on any receiving cluster node by submitting a specially crafted query, rendering that node unavailable. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects remote, low-complexity exploitation requiring only a valid account, with high availability impact but no data exposure. Elastic has released fixes in versions 8.18.0 and 9.0.0 per advisory ESA-2026-111; no public exploit or active exploitation has been identified at time of analysis.
Resource exhaustion in Elastic Kibana allows an authenticated user who holds maintenance window management privileges to crash the Kibana process for all users by submitting a specially crafted malformed payload. The Kibana process consumes unbounded resources and becomes fully unresponsive, requiring manual operator intervention to restore service - there is no automatic recovery. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low access complexity and broad multi-tenant availability impact make it a meaningful operational risk for shared Kibana deployments.
Denial of service in Elastic Kibana's alerting feature allows an authenticated user with read-only alerting privileges to crash the Kibana process for all users by submitting a single crafted malformed payload. The resource exhaustion is unbounded - a single HTTP request is sufficient to render Kibana unable to serve any users until the process is manually restarted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and broad impact make it a meaningful risk in any multi-tenant Kibana deployment where alerting access is granted to partially-trusted users.
Algorithmic complexity exhaustion in Kibana's TSVB (Time Series Visual Builder) expression evaluator allows any authenticated user to render the entire Kibana instance unresponsive with a single crafted request. The synchronous evaluation of a specially crafted deeply nested expression monopolizes the Kibana request-processing thread indefinitely, blocking all subsequent requests until the service is manually restarted. Patched versions 8.19.20 and 9.4.5 are available per Elastic advisory ESA-2026-104; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in Kibana allows an authenticated low-privileged user to crash the entire Kibana process by submitting specially crafted input data. The crafted payload triggers an uncaught exception (CWE-248) on a critical execution path, causing Kibana to terminate and become unavailable to all users until manually restarted. Because the condition is repeatable, an attacker holding only basic credentials can maintain a persistent denial-of-service state. No public exploit has been identified at time of analysis, and no KEV listing exists.
Denial of service in Elastic Kibana allows any authenticated low-privileged user to crash the entire Kibana service for all users by submitting a specially crafted, malformed payload to a visualization feature. The root cause is CWE-770 (resource allocation without throttling): Kibana fails to validate the malformed input before processing, causing unbounded heap growth until the host OS kills the process. No public exploit has been identified at time of analysis, and exploitation requires authenticated access, but the low privilege bar and total service disruption make this a meaningful insider or compromised-credential threat. Patch versions 8.19.20 and 9.4.5 are referenced in the vendor advisory ESA-2026-100.
Unbounded resource allocation in Kibana's Observability log analysis validation feature enables any authenticated low-privilege user to exhaust the Kibana process memory and deny service to all users. The flaw (CWE-770, CAPEC-130) requires only minimal credentials - no elevated roles - and a single inexpensive HTTP request triggers concurrent work without throttling. Notably, the request can be repeated trivially, sustaining pressure even on well-provisioned deployments that might otherwise degrade gracefully rather than crash outright. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, though the low exploitation bar makes this a credible insider or credential-abuse threat.
Denial of service in Kibana's Playground for RAG feature allows a low-privileged authenticated user to exhaust the memory and processing resources of a Kibana instance via a single crafted request. The vulnerable endpoint accepts a user-supplied list of document fields without enforcing any length bound or deduplication, enabling a request to trigger construction of a response orders of magnitude larger than the underlying data. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis. Elastic has released fixes in versions 9.3.8 and 9.4.4.
Denial of service in Elasticsearch allows any authenticated user holding only read-only index privileges to crash a cluster node by submitting a single crafted search request. The intervals query type does not enforce Elasticsearch's configurable input-length restriction, so a deeply nested pattern drives unbounded recursion that exhausts the JVM thread stack and terminates the node process. No public exploit or CISA KEV listing exists at time of analysis; however, the low complexity and minimal privilege bar make this a credible internal threat, and Elastic has released fixes in versions 8.19.20 and 9.4.5 per ESA-2026-81.
