Denial Of Service
Monthly
Uncontrolled resource consumption in MISP ≤2.5.45 allows unauthenticated remote attackers to exhaust persistent storage by flooding the password-reset and related pre-authentication endpoints, each of which performs durable database writes before validating or throttling the caller. The `/users/forgot` endpoint accepted arbitrarily long, unvalidated email values and generated two write operations per request - an audit log entry and a queued background job - with no rate limit, enabling storage and job-queue exhaustion at modest request rates. The upstream fix (commit d75d899be, reported by CIRCL) adds a 1024-byte email length cap, format validation, a Redis-backed per-source flood filter with HTTP 429 responses, and a 15-minute API-access request cooldown; no public exploit or CISA KEV listing has been identified at time of analysis.
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. All library releases from 1.5.0 (May 2020) through 2.8.x are affected; no public exploit identified at time of analysis, but the amplification ratio is deterministic and trivially reproducible.
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by submitting Markdown documents that force many headings onto the same base slug. UniqueSlugNormalizer::normalize() restarts its numeric-suffix search from 1 on every slug collision, producing O(K²) comparisons for K colliding slugs - enabling a small, crafted document to consume seconds of CPU time. No public exploit code has been confirmed, but the attack is trivially constructible from the GHSA advisory description alone, and no authentication is required against any endpoint that renders attacker-controlled Markdown.
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote denial of service. AttributesListener::findTargetAndDirection() walks the entire sibling list for each attribute node when no left-side target exists, producing O(N²) parse time; a ~32 KB payload of repeated {#a} blocks (8,000 iterations) takes over 5 seconds to process. Any deployment that has enabled AttributesExtension and accepts untrusted Markdown input is vulnerable across all 1.x releases from 1.5.0 and all 2.x releases prior to 2.9.0. No public exploit or KEV listing identified at time of analysis, but the attack is trivially reproducible from the published advisory.
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to exhaust server CPU by submitting crafted Markdown input. The fenced code block path exhibits quadratic complexity due to catastrophic regex backtracking in FencedCodeStartParser, a 320 KB single-line payload taking ~27 seconds to process without triggering PCRE's backtrack limit. The reference link label lookup path performs multiple full-string normalization passes per nested bracket pair, and the emphasis/delimiter path similarly degrades under long delimiter sequences - all three are reachable with a stock CommonMarkConverter and default configuration. No public exploit has been identified at time of analysis, but the GHSA advisory documents precise triggering payloads.
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. Exploitation is conditional on the application explicitly registering either extension; all standard bundled converters are unaffected. Fixed in version 2.9.1, which also closes an incomplete AttributesExtension fix shipped in 2.9.0 for the related inline-variant issue GHSA-g2gp-3wwq-f4ph.
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unauthenticated remote attackers to perform denial of service against PHP applications that explicitly register this extension. By submitting Markdown containing many distinctly-named attributes targeting a common block, an attacker triggers O(n²) attribute merging and filtering loops; a 256 KB payload consumes over 20 seconds of PHP CPU time per conversion request. No public exploit code has been identified at time of analysis, but the attack primitive is described in sufficient detail in the GitHub Security Advisory that construction is trivial, and developers who applied the partial 2.9.1 patch for the prior advisory GHSA-jjv6-8j6v-6j52 may incorrectly believe they are already protected.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible client to exhaust the JVM heap by sending a single WebSocket frame with an unknown opcode and an arbitrarily large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass the normal maximum frame size check, causing Jetty to attempt heap allocation for the declared payload size before the opcode is ever validated - a logic-ordering flaw classified under CWE-770. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects high impact and low attack barrier; no public exploit has been identified at time of analysis.
Denial of service via infinite loop in strongSwan's x509 plugin affects all deployments that process X.509 attribute certificates. An unauthenticated remote attacker can craft a malformed attribute certificate that triggers CWE-835 (infinite loop) during parsing, causing the IKE daemon to hang indefinitely and disrupting all VPN connectivity. The vendor fixed this in strongSwan 6.1.0 alongside six other vulnerabilities disclosed on 2026-09-07; no public exploit has been identified at time of analysis.
Denial of service via NULL-pointer dereference in strongSwan's x509 plugin affects versions 4.2.0 through 6.0.x, triggered during verification of X.509 attribute certificates. An unauthenticated remote attacker can crash the charon IKE daemon by presenting a crafted attribute certificate during VPN handshake negotiation, taking the gateway offline. Vendor-released fix is strongSwan 6.1.0, published September 7, 2026, as part of a coordinated batch of six CVE patches; no public exploit has been identified at time of analysis.
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote attackers to hang the Node.js server process with a single HTTP request. The `setChunkedCookie()` and `deleteChunkedCookie()` functions trust an attacker-controlled chunk count parsed from the sentinel cookie value (`__chunked__N`) without any upper bound, causing an O(n²) cleanup loop where each of up to N iterations scans all existing set-cookie response headers. No public standalone exploit repository has been identified, but the GHSA advisory publishes a complete exploit chain including exact cookie payloads, significantly lowering the exploitation bar.
SSRF, XXE and denial of service exposure arise in libxml2 before 2.15.4 because xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate the document's parseFlags down to the parser contexts they create for XInclude resolution. When parseFlags are dropped, protective options such as XML_PARSE_NONET stop being enforced, so an attacker-supplied document containing an external xi:include href can force outbound network fetches through the application's resource loader — enabling server-side request forgery, external entity injection, or a hang driven by an intentionally slow remote resource. Exploitation requires an application that enables XInclude and relies on XML_PARSE_NONET (typically with a custom resource loader); no public exploit code has been identified and EPSS is very low at 0.16% (6th percentile), with no CISA KEV listing.
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. In airborne or safety-critical deployments, a process crash during flight could have consequences beyond mere software unavailability. No public exploit code identified at time of analysis; the fix is confirmed in upstream PR #28475.
Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Process-terminating denial of service in undici's WebSocket implementation allows remote unauthenticated attackers to crash any Node.js application that connects to an attacker-controlled or machine-in-the-middle-intercepted WebSocket endpoint. During the opening handshake, if a server returns a Sec-WebSocket-Protocol header that the client never offered, undici dereferences a null value and throws an uncaught TypeError inside a Promise microtask, bypassing all application-level error handlers and killing the entire Node.js process. Affected are undici 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1; no public exploit identified at time of analysis.
Remote denial of service and data integrity compromise in IBM i (formerly OS/400) releases 7.3, 7.4, 7.5, and 7.6 stems from a critical function that ships without an authentication check (CWE-306), letting a network attacker invoke it without credentials. IBM has released a fix, and no public exploit has been identified at time of analysis; EPSS is low at 0.36% (29th percentile), indicating no observed exploitation pressure yet.
Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.
Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.
Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.
Abrupt TCP disconnections against undici's experimental WebSocketStream client crash the entire Node.js process: undici's internal socket-close handler unconditionally calls abort() on a writable stream that the application has locked with a writer, and discards the returned promise, so the resulting TypeError rejection is never observed and Node's default unhandled-rejection behavior terminates the process. Affected deployments are those running undici 7.0.0 through 7.29.0 or 8.0.0 through 8.10.1 and using the experimental WebSocketStream API to connect to a server an attacker controls or can MITM; the trigger is a single abrupt disconnect with no WebSocket close handshake, requiring no authentication and no user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit code identified at time of analysis, EPSS is 0.35% (28th percentile), and no CISA KEV listing exists; the impact is bounded to availability loss in the subset of services that actually use WebSocketStream against untrusted endpoints.
Infinite-loop denial-of-service in smol-toml (npm, squirrelchat) before version 1.7.1 allows remote unauthenticated attackers to permanently hang any Node.js service that parses attacker-controlled TOML. The trigger is a crafted value inside a TOML array or inline table followed by a comment character with no trailing newline - when this input reaches the parser, skipUntil() in src/util.ts receives -1 from indexOfNewline() and resets the cursor to position zero instead of terminating, spinning indefinitely and consuming all processing capacity. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.2 and the trivially constructible trigger make this straightforward to weaponize against any exposed TOML-parsing endpoint.
Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network attackers to crash or hang the integration runtime by triggering an infinite loop (CWE-835). Affected are ACE versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. Impact is confined to availability - no data exposure or integrity loss - but a hung integration broker can disrupt critical business processes in environments relying on IBM middleware for message routing and API mediation. No public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds write in Hugging Face tokenizers v0.23.1 allows any actor who can supply a crafted tokenizer.json file to abort the loading process immediately, causing denial of service in Rust applications and FFI embeddings before any inference occurs. The defect in BpeBuilder::build (tokenizers/src/models/bpe/model.rs) allocates a scratch buffer sized to the longest vocabulary key, then writes concatenated BPE merge pairs into it without bounding the write to the buffer size; a merge whose result exceeds that length triggers a Rust panic and process abort (CWE-787). A secondary usize underflow at the same code site, activated when continuing_subword_prefix is set and a merge token is shorter than the prefix, produces a panic in debug builds and potential memory corruption in release builds, elevating the secondary impact beyond availability alone. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix appears in the v0.23.2 source.
Memory exhaustion in Chroma 1.5.9 allows unauthenticated remote attackers to crash the vector database server by supplying arbitrarily large HNSW index parameter values (max_neighbors, ef_construction, ef_search) in collection-create requests. Because no upper-bound validation exists in the Rust-based HNSW configuration layer, the server allocates memory proportional to attacker-supplied values during index compaction, causing denial of service. No public exploit code or active exploitation has been identified at time of analysis, but the zero-complexity unauthenticated network path makes this a straightforward availability risk for any internet-facing Chroma deployment.
Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a remote HTTP server to exhaust client-side memory and crash the entire BEAM VM node. Two HTTP/1 parser states - the status-line decoder and the chunk-extension-line decoder - append successive socket data into `conn.buffer` with no size cap because the existing `:max_header_list_size` guard was wired only to header and trailer parsing, not to these two states. A malicious or attacker-redirected server that withholds CRLF terminators can grow the buffer indefinitely until the OS OOM-killer terminates the node, collaterally killing all other processes sharing it. No public exploit has been identified, but the technique requires only a straightforward streaming server.
Unbounded memory consumption in SiYuan's request-concurrency middleware allows unauthenticated remote attackers to permanently exhaust process memory by flooding the application with unique request paths. The root cause is a mutex-entry map that grows without bound - each distinct URL path creates a new mutex entry that is never evicted, causing memory and synchronization overhead to accumulate indefinitely. All SiYuan deployments prior to v3.8.2 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Memory exhaustion denial-of-service in SiYuan's publish-service Basic Auth throttle allows unauthenticated remote attackers to crash or degrade the service by submitting authentication requests with an unbounded number of unique invalid usernames. Because the throttle tracks per-username failure state in memory with no capacity limit or eviction policy, the in-memory tracking structure grows without bound until the process exhausts available heap. All SiYuan versions prior to v3.8.2 are affected; no active exploitation has been identified at time of analysis.
Memory exhaustion in SiYuan's publish-service Basic Auth handler allows authenticated users to repeatedly submit valid credentials, generating persistent session entries that accumulate without expiry or capacity limits, eventually crashing the process. All SiYuan versions before v3.8.2 are affected, as confirmed by vendor security advisory GHSA-f4vj-ppp2-5hg4. No active exploitation has been recorded in CISA KEV and no public proof-of-concept code is known, but the low barrier - only valid credentials required - means any account holder can trigger denial of service on demand.
Unauthenticated remote memory exhaustion in SiYuan before v3.8.2 allows any network-reachable attacker to degrade or crash the service by flooding the /api/system/uiproc endpoint with unique process identifiers. The endpoint retains each submitted identifier in memory without size bounds, rate limiting, or authentication checks, making the attack trivially automatable. No public exploit code or KEV status is confirmed at time of analysis, but the simplicity of exploitation via repeated HTTP requests requires no special tooling.
Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.
Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The `ogs_sbi_time_from_string()` function in `lib/sbi/conv.c` copies characters into a fixed-size buffer using loop counters `j` and `k` without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. Public proof-of-concept exploit code is available via the hackeryounow/5GCVulDB repository; no active exploitation is confirmed in CISA KEV.
Denial of service in the Free5GC go-upf user plane function (UPF) allows a remote, unauthenticated attacker to crash the UPF process by sending crafted PFCP signaling messages that trigger a null pointer dereference during session lookup and session-report handling. The flaw affects Free5GC v4.2.2 and manifests as a Go runtime panic in internal/pfcp, taking down user-plane packet forwarding for all subscribers served by that UPF. No public exploit is confirmed in the wild and CISA KEV does not list it, but an upstream fix (go-upf PR #97) exists and researcher-published analysis (5GCVulDB gist repository) is publicly linked; EPSS is low at 0.25%, consistent with the narrow exposure of PFCP/N4 interfaces rather than low technical severity.
Resource exhaustion in the MOOSDB HTTP server component of MOOS core-moos through 10.4.0 allows unauthenticated remote attackers to render MOOSDB unavailable by opening many simultaneous connections and sending unbounded HTTP header data. Source code analysis confirms the pre-patch implementation in CMOOSDBHTTPServer and CHTTPConnection imposed no limits on concurrent connections, header line count, per-line byte size, or per-connection read timeouts - all four controls were absent. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires no authentication or special tooling and is trivially automatable.
Unbounded memory consumption in MOOS-IvP pMarineViewer through version 24.8.1 allows unauthenticated network attackers to exhaust the operator display process by flooding it with NODE_REPORT messages carrying arbitrary distinct node names. The ContactLedger class allocates a new tracking entry for every unique vessel name it encounters without enforcing any cap, making the ledger - and everything that iterates it - grow without limit. The result is a stalled or crashed operator situational-awareness display, which is operationally significant in autonomous maritime missions. No public exploit has been identified at time of analysis; an upstream fix capping contacts at 200 has been merged but a tagged release version has not been independently confirmed.
Unbounded resource allocation in MOOS-IvP uFldShoreBroker through 24.8.1 allows a remote unauthenticated attacker to exhaust the shore broker process's memory and degrade per-iteration CPU performance by sending NODE_BROKER_PING messages with an unlimited number of distinct community names. Each unique community name causes entries to be appended across six parallel in-memory vectors with no eviction policy and no enrollment ceiling, creating unbounded O(n) per-pass overhead. Sustained delivery crashes or disables the shore broker, severing coordination between shore-side operators and autonomous marine vehicles. No public exploit has been identified at time of analysis.
Unauthenticated remote resource exhaustion in MOOS-IvP pRealm through version 24.8.1 allows any network-reachable attacker to register unlimited long-lived REALMCAST_REQ subscriptions with arbitrarily large variable lists, causing the pRealm process to serialize and publish excessive output on every scheduling interval until system resources are exhausted. The vulnerability stems from three absent input limits: no cap on subscription duration, no cap on variable count per subscription, and no ceiling on concurrent pipeway registrations. The fix, confirmed by PR #132 and commit 8a4bb9d9, introduces hard limits of 3600 seconds duration, 64 variables per request, and 64 total concurrent pipeways. No public exploit or KEV listing has been identified at time of analysis.
Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system memory by sending crafted mux packets with arbitrarily large declared packet counts to the Demuxer::addMuxPacket() function. The demultiplexer trusts the integer value in the mux header without a ceiling, causing the process to reserve memory for each declared packet slot. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed by CISA KEV.
Denial-of-service in MOOS core-moos through 10.4.0 allows any unauthenticated network peer to permanently freeze the MOOSDB accept thread by opening a TCP connection to the MOOSDB port and sending no data during the wire-protocol handshake. Because the accept thread executes a blocking receive without any timeout while holding the socket-list lock, a single stalled connection prevents all subsequent MOOS clients from registering, effectively rendering the publish-subscribe middleware inoperable. No public exploit code or active exploitation has been identified; however, the attack requires only a single TCP connection and no credentials, making it trivially automatable against any exposed MOOSDB instance.
Uncontrolled memory allocation in MOOS core-moos through 10.4.0 exposes MOOSDB servers to pre-authentication denial of service. The CMOOSCommPkt::OnBytesWritten() function reads the packet length field directly from untrusted wire data and passes it without any upper-bound check to new unsigned char[], allowing unbounded heap allocation before any client authentication handshake occurs. An unauthenticated network attacker can craft packets with arbitrarily large declared lengths to exhaust server memory and crash the MOOSDB process; no public exploit has been identified at time of analysis, and an upstream patch is available via GitHub commit e7ea624.
Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge process by sending a single crafted UDP datagram containing a negative declared packet length. The root cause is a signed-to-unsigned type confusion in CMOOSUDPLink::ReadPktFromArray(): a negative nRqd value passes a signed bounds check unchanged, then is silently cast to a near-SIZE_MAX size_t when passed to memcpy, writing far beyond the destination heap buffer. No public exploit has been identified at time of analysis, but the attack primitive requires only network access to the UDP listen port and a small crafted payload; the upstream fix is available as a GitHub patch commit.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Use-after-free in Skia, Chrome's 2D graphics rendering engine, allows remote attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.82 across desktop platforms. The sandbox confinement means this vulnerability alone does not yield full system compromise - a chained sandbox escape would be required for that - but the renderer-process code execution is rated high impact by Chromium's internal severity team. No public exploit or CISA KEV listing is present at time of analysis; SSVC labels exploitation as none and the attack as non-automatable due to the required user interaction.
