Denial Of Service
Monthly
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to crash or indefinitely hang affected instances across four active release branches via crafted TCP communication. The attack requires no user interaction and only low privileges, making it a realistic and automatable threat for any enterprise environment where Coherence cluster ports are reachable by authenticated or low-privileged users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Oracle's own assessment rates this as network-accessible with low complexity.
Partial denial-of-service in Oracle Coherence 15.1.1.0.0 (Core component) allows a low-privileged attacker with TCP network access to intermittently degrade availability of the in-memory data grid. The CVSS 3.1 score of 4.3 reflects constrained impact - confidentiality and integrity are unaffected, and no complete service outage is possible. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; Oracle addressed this vulnerability in the July 2026 Critical Patch Update.
Denial-of-service and partial data integrity compromise in Oracle Coherence's Core component allows unauthenticated network attackers to hang or crash the service or manipulate a subset of accessible data via HTTP. Affected are three actively supported versions - 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - spanning the current Oracle Fusion Middleware release train. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the zero-confidentiality-impact, high-availability-impact profile is consistent with a resource exhaustion or malformed-request crash class of flaw that may attract opportunistic targeting of exposed Coherence cluster endpoints.
Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.
Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin allows a high-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing exist at time of analysis; the high attack complexity and high privilege requirement substantially limit real-world exploitation reach.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause a complete hang or frequently repeatable crash of the database server. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the combination of high attack complexity and high privilege requirements substantially limits realistic exploitation risk.
Denial-of-service in MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-based attacker to cause a repeatable server hang or crash under difficult-to-reproduce conditions. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47 and the same 8.4/9.7 ranges, with Oracle issuing a fix via the July 2026 Critical Patch Update. No public exploit has been identified and this CVE is not listed in CISA KEV, but the broad version coverage across active MySQL release trains warrants timely patching for environments running MySQL replication.
Denial-of-service exploitation in Oracle MySQL Server and MySQL Cluster via the Clone Plugin allows a high-privileged, network-connected attacker to cause a complete hang or repeatedly repeatable crash of the database server. Affected version ranges span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed in Oracle's July 2026 Critical Patch Update. No public exploit or active exploitation has been identified; attack complexity is high and requires pre-existing high database privileges, significantly constraining real-world risk to insider or post-breach scenarios.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Clone Plugin allows a high-privileged, network-connected attacker to crash or hang the database server through a difficult-to-exploit attack path. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and Oracle disclosed this via its July 2026 Critical Patch Update; exploitation would result in complete availability loss for the targeted database instance.
Denial-of-service via the Optimizer component in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-authenticated attacker to cause a complete, repeatable hang or crash of the database service. The flaw is network-reachable over multiple protocols and requires no user interaction, making it straightforward to trigger by any user holding even minimal database credentials. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this in the Critical Patch Update for July 2026.
Oracle MySQL Cluster's Server: Optimizer component in versions 8.0.0 through 8.0.47 can be exploited by a high-privileged remote attacker to cause a complete denial of service via repeated hang or crash of the cluster. Oracle disclosed and patched this in the July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation has been identified at time of analysis, and CISA KEV listing is absent.
Oracle VM VirtualBox 7.2.12 contains a Core component vulnerability exploitable by high-privileged local attackers that produces a scope change, potentially compromising systems beyond VirtualBox itself. Successful exploitation yields complete confidentiality loss of all VirtualBox-accessible data and a partial denial of service, making this an isolation-breach risk in multi-tenant or shared virtualization environments. No public exploit identified at time of analysis, and the AC:H rating signals difficult exploitation, but the scope change (S:C) elevates real-world concern for environments where VirtualBox hosts sensitive guest workloads.
Oracle VM VirtualBox 7.2.12 on the host infrastructure is vulnerable to a local denial-of-service and limited data integrity attack requiring human interaction from a third party. An attacker with logon access to the host - but no specific privileges on VirtualBox - can trigger a complete hang or repeated crash of the hypervisor, plus unauthorized modification of a subset of accessible VM data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low complexity and no-privileges-required local vector make this straightforward to execute once host access is obtained.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local attacker, under high-complexity conditions, to break VM isolation boundaries and compromise data integrity of the hypervisor and potentially adjacent systems. Successful exploitation can result in unauthorized creation, deletion, or modification of critical VirtualBox-accessible data, along with partial denial of service. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis, but the scope change (S:C) elevates priority in multi-tenant or shared-host VirtualBox deployments where VM boundary integrity is a security guarantee.