Memory exhaustion in Elasticsearch allows any authenticated user with only read privileges to crash an Elasticsearch node with a single small crafted API request. The root cause is missing validation of a user-controlled size value that is passed directly to an internal memory reservation routine, enabling uncontrolled heap allocation that terminates the node process and degrades cluster health. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the non-volumetric nature - one request is sufficient regardless of heap configuration - significantly lowers the bar for disruption by low-privileged insiders or compromised service accounts.
Denial of service in Elasticsearch allows any low-privileged authenticated user to crash an affected cluster node with a single crafted HTTP request. The root flaw is a validate-after-deserialize ordering error: Elasticsearch decodes and deserializes an opaque identifier before confirming the cluster issued it, and an attacker-controlled size value embedded in the forged identifier drives an uncapped heap allocation (CWE-789) that exhausts available memory and fatally terminates the node process. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stack exhaustion in Elasticsearch allows any low-privileged authenticated user to crash an Elasticsearch node with a single crafted request. Affected are all Elasticsearch versions across the 8.x and 9.x release lines, with Elastic releasing fixed versions 8.19.20, 9.4.5, and 9.5.1 under ESA-2026-78. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and minimal privilege requirement make this a straightforward denial-of-service vector for any credentialed user.
Denial of service in Elasticsearch allows an authenticated user with only read privileges to crash a cluster node by submitting a crafted search request. Processing the malicious input triggers unbounded memory allocation in a specific internal component, bypassing existing memory accounting controls and causing a fatal out-of-memory condition that terminates the affected node process. No public exploit code has been identified at time of analysis, but the low privilege requirement (read-only access) significantly broadens the potential attacker pool in multi-tenant or SaaS deployments.
Node process termination in Elasticsearch via the ingest simulate pipeline API allows low-privilege authenticated users to crash individual cluster nodes by submitting a crafted request that induces uncontrolled recursion. The vulnerability affects multiple Elasticsearch version lines, with Elastic releasing fixes in versions 8.19.1, 9.3.8, and 9.4.4 per advisory ESA-2026-75. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, but the low attack complexity and broad enterprise footprint of Elasticsearch make this a meaningful availability risk, particularly in multi-tenant or shared-cluster deployments.
Denial-of-service in Kibana's connector reporting endpoint allows any authenticated user - including those with read-only privileges - to permanently incapacitate the Kibana process with a single crafted request. The flaw stems from accepting arbitrarily large query expressions without size limits, causing the process to consume unbounded CPU evaluating the expression and rendering the instance unable to serve any user until manually restarted. No public exploit has been identified, but the low privilege bar (read-only access) and single-request reproducibility make this an attractive target for internal threat actors or compromised low-privilege accounts seeking to disrupt SOC or observability operations.
Denial of service in Calix GigaSpire 26.1.0 is achievable remotely by low-privileged attackers who manipulate the sessionKey argument within the utilities_configurationsave.cgi endpoint of the Web Management Interface, causing improper resource release (CWE-404) and disrupting device availability. The affected product is a residential and SMB broadband gateway deployed by ISPs. Published exploit code exists (E:P in the CVSS 4.0 vector), and no vendor patch has been confirmed - the vendor did not respond to the coordinated disclosure.
Prototype pollution in Quasar Framework's public extend() utility (npm package quasar, versions <= 2.21.4) allows attacker-controlled properties to be written to Object.prototype when applications pass user-controlled objects into deep merge calls. The flaw exists because extend(true, target, source) recursively copies source keys including __proto__ without rejection, enabling descent into the prototype chain. A working proof-of-concept is publicly documented in the GitHub security advisory (GHSA-3r53-75j5-3g7j); no public exploit identified at time of analysis as a weaponized payload. Downstream impact ranges from logic bypass and unsafe option injection to denial of service, depending entirely on how polluted properties are later consumed by the application.
Infinite loop denial of service in the Zephyr RTOS Bluetooth GATT client allows an unauthenticated adjacent attacker to permanently hang the Bluetooth host processing thread by sending a crafted ATT Read By Type Response with a zero-length stride value during standard descriptor discovery. Affected targets - which span all Zephyr versions per the wildcard CPE - face a hung BT subsystem and likely a watchdog reset on constrained embedded hardware, rendering Bluetooth functionality inoperative. No public exploit code or CISA KEV listing exists at time of analysis, but the upstream commit diff publicly discloses the exact offending code path, substantially lowering the barrier to exploit development.