Remote code execution in Google Chrome's DevTools component before 152.0.7977.82 lets a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and carries a CVSS 9.6 with scope change, reflecting sandbox escape. Google has shipped a fix; per CISA's SSVC assessment there is no evidence of active exploitation and no public exploit identified at time of analysis.
Use-after-free in Chrome's Compositing component (versions prior to 152.0.7977.82) enables a sandbox escape when chained with a renderer-process compromise - an attacker who has already gained control of the renderer can corrupt memory in the Compositing layer and execute arbitrary code outside Chrome's sandbox boundary on the host operating system. The CVSS S:C (scope changed) metric confirms this is a privilege-escalation-across-boundary primitive, delivering full C:H/I:H/A:H impact against the underlying OS. A vendor patch is available in Chrome 152.0.7977.82, and no public exploit has been identified at time of analysis.
Uncontrolled resource consumption in the Migrate Guru - Site Migration & Cloning WordPress plugin (versions 6.65 and earlier) exposes any WordPress installation running the plugin to remote denial of service by unauthenticated network attackers. The root cause (CWE-770) indicates that one or more plugin endpoints perform resource-intensive operations without adequate rate limiting or throttling, allowing an attacker to exhaust server capacity without supplying credentials. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated denial of service in MalCare Security WordPress plugin versions 6.69 and earlier allows any remote attacker with no credentials to exhaust server resources and take down affected WordPress sites. The vulnerability, rooted in CWE-770 (resource allocation without throttling), exposes a network-accessible plugin endpoint that can be abused to render the site unavailable. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward target for automated abuse.
Persistent denial of service in MISP's event template subsystem allows an authenticated user with event-template write permissions to store malformed JSON as a template definition by bypassing semantic validation. When any authenticated user subsequently loads the event template index - an endpoint accessible to all authenticated users - an unhandled exception in afterFind() causes HTTP 500 errors instance-wide until an administrator manually repairs the offending database row. The patch enforces strict array-only validation on save and adds exception handling on retrieval with graceful degradation to an empty definition.
Process-terminating denial of service in libmongocrypt's decryption path allows a low-privileged attacker to crash applications using MongoDB Client-Side Field Level Encryption (CSFLE). Tracked as MONGOCRYPT-971, the vulnerability is triggered when an unexpected-size encrypted value reaches the decryption routine, firing a reachable assertion (CWE-617) that abruptly terminates the host process rather than returning a handled error. An attacker who can store crafted encrypted values in a shared MongoDB collection, or influence the encrypted data an application receives, can repeatably crash the targeted application.
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the vhr open-source HR management system allows any authenticated user to overwrite arbitrary HR profiles - including administrator accounts - via the PUT /hr/info endpoint by supplying a victim's profile ID in the request body. The flaw stems from a complete absence of object-level authorization in HrInfoController.java: the server updates whichever record ID is provided without verifying the requester owns or has permission to modify it. Beyond profile data manipulation, an attacker can disable administrator accounts, effectively causing a denial-of-service against system administration functions. No vendor-released patch has been identified at time of analysis.
NULL pointer dereference in GStreamer's RTSP support library (gst-plugins-base) crashes any process that parses a Digest authentication header containing specially crafted whitespace, resulting in a denial-of-service condition. The flaw is bidirectional: an unauthenticated remote attacker can crash an RTSP server by sending a single malformed request when Digest authentication is enabled, and a malicious or compromised RTSP server can crash an RTSP client using the same technique. No confidentiality or integrity impact is confirmed; the sole consequence is process termination. No public exploit code or CISA KEV listing has been identified at time of analysis.
NULL pointer dereference in the Linux kernel's psxpad-spi driver crashes the kernel when system suspend is triggered on hardware using SPI-connected PlayStation controllers. The probe() function in drivers/input/joystick/psxpad-spi.c omits the spi_set_drvdata() call that stores per-device state, so psxpad_spi_suspend() unconditionally dereferences a NULL pointer on suspend entry, causing a kernel panic. Patches are available across all active stable kernel branches (5.10 through 7.2); EPSS is 0.21% and no active exploitation has been identified.
Out-of-bounds memory read in the Linux kernel's DRM HDMI connector subsystem allows a local, low-privileged user to potentially leak up to 32 bytes of adjacent kernel heap memory or trigger a page fault leading to kernel crash. The flaw exists in a helper function that copies audio infoframe data using the destination buffer size (60 bytes) rather than the source structure size (28 bytes), reading 32 bytes beyond the source allocation. No public exploit code exists, and EPSS sits at the 10th percentile; however, the availability impact is real - the overread can cross a page boundary and cause an access violation.
Btrfs in the Linux kernel fails to reinitialize inode address-space mapping flags and minimum folio order when re-reading previously evicted cached inodes, causing a kernel assertion failure and system crash (denial of service). The defect surfaces only when btrfs is mounted with a block size larger than the host memory page size - a non-default but valid configuration - and manifests after a create/evict/re-read inode cycle. No public exploit code exists and EPSS is 0.20% (10th percentile), reflecting negligible real-world exploitation probability beyond accidental triggering.
Uncontrolled recursion in Amazon Ion-C before v1.1.6 allows a remote unauthenticated attacker to crash any application that parses untrusted Ion data using this library, causing a denial of service via native call stack exhaustion. The fix, released in v1.1.6 and titled 'Harden container depth,' confirms the root cause is missing or insufficient depth limiting on nested Ion container parsing. No authentication is required and no special configuration is needed beyond the application accepting Ion input from untrusted sources. No public exploit code has been identified at time of analysis.
Connection deadlock in golang.org/x/crypto/ssh (all versions before 0.56.0) allows a malicious remote SSH peer to permanently freeze an SSH connection by flooding the incomingRequests queue of a channel that has been registered in the mux's chanList but not yet established. The attack exploits the absence of any established-state guard in the packet handler, causing a deadlock that renders the entire connection unresponsive without triggering an explicit teardown. No public exploit has been identified and no CISA KEV listing exists, but the network-accessible, no-authentication CVSS vector makes this straightforward to trigger against any Go application using this library for SSH.
Denial-of-service in the Go extended cryptography library's SSH package allows a malicious peer to deadlock an entire SSH connection by sending crafted RFC 4254 channel messages after a channel is established. All versions of golang.org/x/crypto/ssh below 0.56.0 are affected; the flaw manifests because unrecognized channel messages were buffered and allowed to block rather than being rejected as protocol errors. No public exploit or active exploitation has been identified, but the attack requires no privileges in the worst-case client scenario where a malicious SSH server targets a connecting client.
BEAM atom table exhaustion in Boruta Server prior to 0.10.0 allows any authenticated end user to crash the entire OAuth 2.0/OpenID Connect umbrella application by repeatedly submitting PUT /users/settings requests with arbitrary novel body keys. The UserSettingsController calls String.to_atom/1 on all user-supplied map keys before any validation, permanently interning them in the Erlang VM's global atom table (hard cap: 1,048,576 entries). Once exhausted, the BEAM runtime aborts with 'no more index entries in atom_tab', taking down the auth, admin, and gateway components simultaneously. No public exploit identified at time of analysis, and the issue has been patched in version 0.10.0.
Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. Depending on the downstream dependency tree, exploitable outcomes range from reliable denial of service to remote code execution via prototype-pollution gadget chains; no public exploit or active exploitation is confirmed at time of analysis.
Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. Exploitation is gated on a non-default configuration - Web Access must be explicitly enabled on devices registered to Cisco Unified Communications Manager - materially limiting real-world attack surface despite the network-accessible vector. No public exploit code and no CISA KEV listing were identified at time of analysis.
Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an unauthenticated attacker run code as root by connecting to TCP ports 43210 and 43211, which are exposed by default in the Layer 3 default VRF. Crafted input to the S1HAL process is executed with root privileges, and the same flaw can crash S1HAL to force a device reload (denial of service). Rated CVSS 9.8; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-authentication, network-facing nature makes it a top-priority patch.
NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching.
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.