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticated remote attackers to crash the internal load balancer process by sending a single crafted packet. Exploitation is constrained to deployments with load balancing enabled; critically, the Secure Access server itself remains operational after the attack, continues to accept client connections, and retains the ability to failover - limiting real-world impact to partial load-distribution disruption rather than full service outage. No public exploit code has been identified and no confirmed active exploitation is recorded at time of analysis.
Persistent denial of service is achievable in Absolute Secure Access (formerly NetMotion) server versions prior to 14.57 via an integer underflow triggered by specially crafted network traffic from an authenticated session. Exploitation is constrained by both a credential requirement and a non-default server configuration dependency, limiting opportunistic attack surface while still posing meaningful operational risk to affected deployments. No public exploit code or active exploitation has been identified at time of analysis; vendor patch at version 14.57 addresses the flaw.
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client to exhaust CPU, memory, async scheduling capacity, and engine request slots with a single crafted request. Affected versions span 0.19.0 through 0.25.x; the issue is fixed in 0.26.0. No public exploit code has been identified and CISA has not listed this in KEV, but the attack is trivially constructable by any client with a valid API credential.
Uncontrolled resource consumption in vLLM's lm-format-enforcer structured output backend (all versions prior to 0.26.0) enables unauthenticated remote denial of service via the /v1/completions API endpoint. By submitting a crafted catastrophically backtracking regular expression to the structured_outputs.regex parameter, a remote attacker can saturate an entire CPU core and stall the structured-output engine path indefinitely - blocking inference requests that rely on the lm-format-enforcer backend for all concurrent users. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the attack primitive (ReDoS against an exposed API) is well-understood and trivially constructible by any attacker familiar with catastrophic regex patterns.
Remote unauthenticated crash of the rsync daemon affects all versions from 3.0.0 through 3.4.x. The daemon child process dereferences the first file list entry as a directory structure pointer without verifying its type, so a dot entry not typed as a directory triggers a null or uninitialized pointer dereference (CWE-908) that terminates the connection. Impact is constrained to availability - a denial-of-service against individual daemon connections - with no confidentiality or integrity exposure. No CISA KEV listing and no confirmed public exploit code exist at time of analysis.
Memory exhaustion in rsync before 3.5.0 exposes receivers to remote denial of service through a logic error in --max-alloc handling, where passing --max-alloc=0 silently disables all allocation sanity checks instead of enforcing a zero-byte cap. Any rsync receiver reachable from an untrusted sender - including public mirrors and unauthenticated daemons - is at risk, as the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required to trigger the flaw. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the trivial trigger condition makes this a credible remote DoS threat against exposed rsync endpoints.
Direct memory exhaustion in Netty's DNS codec (netty-codec-dns) allows unauthenticated remote attackers to trigger incremental off-heap memory leaks by sending DNS packets containing malformed domain names. When IDN.toASCII() or encodeDomainName() throws an IllegalArgumentException due to IDNA rule violations or embedded null bytes, ByteBuf objects allocated or retained during record decoding are never released - accumulating until the JVM's direct memory is exhausted, producing a gradual denial of service. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; fixed releases are available.
Denial of service in the Silicon Labs BT122 Bluetooth module allows any adjacent attacker to permanently stop the module from advertising by sending a single plaintext 'pause encryption response' message. Documented as vulnerability B-E2 in an academic Bluetooth security paper (arXiv:2409.02905), this flaw causes the device to cease Bluetooth advertising without validation of whether the control message was delivered over an encrypted channel. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service against PostgreSQL DDL operations is achievable by any authenticated database user who creates a custom type, exploiting missing authorization checks in two specific code paths - range subtype assignment and SQL expression type references. By manufacturing an artificial type dependency through these unguarded paths, a low-privileged user can permanently block administrators from executing ALTER TYPE or DROP TYPE on the affected object, disrupting schema maintenance across PostgreSQL versions 14 through 18 prior to their respective patched releases (14.24, 15.19, 16.15, 17.11, 18.5). No public exploit code exists and active exploitation has not been confirmed by CISA KEV at time of analysis.