Unauthenticated remote denial of service in Libreswan's pluto IKE daemon allows any network attacker to repeatedly crash and restart the VPN service by sending a malformed X.509 certificate in a CERT payload during IKE handshake negotiation. The crash is triggered by a reachable assertion in `add_decoded_cert()`: when NSS's `CERT_ExtractPublicKey()` receives a certificate with an invalid RSA exponent (e.g., zero), it returns NULL, which the FIPS-mode code path does not handle, causing the daemon to abort. The vendor explicitly confirms no remote code execution is possible; impact is limited to availability. No CISA KEV listing and no public exploit code have been identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the Shared Tab Groups feature (CWE-416). A remote attacker who lures a victim into visiting a crafted HTML page can corrupt freed memory to execute arbitrary code outside the renderer sandbox. Chromium rates the severity Critical (CVSS 9.6); the vendor has shipped a fix, but no public exploit has been identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the WebGL implementation, letting a remote attacker who lures a victim to a crafted HTML page execute arbitrary code OUTSIDE the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector; a vendor patch shipped in the September 2026 Stable channel update. No public exploit identified at time of analysis, though the tracker bug (issues.chromium.org/546260492) and Google's own reporting indicate the flaw is well characterized.
Use-after-free in Chrome's TabStrip component enables remote code execution outside the renderer sandbox in Google Chrome versions prior to 152.0.7977.75. An attacker must social-engineer a user into a specific UI interaction to trigger the memory-corruption primitive, after which arbitrary code executes at browser-process privilege - a full sandbox escape. Google has issued a stable channel patch; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in Google Chrome's Browser process prior to version 152.0.7977.75 enables sandbox escape, allowing an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. The CVSS vector (AV:N/AC:H/S:C/C:H/I:H/A:H) reflects both the network-reachable delivery and the scope change from renderer to host-level execution. No public exploit or CISA KEV listing has been identified at time of analysis, but sandbox-escape primitives of this class are highly valued in exploit chains.
Remote code execution inside Chrome's sandbox is achievable via a use-after-free in WebRTC, triggered when a victim visits a specially crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75 across desktop platforms. No public exploit code or CISA KEV listing has been identified at time of analysis, though the sandboxed execution boundary limits the practical impact compared to the raw CVSS 8.8 score - Google's own Chromium severity rating of 'Medium' reflects this containment.
Remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in Dawn, Chrome's WebGPU/GPU graphics abstraction layer, and - per Google's advisory - allows a crafted HTML page to execute arbitrary code outside the renderer sandbox. Exploitation only requires an unauthenticated victim to visit a malicious page, giving the attacker high-impact code execution on the device. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, though the sandbox-escape framing makes it a high-priority browser patch.
Remote code execution in Google Chrome desktop before 152.0.7977.75 stems from a use-after-free in the Proxy component that a remote attacker can trigger with crafted network traffic to run arbitrary code OUTSIDE the browser sandbox. Google rates the Chromium severity High and a patched Stable channel build is available; no public exploit code has been identified at time of analysis. Because the flaw yields a sandbox escape rather than a contained renderer bug, successful exploitation gives attacker-controlled code on the host at browser-process privilege.
Unbounded recursion in Net::DNS before 1.57 for Perl allows a remote unauthenticated attacker to exhaust memory and terminate any DNS forwarder or proxy process by sending a crafted DNS message carrying a TSIG record misplaced in the answer or authority section with an empty MAC field. Because the library's decoder does not drop the malformed packet as RFC 8945 section 5.2 requires, the TSIG survives the re-encoding strip step and drives `sig_data` into infinite recursion; payloads under 100 bytes on the wire are sufficient to crash the process. No public exploit has been identified at time of analysis, and EPSS indicates low current exploitation probability (0.17%), though the trivially small payload and zero-authentication requirement make this an operational priority for any Perl-based DNS forwarder or proxy deployment.
Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's `maxTotalMergeKeys` safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (`<<`) processing is enabled by default on both release lines. No confirmed active exploitation appears in CISA KEV at time of analysis, but the attack is trivially reproducible from the published advisory and pathological test case, and the library's ubiquity in the npm ecosystem makes this a high-priority availability risk.
Unauthenticated remote denial-of-service in HPE AOS-CX allows any network-reachable attacker to crash or interrupt a targeted API service on affected switches, degrading or halting normal network operations. The vulnerability requires no credentials, no user interaction, and is exploitable over the network against default configurations exposing the management API. This CVE is part of HPE Security Bulletin HPESBNW05134, which also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749) and a CVSS 7.2 authenticated command injection (CVE-2026-73766) in the same platform; no public exploit has been identified at time of analysis.
Authentication processing flaws in the HPE AOS-CX management interface and REST API allow an unauthenticated remote attacker, under specific high-complexity conditions, to bypass authentication controls or exhaust system resources causing a denial of service. Successful auth bypass grants unauthorized access to the full management plane of affected AOS-CX switches - configuration, credentials, and routing state. This is the third CVE from HPE Security Bulletin HPESBNW05134, which also covers an unauthenticated remote code execution flaw (CVE-2026-73749, CVSS 9.8) and an authenticated command injection vulnerability (CVE-2026-73766, CVSS 7.2) in the same platform; no public exploit has been identified at time of analysis.
Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.
Memory exhaustion in gRPC-Go before version 1.83.1 allows an unauthenticated remote attacker to crash any service built on this library by sending HTTP/2 streams fragmented into millions of tiny one-byte DATA frames. Each fragment is stored as a separate recvMsg object in recvBuffer, creating severe heap overhead that bypasses HTTP/2 flow-control protections - which limit payload bytes, not the number of allocated metadata objects. No public exploit has been identified at time of analysis, but the attack is fully derivable from the public GitHub advisory and PR diff.
Worker process exhaustion in Erlang/OTP's inets httpd enables unauthenticated remote denial of service by exploiting a bare-catch error-handling flaw in the chunked transfer-encoding decoder, permanently consuming HTTP worker processes until the pool is exhausted and the server becomes unresponsive to legitimate clients. The defect lies in httpd_request_handler:handle_info/2, where a throw exception raised by an invalid chunk-size is silently coerced into a normal return tuple rather than propagated as an error, leaving the worker suspended indefinitely with the request timeout already cancelled and no default byte-rate watchdog to reclaim it. Affected OTP versions span three active release lines (27.x, 28.x, 29.x) in their default configurations; no public exploit is confirmed, though the fix commit includes a regression test that is functionally equivalent to a proof-of-concept attack.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event loop by submitting a small crafted XML document containing a malformed end tag. The SAX parser in lib/sax.js uses an unanchored global regex /[ \t\n\r]+$/g to trim end-tag names; a tag with N whitespace characters followed by one non-whitespace character causes the engine to retry the match from every character position with O(N) backtracking per position, yielding O(N²) total work that blocks the single-threaded event loop. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 4.0 score of 8.7 with VA:H and PR:N reflects the severity of unauthenticated, network-reachable availability impact.
Erlang/OTP's inets HTTP server (httpd) fails to enforce an administrator-configured request body-size limit when processing chunked transfer-encoded requests, enabling unauthenticated remote attackers to exhaust server memory and cause denial of service. Affected OTP branches span 17.x through 27.3.4.16, 28.x through 28.5.0.5, and 29.x through 29.0.5, covering inets versions 5.10 through 9.7.1. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, but the zero-authentication, low-complexity network attack path makes this an operationally straightforward DoS risk for any deployment exposing inets httpd to untrusted clients.
Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js process heap by sending a compact, crafted XML document with repeated namespace prefix declarations. The unmaintained legacy `xmldom` package (versions 0.1.5-0.6.0) has no available fix, while `@xmldom/xmldom` is patched in releases 0.8.15 and 0.9.12. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the attack is trivially automatable against any application that parses untrusted XML with this library.
Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The `@xmldom/xmldom` package before versions 0.8.15 and 0.9.12, and all versions of the legacy `xmldom` package (0.3.0-0.6.0), expose both paths through the default `DOMParser.parseFromString()` interface, requiring no authentication or special configuration. No public exploit has been identified at time of analysis, but the security advisories and fix commits are publicly available on GitHub.
Unbounded memory exhaustion in the Erlang/OTP inets httpc HTTP client allows any server the client connects to - including via redirect or man-in-the-middle - to crash the BEAM VM by returning an arbitrarily large volume of response headers. The root cause is that max_header_size defaults to the atom nolimit and the header accumulation loop in httpc_response:parse_headers/6 collects all header data into an in-process list before any size check fires. A proof-of-concept server delivering 100,000 headers of ~4,000 bytes each consumed over 13 GB of RAM in under 30 seconds; no public exploit code has been separately released but the PoC is embedded in the official advisory, and vendor patches are available for OTP 27, 28, and 29 branches.