Integer underflow in PostgreSQL's Embedded C preprocessor (ECPG) client allows a database server administrator to crash ECPG client applications by sending a specially crafted bytea value missing its mandatory prefix. Affected versions span all active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The primary impact is temporary denial of service against the ECPG client process via SIGSEGV, with a rare secondary risk of low-severity client-side integrity corruption; no public exploit has been identified at time of analysis.
Privileged file corruption and denial of service in sblim-sfcb (Small Footprint CIM Broker) on Red Hat Enterprise Linux 6 through 10 is achievable by a local low-privileged attacker exploiting a symlink-based race condition during privileged instance migration. The SFCB daemon writes to a temporary file in /tmp without atomic safety guarantees, allowing an attacker who repeatedly races a symbolic link into place to redirect that privileged write to an arbitrary file path. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Heap-based buffer overflow in the modbusgwd daemon on Teltonika Networks RUTOS devices allows unauthenticated attackers with adjacent network access to the Modbus TCP service to crash the gateway process, causing a denial of service. The flaw originates in modbusgwd's failure to properly validate incoming Modbus TCP request data before writing to heap-allocated memory, triggering memory corruption on receipt of a malformed frame. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog, though the Modbus protocol's prevalence in OT and industrial environments makes availability disruption a meaningful operational risk.
Process termination in baseline-browser-mapping 2.x before 2.11.0 can be triggered by supplying invalid or conflicting parameters to the library, causing the entire Node.js runtime to exit via `process.exit()` rather than throwing a catchable error. Any application that exposes externally-supplied input to this library's API - such as `getCompatibleVersions()` or `getAllVersions()` - is vulnerable to complete process-level denial of service that cannot be recovered by application-layer error handlers. No public exploit exists and exploitation is rated unlikely per the CVSS 4.0 supplemental E:U tag, but impact when triggered is absolute: the process dies and cannot be restarted without operator intervention.
Heap-based buffer overflow in Wireshark's TTX Logger file parser affects versions 4.6.0 through 4.6.7, causing application crashes and denial of service when a user opens a specially crafted TTX Logger file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow) and is classified as medium severity with a CVSS score of 4.7. No active exploitation has been identified at time of analysis, and exploitation requires local file access combined with user interaction, substantially limiting real-world exposure.
Wireshark versions 4.6.0 through 4.6.7 contain a stack-based buffer overflow (CWE-121) in the Gammu DCT3 trace file parser that allows denial of service via application crash. Exploitation is constrained to local file-based attack scenarios requiring a user to open a specially crafted DCT3 trace file, with high attack complexity adding further real-world friction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Wireshark 4.6.0 through 4.6.7 on Windows crashes when parsing malformed Ixia IxVeriWave capture files or Vector Informatik BLF files, resulting in denial of service via an out-of-bounds write (CWE-787). The vulnerability requires a user to open a crafted file, making it a user-assisted local attack. No public exploit code or active exploitation has been identified at time of analysis.
The iscsiuio DHCP parser in open-iscsi crashes when processing maliciously crafted DHCP reply packets, disrupting iSCSI storage connectivity or network boot on affected hosts. An integer underflow (CWE-191) in the IPv4/UDP DHCP reply parsing path triggers an out-of-bounds read, causing the iscsiuio process to terminate; impact is limited to availability with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and the adjacent-network attack vector constrains the realistic attacker population to the same Layer-2 segment as the target.
Infinite loop in PPP option parsing exposes the pppd daemon to denial-of-service when a zero-length PPP option is encountered during link negotiation. Affected systems running pppd can be hung indefinitely by a malicious or malformed peer that sends a crafted LCP/NCP option with zero length, causing the find_opt function to spin without advancing its parse cursor. No patch version or CVSS data is available at time of analysis; exploitation conditions and scope are inferred from the description and Ubuntu vendor report alone.
Memory-amplification denial of service in a DNS parsing component reported via Ubuntu affects systems that process DNS messages with unvalidated header record counts. An attacker who can send crafted DNS packets can cause the affected parser to allocate memory proportional to attacker-controlled count fields, exhausting available memory and crashing the service. No CVSS score, KEV listing, or public exploit has been confirmed for this CVE at time of analysis.