Uncontrolled resource consumption in MISP ≤2.5.45 allows unauthenticated remote attackers to exhaust persistent storage by flooding the password-reset and related pre-authentication endpoints, each of which performs durable database writes before validating or throttling the caller. The `/users/forgot` endpoint accepted arbitrarily long, unvalidated email values and generated two write operations per request - an audit log entry and a queued background job - with no rate limit, enabling storage and job-queue exhaustion at modest request rates. The upstream fix (commit d75d899be, reported by CIRCL) adds a 1024-byte email length cap, format validation, a Redis-backed per-source flood filter with HTTP 429 responses, and a 15-minute API-access request cooldown; no public exploit or CISA KEV listing has been identified at time of analysis.
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. All library releases from 1.5.0 (May 2020) through 2.8.x are affected; no public exploit identified at time of analysis, but the amplification ratio is deterministic and trivially reproducible.
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by submitting Markdown documents that force many headings onto the same base slug. UniqueSlugNormalizer::normalize() restarts its numeric-suffix search from 1 on every slug collision, producing O(K²) comparisons for K colliding slugs - enabling a small, crafted document to consume seconds of CPU time. No public exploit code has been confirmed, but the attack is trivially constructible from the GHSA advisory description alone, and no authentication is required against any endpoint that renders attacker-controlled Markdown.
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote denial of service. AttributesListener::findTargetAndDirection() walks the entire sibling list for each attribute node when no left-side target exists, producing O(N²) parse time; a ~32 KB payload of repeated {#a} blocks (8,000 iterations) takes over 5 seconds to process. Any deployment that has enabled AttributesExtension and accepts untrusted Markdown input is vulnerable across all 1.x releases from 1.5.0 and all 2.x releases prior to 2.9.0. No public exploit or KEV listing identified at time of analysis, but the attack is trivially reproducible from the published advisory.
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to exhaust server CPU by submitting crafted Markdown input. The fenced code block path exhibits quadratic complexity due to catastrophic regex backtracking in FencedCodeStartParser, a 320 KB single-line payload taking ~27 seconds to process without triggering PCRE's backtrack limit. The reference link label lookup path performs multiple full-string normalization passes per nested bracket pair, and the emphasis/delimiter path similarly degrades under long delimiter sequences - all three are reachable with a stock CommonMarkConverter and default configuration. No public exploit has been identified at time of analysis, but the GHSA advisory documents precise triggering payloads.
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. Exploitation is conditional on the application explicitly registering either extension; all standard bundled converters are unaffected. Fixed in version 2.9.1, which also closes an incomplete AttributesExtension fix shipped in 2.9.0 for the related inline-variant issue GHSA-g2gp-3wwq-f4ph.
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unauthenticated remote attackers to perform denial of service against PHP applications that explicitly register this extension. By submitting Markdown containing many distinctly-named attributes targeting a common block, an attacker triggers O(n²) attribute merging and filtering loops; a 256 KB payload consumes over 20 seconds of PHP CPU time per conversion request. No public exploit code has been identified at time of analysis, but the attack primitive is described in sufficient detail in the GitHub Security Advisory that construction is trivial, and developers who applied the partial 2.9.1 patch for the prior advisory GHSA-jjv6-8j6v-6j52 may incorrectly believe they are already protected.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible client to exhaust the JVM heap by sending a single WebSocket frame with an unknown opcode and an arbitrarily large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass the normal maximum frame size check, causing Jetty to attempt heap allocation for the declared payload size before the opcode is ever validated - a logic-ordering flaw classified under CWE-770. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects high impact and low attack barrier; no public exploit has been identified at time of analysis.
Denial of service via infinite loop in strongSwan's x509 plugin affects all deployments that process X.509 attribute certificates. An unauthenticated remote attacker can craft a malformed attribute certificate that triggers CWE-835 (infinite loop) during parsing, causing the IKE daemon to hang indefinitely and disrupting all VPN connectivity. The vendor fixed this in strongSwan 6.1.0 alongside six other vulnerabilities disclosed on 2026-09-07; no public exploit has been identified at time of analysis.
Denial of service via NULL-pointer dereference in strongSwan's x509 plugin affects versions 4.2.0 through 6.0.x, triggered during verification of X.509 attribute certificates. An unauthenticated remote attacker can crash the charon IKE daemon by presenting a crafted attribute certificate during VPN handshake negotiation, taking the gateway offline. Vendor-released fix is strongSwan 6.1.0, published September 7, 2026, as part of a coordinated batch of six CVE patches; no public exploit has been identified at time of analysis.
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote attackers to hang the Node.js server process with a single HTTP request. The `setChunkedCookie()` and `deleteChunkedCookie()` functions trust an attacker-controlled chunk count parsed from the sentinel cookie value (`__chunked__N`) without any upper bound, causing an O(n²) cleanup loop where each of up to N iterations scans all existing set-cookie response headers. No public standalone exploit repository has been identified, but the GHSA advisory publishes a complete exploit chain including exact cookie payloads, significantly lowering the exploitation bar.
SSRF, XXE and denial of service exposure arise in libxml2 before 2.15.4 because xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate the document's parseFlags down to the parser contexts they create for XInclude resolution. When parseFlags are dropped, protective options such as XML_PARSE_NONET stop being enforced, so an attacker-supplied document containing an external xi:include href can force outbound network fetches through the application's resource loader — enabling server-side request forgery, external entity injection, or a hang driven by an intentionally slow remote resource. Exploitation requires an application that enables XInclude and relies on XML_PARSE_NONET (typically with a custom resource loader); no public exploit code has been identified and EPSS is very low at 0.16% (6th percentile), with no CISA KEV listing.
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. In airborne or safety-critical deployments, a process crash during flight could have consequences beyond mere software unavailability. No public exploit code identified at time of analysis; the fix is confirmed in upstream PR #28475.
Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Process-terminating denial of service in undici's WebSocket implementation allows remote unauthenticated attackers to crash any Node.js application that connects to an attacker-controlled or machine-in-the-middle-intercepted WebSocket endpoint. During the opening handshake, if a server returns a Sec-WebSocket-Protocol header that the client never offered, undici dereferences a null value and throws an uncaught TypeError inside a Promise microtask, bypassing all application-level error handlers and killing the entire Node.js process. Affected are undici 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1; no public exploit identified at time of analysis.
Remote denial of service and data integrity compromise in IBM i (formerly OS/400) releases 7.3, 7.4, 7.5, and 7.6 stems from a critical function that ships without an authentication check (CWE-306), letting a network attacker invoke it without credentials. IBM has released a fix, and no public exploit has been identified at time of analysis; EPSS is low at 0.36% (29th percentile), indicating no observed exploitation pressure yet.
Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.
Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.
Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.
Abrupt TCP disconnections against undici's experimental WebSocketStream client crash the entire Node.js process: undici's internal socket-close handler unconditionally calls abort() on a writable stream that the application has locked with a writer, and discards the returned promise, so the resulting TypeError rejection is never observed and Node's default unhandled-rejection behavior terminates the process. Affected deployments are those running undici 7.0.0 through 7.29.0 or 8.0.0 through 8.10.1 and using the experimental WebSocketStream API to connect to a server an attacker controls or can MITM; the trigger is a single abrupt disconnect with no WebSocket close handshake, requiring no authentication and no user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit code identified at time of analysis, EPSS is 0.35% (28th percentile), and no CISA KEV listing exists; the impact is bounded to availability loss in the subset of services that actually use WebSocketStream against untrusted endpoints.
Infinite-loop denial-of-service in smol-toml (npm, squirrelchat) before version 1.7.1 allows remote unauthenticated attackers to permanently hang any Node.js service that parses attacker-controlled TOML. The trigger is a crafted value inside a TOML array or inline table followed by a comment character with no trailing newline - when this input reaches the parser, skipUntil() in src/util.ts receives -1 from indexOfNewline() and resets the cursor to position zero instead of terminating, spinning indefinitely and consuming all processing capacity. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.2 and the trivially constructible trigger make this straightforward to weaponize against any exposed TOML-parsing endpoint.
Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network attackers to crash or hang the integration runtime by triggering an infinite loop (CWE-835). Affected are ACE versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. Impact is confined to availability - no data exposure or integrity loss - but a hung integration broker can disrupt critical business processes in environments relying on IBM middleware for message routing and API mediation. No public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds write in Hugging Face tokenizers v0.23.1 allows any actor who can supply a crafted tokenizer.json file to abort the loading process immediately, causing denial of service in Rust applications and FFI embeddings before any inference occurs. The defect in BpeBuilder::build (tokenizers/src/models/bpe/model.rs) allocates a scratch buffer sized to the longest vocabulary key, then writes concatenated BPE merge pairs into it without bounding the write to the buffer size; a merge whose result exceeds that length triggers a Rust panic and process abort (CWE-787). A secondary usize underflow at the same code site, activated when continuing_subword_prefix is set and a merge token is shorter than the prefix, produces a panic in debug builds and potential memory corruption in release builds, elevating the secondary impact beyond availability alone. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix appears in the v0.23.2 source.
Memory exhaustion in Chroma 1.5.9 allows unauthenticated remote attackers to crash the vector database server by supplying arbitrarily large HNSW index parameter values (max_neighbors, ef_construction, ef_search) in collection-create requests. Because no upper-bound validation exists in the Rust-based HNSW configuration layer, the server allocates memory proportional to attacker-supplied values during index compaction, causing denial of service. No public exploit code or active exploitation has been identified at time of analysis, but the zero-complexity unauthenticated network path makes this a straightforward availability risk for any internet-facing Chroma deployment.
Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a remote HTTP server to exhaust client-side memory and crash the entire BEAM VM node. Two HTTP/1 parser states - the status-line decoder and the chunk-extension-line decoder - append successive socket data into `conn.buffer` with no size cap because the existing `:max_header_list_size` guard was wired only to header and trailer parsing, not to these two states. A malicious or attacker-redirected server that withholds CRLF terminators can grow the buffer indefinitely until the OS OOM-killer terminates the node, collaterally killing all other processes sharing it. No public exploit has been identified, but the technique requires only a straightforward streaming server.
Unbounded memory consumption in SiYuan's request-concurrency middleware allows unauthenticated remote attackers to permanently exhaust process memory by flooding the application with unique request paths. The root cause is a mutex-entry map that grows without bound - each distinct URL path creates a new mutex entry that is never evicted, causing memory and synchronization overhead to accumulate indefinitely. All SiYuan deployments prior to v3.8.2 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Memory exhaustion denial-of-service in SiYuan's publish-service Basic Auth throttle allows unauthenticated remote attackers to crash or degrade the service by submitting authentication requests with an unbounded number of unique invalid usernames. Because the throttle tracks per-username failure state in memory with no capacity limit or eviction policy, the in-memory tracking structure grows without bound until the process exhausts available heap. All SiYuan versions prior to v3.8.2 are affected; no active exploitation has been identified at time of analysis.
Memory exhaustion in SiYuan's publish-service Basic Auth handler allows authenticated users to repeatedly submit valid credentials, generating persistent session entries that accumulate without expiry or capacity limits, eventually crashing the process. All SiYuan versions before v3.8.2 are affected, as confirmed by vendor security advisory GHSA-f4vj-ppp2-5hg4. No active exploitation has been recorded in CISA KEV and no public proof-of-concept code is known, but the low barrier - only valid credentials required - means any account holder can trigger denial of service on demand.
Unauthenticated remote memory exhaustion in SiYuan before v3.8.2 allows any network-reachable attacker to degrade or crash the service by flooding the /api/system/uiproc endpoint with unique process identifiers. The endpoint retains each submitted identifier in memory without size bounds, rate limiting, or authentication checks, making the attack trivially automatable. No public exploit code or KEV status is confirmed at time of analysis, but the simplicity of exploitation via repeated HTTP requests requires no special tooling.
Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.
Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The `ogs_sbi_time_from_string()` function in `lib/sbi/conv.c` copies characters into a fixed-size buffer using loop counters `j` and `k` without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. Public proof-of-concept exploit code is available via the hackeryounow/5GCVulDB repository; no active exploitation is confirmed in CISA KEV.
Denial of service in the Free5GC go-upf user plane function (UPF) allows a remote, unauthenticated attacker to crash the UPF process by sending crafted PFCP signaling messages that trigger a null pointer dereference during session lookup and session-report handling. The flaw affects Free5GC v4.2.2 and manifests as a Go runtime panic in internal/pfcp, taking down user-plane packet forwarding for all subscribers served by that UPF. No public exploit is confirmed in the wild and CISA KEV does not list it, but an upstream fix (go-upf PR #97) exists and researcher-published analysis (5GCVulDB gist repository) is publicly linked; EPSS is low at 0.25%, consistent with the narrow exposure of PFCP/N4 interfaces rather than low technical severity.
Resource exhaustion in the MOOSDB HTTP server component of MOOS core-moos through 10.4.0 allows unauthenticated remote attackers to render MOOSDB unavailable by opening many simultaneous connections and sending unbounded HTTP header data. Source code analysis confirms the pre-patch implementation in CMOOSDBHTTPServer and CHTTPConnection imposed no limits on concurrent connections, header line count, per-line byte size, or per-connection read timeouts - all four controls were absent. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires no authentication or special tooling and is trivially automatable.
Unbounded memory consumption in MOOS-IvP pMarineViewer through version 24.8.1 allows unauthenticated network attackers to exhaust the operator display process by flooding it with NODE_REPORT messages carrying arbitrary distinct node names. The ContactLedger class allocates a new tracking entry for every unique vessel name it encounters without enforcing any cap, making the ledger - and everything that iterates it - grow without limit. The result is a stalled or crashed operator situational-awareness display, which is operationally significant in autonomous maritime missions. No public exploit has been identified at time of analysis; an upstream fix capping contacts at 200 has been merged but a tagged release version has not been independently confirmed.
Unbounded resource allocation in MOOS-IvP uFldShoreBroker through 24.8.1 allows a remote unauthenticated attacker to exhaust the shore broker process's memory and degrade per-iteration CPU performance by sending NODE_BROKER_PING messages with an unlimited number of distinct community names. Each unique community name causes entries to be appended across six parallel in-memory vectors with no eviction policy and no enrollment ceiling, creating unbounded O(n) per-pass overhead. Sustained delivery crashes or disables the shore broker, severing coordination between shore-side operators and autonomous marine vehicles. No public exploit has been identified at time of analysis.
Unauthenticated remote resource exhaustion in MOOS-IvP pRealm through version 24.8.1 allows any network-reachable attacker to register unlimited long-lived REALMCAST_REQ subscriptions with arbitrarily large variable lists, causing the pRealm process to serialize and publish excessive output on every scheduling interval until system resources are exhausted. The vulnerability stems from three absent input limits: no cap on subscription duration, no cap on variable count per subscription, and no ceiling on concurrent pipeway registrations. The fix, confirmed by PR #132 and commit 8a4bb9d9, introduces hard limits of 3600 seconds duration, 64 variables per request, and 64 total concurrent pipeways. No public exploit or KEV listing has been identified at time of analysis.
Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system memory by sending crafted mux packets with arbitrarily large declared packet counts to the Demuxer::addMuxPacket() function. The demultiplexer trusts the integer value in the mux header without a ceiling, causing the process to reserve memory for each declared packet slot. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed by CISA KEV.
Denial-of-service in MOOS core-moos through 10.4.0 allows any unauthenticated network peer to permanently freeze the MOOSDB accept thread by opening a TCP connection to the MOOSDB port and sending no data during the wire-protocol handshake. Because the accept thread executes a blocking receive without any timeout while holding the socket-list lock, a single stalled connection prevents all subsequent MOOS clients from registering, effectively rendering the publish-subscribe middleware inoperable. No public exploit code or active exploitation has been identified; however, the attack requires only a single TCP connection and no credentials, making it trivially automatable against any exposed MOOSDB instance.
Uncontrolled memory allocation in MOOS core-moos through 10.4.0 exposes MOOSDB servers to pre-authentication denial of service. The CMOOSCommPkt::OnBytesWritten() function reads the packet length field directly from untrusted wire data and passes it without any upper-bound check to new unsigned char[], allowing unbounded heap allocation before any client authentication handshake occurs. An unauthenticated network attacker can craft packets with arbitrarily large declared lengths to exhaust server memory and crash the MOOSDB process; no public exploit has been identified at time of analysis, and an upstream patch is available via GitHub commit e7ea624.
Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge process by sending a single crafted UDP datagram containing a negative declared packet length. The root cause is a signed-to-unsigned type confusion in CMOOSUDPLink::ReadPktFromArray(): a negative nRqd value passes a signed bounds check unchanged, then is silently cast to a near-SIZE_MAX size_t when passed to memcpy, writing far beyond the destination heap buffer. No public exploit has been identified at time of analysis, but the attack primitive requires only network access to the UDP listen port and a small crafted payload; the upstream fix is available as a GitHub patch commit.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Use-after-free in Skia, Chrome's 2D graphics rendering engine, allows remote attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.82 across desktop platforms. The sandbox confinement means this vulnerability alone does not yield full system compromise - a chained sandbox escape would be required for that - but the renderer-process code execution is rated high impact by Chromium's internal severity team. No public exploit or CISA KEV listing is present at time of analysis; SSVC labels exploitation as none and the attack as non-automatable due to the required user interaction.