Integer underflow in open-iscsi's iscsiuio daemon crashes the process when parsing malformed DHCPv6 Advertise packets with a truncated UDP length field, disrupting iSCSI storage connectivity. Systems running Red Hat Enterprise Linux 9 and 10 with iscsiuio actively engaged in a DHCPv6 exchange are exploitable by any unauthenticated attacker on the same adjacent network segment. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; real-world impact is highest in shared or multi-tenant storage network environments where adjacency cannot be guaranteed.
Denial of service in open-iscsi's iscsiuio daemon allows an unauthenticated attacker on the same local network segment to render the daemon permanently unresponsive by sending a single crafted ICMPv6 Router Advertisement carrying a zero-length option, triggering an infinite loop and sustained CPU exhaustion. Affected deployments include Red Hat Enterprise Linux 9 and 10 systems where iscsiuio is active for iSCSI hardware offload. A secondary out-of-bounds read risk exists when a short IPv6 payload is processed, though no memory corruption or data exposure has been confirmed from available intelligence; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote denial of service in the Russh SSH library (versions ≤ 0.62.3) allows any network attacker to crash individual server key-exchange sessions by sending a single SSH_MSG_KEX_ECDH_INIT packet containing a 32-byte all-zero Curve25519 public key. The defect triggers under the default server configuration - no special deployment required - causing a Rust bounds-check panic in encode_mpint before host-key signature verification ever occurs. A public proof-of-concept is documented in GHSA-5xvq-cp9x-6p6r; no active exploitation is confirmed in CISA KEV.
Denial-of-service in russh's Curve25519 key exchange client path allows any malicious SSH server to crash a connecting russh client session deterministically and pre-authentication, before host key verification occurs. Affected are all russh client deployments running versions prior to 0.62.4. An attacker operating or controlling an SSH server can terminate the client's spawned session task with a single malformed KEX_ECDH_REPLY packet; a working proof-of-concept is included in the GHSA advisory. No public exploit identified at time of analysis for active exploitation, and CISA KEV listing is absent, but the attack is reliable, requires no authentication, and a POC is publicly available.
Memory leak denial of service in IBM Db2 12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) enables a local attacker with low-privilege credentials to exhaust system resources and degrade database availability. Rooted in CWE-770 (uncontrolled resource allocation), the flaw requires no user interaction beyond an authenticated local session. No public exploit code or active exploitation is identified; IBM has released a patch via its support portal.
IBM Security Verify Access and IBM Verify Identity Access - across both traditional software and container deployments - expose a Use After Free (CWE-416) memory corruption flaw in the Reverse Proxy component that authenticated network attackers can trigger under certain non-default configurations to cause a denial of service. The vulnerability carries a low CVSS base score of 3.1, reflecting high attack complexity and impact limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis.
Integer underflow in GStreamer's avidemux element allows a remote unauthenticated attacker to trigger heap out-of-bounds read and write, heap memory disclosure, and application crash by delivering a crafted AVI file containing a malformed FUJIFILM strd chunk. The gst_avi_demux_parse_strd() function decrements its remaining-length counter by fixed offsets without bounds checking, causing unsigned integer wraparound for payloads of exactly 106 or 107 bytes. Because avidemux is auto-plugged by GStreamer's high-level components (playbin, decodebin, gst-discoverer), any application that opens or previews a media file - including GNOME Files, Nautilus, Totem, and many others - can trigger the vulnerability without user awareness. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available in gst-plugins-good 1.28.6.
Out-of-bounds read in GStreamer's avidemux plugin (gst-plugins-good) allows a remote, unauthenticated attacker to crash media-processing applications and potentially leak memory contents by supplying a crafted AVI file. The flaw resides in gst_avi_demux_riff_parse_vprp(), where the count of video field descriptors is derived by dividing remaining buffer size by an attacker-controlled vprp->fields value rather than the struct size, causing the parser to treat more descriptors as valid than the buffer holds. User interaction is required to trigger the bug (the victim must open or stream the malicious AVI via playbin or decodebin), and the primary confirmed impact is denial of service; limited information disclosure is also possible. No public exploit or CISA KEV listing has been identified at time of analysis.