Remote code execution in Google Chrome's DevTools component before 152.0.7977.82 lets a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and carries a CVSS 9.6 with scope change, reflecting sandbox escape. Google has shipped a fix; per CISA's SSVC assessment there is no evidence of active exploitation and no public exploit identified at time of analysis.
Use-after-free in Chrome's Compositing component (versions prior to 152.0.7977.82) enables a sandbox escape when chained with a renderer-process compromise - an attacker who has already gained control of the renderer can corrupt memory in the Compositing layer and execute arbitrary code outside Chrome's sandbox boundary on the host operating system. The CVSS S:C (scope changed) metric confirms this is a privilege-escalation-across-boundary primitive, delivering full C:H/I:H/A:H impact against the underlying OS. A vendor patch is available in Chrome 152.0.7977.82, and no public exploit has been identified at time of analysis.
Uncontrolled resource consumption in the Migrate Guru - Site Migration & Cloning WordPress plugin (versions 6.65 and earlier) exposes any WordPress installation running the plugin to remote denial of service by unauthenticated network attackers. The root cause (CWE-770) indicates that one or more plugin endpoints perform resource-intensive operations without adequate rate limiting or throttling, allowing an attacker to exhaust server capacity without supplying credentials. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated denial of service in MalCare Security WordPress plugin versions 6.69 and earlier allows any remote attacker with no credentials to exhaust server resources and take down affected WordPress sites. The vulnerability, rooted in CWE-770 (resource allocation without throttling), exposes a network-accessible plugin endpoint that can be abused to render the site unavailable. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward target for automated abuse.
Persistent denial of service in MISP's event template subsystem allows an authenticated user with event-template write permissions to store malformed JSON as a template definition by bypassing semantic validation. When any authenticated user subsequently loads the event template index - an endpoint accessible to all authenticated users - an unhandled exception in afterFind() causes HTTP 500 errors instance-wide until an administrator manually repairs the offending database row. The patch enforces strict array-only validation on save and adds exception handling on retrieval with graceful degradation to an empty definition.
Process-terminating denial of service in libmongocrypt's decryption path allows a low-privileged attacker to crash applications using MongoDB Client-Side Field Level Encryption (CSFLE). Tracked as MONGOCRYPT-971, the vulnerability is triggered when an unexpected-size encrypted value reaches the decryption routine, firing a reachable assertion (CWE-617) that abruptly terminates the host process rather than returning a handled error. An attacker who can store crafted encrypted values in a shared MongoDB collection, or influence the encrypted data an application receives, can repeatably crash the targeted application.
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the vhr open-source HR management system allows any authenticated user to overwrite arbitrary HR profiles - including administrator accounts - via the PUT /hr/info endpoint by supplying a victim's profile ID in the request body. The flaw stems from a complete absence of object-level authorization in HrInfoController.java: the server updates whichever record ID is provided without verifying the requester owns or has permission to modify it. Beyond profile data manipulation, an attacker can disable administrator accounts, effectively causing a denial-of-service against system administration functions. No vendor-released patch has been identified at time of analysis.
NULL pointer dereference in GStreamer's RTSP support library (gst-plugins-base) crashes any process that parses a Digest authentication header containing specially crafted whitespace, resulting in a denial-of-service condition. The flaw is bidirectional: an unauthenticated remote attacker can crash an RTSP server by sending a single malformed request when Digest authentication is enabled, and a malicious or compromised RTSP server can crash an RTSP client using the same technique. No confidentiality or integrity impact is confirmed; the sole consequence is process termination. No public exploit code or CISA KEV listing has been identified at time of analysis.
NULL pointer dereference in the Linux kernel's psxpad-spi driver crashes the kernel when system suspend is triggered on hardware using SPI-connected PlayStation controllers. The probe() function in drivers/input/joystick/psxpad-spi.c omits the spi_set_drvdata() call that stores per-device state, so psxpad_spi_suspend() unconditionally dereferences a NULL pointer on suspend entry, causing a kernel panic. Patches are available across all active stable kernel branches (5.10 through 7.2); EPSS is 0.21% and no active exploitation has been identified.
Out-of-bounds memory read in the Linux kernel's DRM HDMI connector subsystem allows a local, low-privileged user to potentially leak up to 32 bytes of adjacent kernel heap memory or trigger a page fault leading to kernel crash. The flaw exists in a helper function that copies audio infoframe data using the destination buffer size (60 bytes) rather than the source structure size (28 bytes), reading 32 bytes beyond the source allocation. No public exploit code exists, and EPSS sits at the 10th percentile; however, the availability impact is real - the overread can cross a page boundary and cause an access violation.
Btrfs in the Linux kernel fails to reinitialize inode address-space mapping flags and minimum folio order when re-reading previously evicted cached inodes, causing a kernel assertion failure and system crash (denial of service). The defect surfaces only when btrfs is mounted with a block size larger than the host memory page size - a non-default but valid configuration - and manifests after a create/evict/re-read inode cycle. No public exploit code exists and EPSS is 0.20% (10th percentile), reflecting negligible real-world exploitation probability beyond accidental triggering.
Uncontrolled recursion in Amazon Ion-C before v1.1.6 allows a remote unauthenticated attacker to crash any application that parses untrusted Ion data using this library, causing a denial of service via native call stack exhaustion. The fix, released in v1.1.6 and titled 'Harden container depth,' confirms the root cause is missing or insufficient depth limiting on nested Ion container parsing. No authentication is required and no special configuration is needed beyond the application accepting Ion input from untrusted sources. No public exploit code has been identified at time of analysis.
Connection deadlock in golang.org/x/crypto/ssh (all versions before 0.56.0) allows a malicious remote SSH peer to permanently freeze an SSH connection by flooding the incomingRequests queue of a channel that has been registered in the mux's chanList but not yet established. The attack exploits the absence of any established-state guard in the packet handler, causing a deadlock that renders the entire connection unresponsive without triggering an explicit teardown. No public exploit has been identified and no CISA KEV listing exists, but the network-accessible, no-authentication CVSS vector makes this straightforward to trigger against any Go application using this library for SSH.
Denial-of-service in the Go extended cryptography library's SSH package allows a malicious peer to deadlock an entire SSH connection by sending crafted RFC 4254 channel messages after a channel is established. All versions of golang.org/x/crypto/ssh below 0.56.0 are affected; the flaw manifests because unrecognized channel messages were buffered and allowed to block rather than being rejected as protocol errors. No public exploit or active exploitation has been identified, but the attack requires no privileges in the worst-case client scenario where a malicious SSH server targets a connecting client.
BEAM atom table exhaustion in Boruta Server prior to 0.10.0 allows any authenticated end user to crash the entire OAuth 2.0/OpenID Connect umbrella application by repeatedly submitting PUT /users/settings requests with arbitrary novel body keys. The UserSettingsController calls String.to_atom/1 on all user-supplied map keys before any validation, permanently interning them in the Erlang VM's global atom table (hard cap: 1,048,576 entries). Once exhausted, the BEAM runtime aborts with 'no more index entries in atom_tab', taking down the auth, admin, and gateway components simultaneously. No public exploit identified at time of analysis, and the issue has been patched in version 0.10.0.
Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. Depending on the downstream dependency tree, exploitable outcomes range from reliable denial of service to remote code execution via prototype-pollution gadget chains; no public exploit or active exploitation is confirmed at time of analysis.
Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. Exploitation is gated on a non-default configuration - Web Access must be explicitly enabled on devices registered to Cisco Unified Communications Manager - materially limiting real-world attack surface despite the network-accessible vector. No public exploit code and no CISA KEV listing were identified at time of analysis.
Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an unauthenticated attacker run code as root by connecting to TCP ports 43210 and 43211, which are exposed by default in the Layer 3 default VRF. Crafted input to the S1HAL process is executed with root privileges, and the same flaw can crash S1HAL to force a device reload (denial of service). Rated CVSS 9.8; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-authentication, network-facing nature makes it a top-priority patch.
NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching.
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.