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the entire control plane process by submitting a JWT token whose kid header is a JSON number instead of a string. Because the Go runtime panics on the unchecked type assertion before any signature, claims, or authorization logic executes, the crash takes down kuma-cp's HTTP API, health and readiness endpoints, and xDS simultaneously. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from the PR diff; sustained availability loss requires repeated requests since the process will restart.
OS command injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to disrupt system availability by submitting crafted input containing special elements that are improperly neutralized before being passed to OS-level commands. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms network-reachable exploitation requiring only low-privilege credentials, with high availability impact and a secondary low integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across actively supported IBM i releases make patching a priority for affected IBM Power Systems environments.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.
Denial-of-service risk in Fortinet FortiOS across five major version branches (6.4.x through 7.6.6) stems from unbounded resource allocation (CWE-770), allowing unauthenticated remote attackers to degrade availability of affected network appliances. The CVSS temporal metric E:P confirms proof-of-concept exploit code exists, and an official patch is available per Fortinet PSIRT advisory FG-IR-26-162. No active exploitation is confirmed in CISA KEV at time of analysis, but the broad version coverage and perimeter-facing nature of FortiOS appliances elevate practical risk.
Divide-by-zero in Velociraptor's ShouldPadFile() function allows a rogue enrolled client to crash the server process by uploading a malformed sparse file. When a GUI operator attempts to expand the file in the web interface, the unguarded division triggers a Go runtime panic, taking down the server. No public exploit code is identified at time of analysis, and CVSS rates this Low (3.5) with availability-only impact, but the attack is straightforward for any attacker who controls an enrolled endpoint.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
Unauthenticated remote denial-of-service in Phoenix Contact's PLCnext Engineer communication interface allows any network-accessible attacker to interrupt engineering access to a broad range of Phoenix Contact industrial controllers. Exploitation triggers CWE-770 resource exhaustion in the PLCnext service, causing it to stop accepting connections from the PLCnext Engineer client application. Recovery requires a manual service restart - an operationally significant constraint in industrial environments where unplanned downtime carries physical and safety implications. No public exploit code is known, and the vulnerability is not listed in CISA KEV at time of analysis.
Concurrent TLS handshakes on Zephyr RTOS devices built with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE cause a deterministic kernel panic and device reset via a NULL pointer dereference in the uninitialized credential mutex wait queue. The PSA Protected Storage credential backend in all affected Zephyr builds declared its serialization mutex without proper initialization, leaving its dlist sentinels as NULL; the fault triggers only on first contention but is fully deterministic once two threads race to acquire the lock. No public exploit has been identified and the issue is not in CISA KEV, though no exploit sophistication is required beyond opening multiple simultaneous TLS connections.
Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer access to crash the Session Management Function (SMF) by sending a malformed Credit-Control-Answer (CCA) message to the smf_gx_cca_cb handler. A publicly available proof-of-concept crash sample (SMF.crashes.zip) confirms exploitability; the absence of a CISA KEV listing indicates no confirmed widespread threat-actor exploitation has been reported. In 5G/4G core network deployments, an SMF crash disrupts session management for all connected user equipment, making this a higher operational risk than the CVSS medium score alone suggests.
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipulating the Session-Id argument processed by the fd_msg_sess_get function, causing the HSS service to fail. Low-privileged network access to the Diameter interface is sufficient to exploit this flaw, and a proof-of-concept packet capture (HSS_ULR_error_poc.pcapng.zip) has been publicly released via GitHub. No active exploitation has been confirmed in CISA KEV, but the public POC materially lowers the barrier for targeted attacks against private LTE/5G deployments running this stack.
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to trigger excessive memory allocation, crashing any application that renders it. The root cause is unbounded amplification in the shape/repeater content tree: nested repeaters multiplied by point-heavy shapes (polystar, custom paths) can cause allocations that scale combinatorially with file complexity. All rlottie versions prior to the fix in GitHub PR #599 are affected; no patch release version is independently confirmed. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.