Unauthenticated remote denial of service in Libreswan's pluto IKE daemon allows any network attacker to repeatedly crash and restart the VPN service by sending a malformed X.509 certificate in a CERT payload during IKE handshake negotiation. The crash is triggered by a reachable assertion in `add_decoded_cert()`: when NSS's `CERT_ExtractPublicKey()` receives a certificate with an invalid RSA exponent (e.g., zero), it returns NULL, which the FIPS-mode code path does not handle, causing the daemon to abort. The vendor explicitly confirms no remote code execution is possible; impact is limited to availability. No CISA KEV listing and no public exploit code have been identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the Shared Tab Groups feature (CWE-416). A remote attacker who lures a victim into visiting a crafted HTML page can corrupt freed memory to execute arbitrary code outside the renderer sandbox. Chromium rates the severity Critical (CVSS 9.6); the vendor has shipped a fix, but no public exploit has been identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the WebGL implementation, letting a remote attacker who lures a victim to a crafted HTML page execute arbitrary code OUTSIDE the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector; a vendor patch shipped in the September 2026 Stable channel update. No public exploit identified at time of analysis, though the tracker bug (issues.chromium.org/546260492) and Google's own reporting indicate the flaw is well characterized.
Use-after-free in Chrome's TabStrip component enables remote code execution outside the renderer sandbox in Google Chrome versions prior to 152.0.7977.75. An attacker must social-engineer a user into a specific UI interaction to trigger the memory-corruption primitive, after which arbitrary code executes at browser-process privilege - a full sandbox escape. Google has issued a stable channel patch; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in Google Chrome's Browser process prior to version 152.0.7977.75 enables sandbox escape, allowing an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. The CVSS vector (AV:N/AC:H/S:C/C:H/I:H/A:H) reflects both the network-reachable delivery and the scope change from renderer to host-level execution. No public exploit or CISA KEV listing has been identified at time of analysis, but sandbox-escape primitives of this class are highly valued in exploit chains.
Remote code execution inside Chrome's sandbox is achievable via a use-after-free in WebRTC, triggered when a victim visits a specially crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75 across desktop platforms. No public exploit code or CISA KEV listing has been identified at time of analysis, though the sandboxed execution boundary limits the practical impact compared to the raw CVSS 8.8 score - Google's own Chromium severity rating of 'Medium' reflects this containment.
Remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in Dawn, Chrome's WebGPU/GPU graphics abstraction layer, and - per Google's advisory - allows a crafted HTML page to execute arbitrary code outside the renderer sandbox. Exploitation only requires an unauthenticated victim to visit a malicious page, giving the attacker high-impact code execution on the device. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, though the sandbox-escape framing makes it a high-priority browser patch.
Remote code execution in Google Chrome desktop before 152.0.7977.75 stems from a use-after-free in the Proxy component that a remote attacker can trigger with crafted network traffic to run arbitrary code OUTSIDE the browser sandbox. Google rates the Chromium severity High and a patched Stable channel build is available; no public exploit code has been identified at time of analysis. Because the flaw yields a sandbox escape rather than a contained renderer bug, successful exploitation gives attacker-controlled code on the host at browser-process privilege.
Unbounded recursion in Net::DNS before 1.57 for Perl allows a remote unauthenticated attacker to exhaust memory and terminate any DNS forwarder or proxy process by sending a crafted DNS message carrying a TSIG record misplaced in the answer or authority section with an empty MAC field. Because the library's decoder does not drop the malformed packet as RFC 8945 section 5.2 requires, the TSIG survives the re-encoding strip step and drives `sig_data` into infinite recursion; payloads under 100 bytes on the wire are sufficient to crash the process. No public exploit has been identified at time of analysis, and EPSS indicates low current exploitation probability (0.17%), though the trivially small payload and zero-authentication requirement make this an operational priority for any Perl-based DNS forwarder or proxy deployment.
Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's `maxTotalMergeKeys` safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (`<<`) processing is enabled by default on both release lines. No confirmed active exploitation appears in CISA KEV at time of analysis, but the attack is trivially reproducible from the published advisory and pathological test case, and the library's ubiquity in the npm ecosystem makes this a high-priority availability risk.
Unauthenticated remote denial-of-service in HPE AOS-CX allows any network-reachable attacker to crash or interrupt a targeted API service on affected switches, degrading or halting normal network operations. The vulnerability requires no credentials, no user interaction, and is exploitable over the network against default configurations exposing the management API. This CVE is part of HPE Security Bulletin HPESBNW05134, which also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749) and a CVSS 7.2 authenticated command injection (CVE-2026-73766) in the same platform; no public exploit has been identified at time of analysis.
Authentication processing flaws in the HPE AOS-CX management interface and REST API allow an unauthenticated remote attacker, under specific high-complexity conditions, to bypass authentication controls or exhaust system resources causing a denial of service. Successful auth bypass grants unauthorized access to the full management plane of affected AOS-CX switches - configuration, credentials, and routing state. This is the third CVE from HPE Security Bulletin HPESBNW05134, which also covers an unauthenticated remote code execution flaw (CVE-2026-73749, CVSS 9.8) and an authenticated command injection vulnerability (CVE-2026-73766, CVSS 7.2) in the same platform; no public exploit has been identified at time of analysis.
Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.
Memory exhaustion in gRPC-Go before version 1.83.1 allows an unauthenticated remote attacker to crash any service built on this library by sending HTTP/2 streams fragmented into millions of tiny one-byte DATA frames. Each fragment is stored as a separate recvMsg object in recvBuffer, creating severe heap overhead that bypasses HTTP/2 flow-control protections - which limit payload bytes, not the number of allocated metadata objects. No public exploit has been identified at time of analysis, but the attack is fully derivable from the public GitHub advisory and PR diff.
Worker process exhaustion in Erlang/OTP's inets httpd enables unauthenticated remote denial of service by exploiting a bare-catch error-handling flaw in the chunked transfer-encoding decoder, permanently consuming HTTP worker processes until the pool is exhausted and the server becomes unresponsive to legitimate clients. The defect lies in httpd_request_handler:handle_info/2, where a throw exception raised by an invalid chunk-size is silently coerced into a normal return tuple rather than propagated as an error, leaving the worker suspended indefinitely with the request timeout already cancelled and no default byte-rate watchdog to reclaim it. Affected OTP versions span three active release lines (27.x, 28.x, 29.x) in their default configurations; no public exploit is confirmed, though the fix commit includes a regression test that is functionally equivalent to a proof-of-concept attack.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event loop by submitting a small crafted XML document containing a malformed end tag. The SAX parser in lib/sax.js uses an unanchored global regex /[ \t\n\r]+$/g to trim end-tag names; a tag with N whitespace characters followed by one non-whitespace character causes the engine to retry the match from every character position with O(N) backtracking per position, yielding O(N²) total work that blocks the single-threaded event loop. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 4.0 score of 8.7 with VA:H and PR:N reflects the severity of unauthenticated, network-reachable availability impact.
Erlang/OTP's inets HTTP server (httpd) fails to enforce an administrator-configured request body-size limit when processing chunked transfer-encoded requests, enabling unauthenticated remote attackers to exhaust server memory and cause denial of service. Affected OTP branches span 17.x through 27.3.4.16, 28.x through 28.5.0.5, and 29.x through 29.0.5, covering inets versions 5.10 through 9.7.1. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, but the zero-authentication, low-complexity network attack path makes this an operationally straightforward DoS risk for any deployment exposing inets httpd to untrusted clients.
Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js process heap by sending a compact, crafted XML document with repeated namespace prefix declarations. The unmaintained legacy `xmldom` package (versions 0.1.5-0.6.0) has no available fix, while `@xmldom/xmldom` is patched in releases 0.8.15 and 0.9.12. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the attack is trivially automatable against any application that parses untrusted XML with this library.
Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The `@xmldom/xmldom` package before versions 0.8.15 and 0.9.12, and all versions of the legacy `xmldom` package (0.3.0-0.6.0), expose both paths through the default `DOMParser.parseFromString()` interface, requiring no authentication or special configuration. No public exploit has been identified at time of analysis, but the security advisories and fix commits are publicly available on GitHub.
Unbounded memory exhaustion in the Erlang/OTP inets httpc HTTP client allows any server the client connects to - including via redirect or man-in-the-middle - to crash the BEAM VM by returning an arbitrarily large volume of response headers. The root cause is that max_header_size defaults to the atom nolimit and the header accumulation loop in httpc_response:parse_headers/6 collects all header data into an in-process list before any size check fires. A proof-of-concept server delivering 100,000 headers of ~4,000 bytes each consumed over 13 GB of RAM in under 30 seconds; no public exploit code has been separately released but the PoC is embedded in the official advisory, and vendor patches are available for OTP 27, 28, and 29 branches.