Oracle Workflow's Notification Mailer component within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) contains a locally-exploitable flaw that enables a low-privileged attacker with infrastructure logon access to partially corrupt workflow data and degrade service availability. The CVSS score of 3.6 reflects the real-world difficulty: local access is mandatory, attack complexity is rated High, and no confidentiality exposure exists. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, making this a low-priority operational finding relative to typical enterprise vulnerability backlogs.
Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Local exploitation of the Core component in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker to perform unauthorized creation, deletion, or modification of critical VirtualBox data and cause a partial denial of service - provided a second user's interaction can be induced. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), classifying it as easily exploitable under those local conditions. No public exploit code or active exploitation has been identified at time of analysis, and the mandatory human-interaction requirement (UI:R) materially constrains unassisted or automated attacks.
Denial-of-service vulnerability in Oracle MySQL Server and MySQL Cluster's InnoDB storage engine component allows high-privileged network-authenticated attackers to cause a complete, frequently repeatable crash or hang of the database server. Affected deployments span MySQL Server 8.4.x and 9.7.x, as well as MySQL Cluster 8.0.x through 9.7.x, making this a broad cross-version exposure within Oracle's primary database products. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high privilege requirement substantially narrows the real-world attacker population.
Local denial-of-service in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker with local logon access to the host system to repeatedly crash or hang the VirtualBox process, rendering the hypervisor unavailable. The flaw resides in the Core component and requires no user interaction once the attacker has a local session on the infrastructure host. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to availability - confidentiality and integrity are unaffected.
Oracle VM VirtualBox 7.2.12 Core component allows a high-privileged local attacker to cause a complete denial-of-service by crashing or hanging the hypervisor, with a scope change indicating the impact can extend beyond the primary VirtualBox process to affect additional products on the same infrastructure. The vulnerability is confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code or active exploitation has been identified at time of analysis.
Partial availability disruption in Oracle Siebel CRM End User (Redwood UI component, versions 24.4 through 26.3) can be triggered by a highly privileged network attacker over HTTP under difficult exploitation conditions that also require victim interaction, potentially causing cascading availability degradation in interconnected systems due to a confirmed scope change. The CVSS 3.1 base score of 2.6 (Low) reflects the extremely restrictive prerequisite chain - high privileges, user interaction, and high attack complexity must all align. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt availability across a broad range of supported versions, including the current releases 25.0.3 and 26.0.1. The attack surface is unusually wide: exploitation is possible through any protocol supported by the JVM, via APIs exposed in the Libraries component, through web services that internally invoke those APIs, and through the sandboxed Java Web Start or applet execution path when loading untrusted code. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivial exploitation conditions (AC:L/PR:N/UI:N) and the ubiquity of Java deployments elevate realistic risk beyond the moderate CVSS score alone.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause repeated crashes or indefinite hangs across affected 8.0, 8.4, and 9.7 release branches. Exploitation is straightforward (AC:L) but gated entirely by the requirement for high database privileges, substantially narrowing the realistic threat population. No public exploit identified at time of analysis and no CISA KEV listing; risk is most acute in replication-dependent high-availability clusters where availability SLAs are critical.
Local partial denial-of-service in Oracle GoldenGate Stream Analytics 26.1.0.0.0 allows a low-privileged attacker with logon access to the host infrastructure to degrade availability of the analytics service. The vulnerability resides in the Security component and requires no user interaction once local access is established. No public exploit code has been identified at time of analysis, and the low CVSS score of 3.3 reflects a limited, non-critical impact confined to availability.
Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to disrupt service availability with no authentication and low attack complexity. Affected releases span a broad range including Java SE 8u491 through 26.0.1, GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18 - covering virtually every supported Java SE release as of the July 2026 CPU. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though Oracle characterizes the vulnerability as 'easily exploitable', indicating automated exploitation is plausible.
Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated attackers across multiple network protocols, confirmed by Oracle's Critical Patch Update for July 2026. The vulnerability manifests in two distinct deployment contexts: server-side web services that pass externally supplied data to JavaFX APIs, and client-side sandboxed environments (Java Web Start applications or Java applets) that load and execute untrusted internet code. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; however, the low-complexity, no-authentication-required attack surface makes exploitation straightforward should a proof-of-concept emerge.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Optimizer component allows a high-privileged, network-connected attacker to crash or hang the database server. Affected products span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; the high privilege and high complexity requirements materially constrain real-world risk.
Denial-of-service in Oracle MySQL Server and MySQL Cluster versions 9.7.0-9.7.1 allows a high-privileged, network-adjacent attacker to repeatedly hang or crash the InnoDB storage engine via multiple supported protocols. The CVSS 3.1 score of 4.9 reflects the PR:H prerequisite, which significantly limits the exploitable population to authenticated database administrators or equivalently privileged accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.
Divide-by-zero in Zephyr's DesignWare SPI driver exposes kernel crash to locally-authorized userspace threads on all releases through v4.4.0. The spi_transceive syscall verify handler in spi_handlers.c copies the caller-supplied spi_config from userspace without validating the frequency field, allowing a thread with SPI device object access to pass frequency=0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(), which raises a CPU exception on Cortex-M Mainline and ARC platforms and halts the system. No public exploit has been identified at time of analysis; exploitation is gated behind a non-default build configuration and explicit privilege grant.
Kernel heap exhaustion in Zephyr RTOS affects all builds with CONFIG_USERSPACE enabled from v1.12.0 through v4.4.1, allowing any low-privilege user thread to permanently leak kernel memory by supplying a forged object handle to k_poll(). The z_vrfy_k_poll() syscall verifier allocates a kernel-side event copy but, prior to the fix, killed the calling thread via K_OOPS without freeing that buffer - a path any user thread can trigger repeatedly. By spawning additional threads that inherit the parent's resource_pool, an attacker can multiply the leak rate until the shared kernel heap is depleted, causing system-wide denial of service affecting queues, message buffers, and all future k_poll calls. No public exploit code or CISA KEV listing has been identified at time of analysis.
Zephyr RTOS Bluetooth Mesh PB-ADV provisioning can be permanently denied on any affected device within BLE advertising range by an unauthenticated remote attacker exploiting a timer-reset logic flaw in subsys/bluetooth/mesh/pb_adv.c. The watchdog timer governing protocol timeouts was rescheduled unconditionally before validity checks, allowing an attacker to hold a dead provisioning link open indefinitely by sending FCS-valid PDUs faster than the 60-120 second timeout interval. The device's unprovisioned beacon is suppressed and all new Link Open requests are rejected for as long as the attacker transmits, rendering the device permanently un-provisionable without a reboot. No public exploit is identified and the vulnerability is not listed in CISA KEV, though the attack requires no authentication and low complexity to execute from within BLE range.
Persistent denial of service in the NXP LPUART serial driver for Zephyr RTOS allows an unprivileged userspace thread to deterministically crash the entire embedded system by issuing a uart_configure() call with an unsupported parameter value while CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled. The driver's configure path calls LPUART_Deinit() before validating the requested configuration, gating the peripheral clock; if validation then rejects the parameters, the clock is never restored, and any subsequent LPUART register access - from any thread or interrupt handler - triggers a hard fault and system reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fault path is trivially and deterministically reproducible from userspace on affected NXP MCU targets.
Remote denial-of-service in Gitea versions prior to 1.27.0 allows any authenticated user to crash the server by exploiting an O(N²) string concatenation flaw in the RFC 4716 SSH key parser. Submitting a single crafted SSH2 public key with hundreds of thousands of short content lines forces quadratic heap allocation that exhausts CPU and RAM within seconds, taking the entire Gitea instance offline. A functional, Docker-packaged proof-of-concept is publicly available per the Gitea security advisory; no active exploitation has been confirmed in CISA KEV, but the trivially low barrier - any valid user account suffices - elevates real-world risk considerably.
Node process termination in Elasticsearch allows a low-privileged authenticated user to crash any reachable cluster node with a single malformed search request. The vulnerability stems from a reachable assertion in the query parsing layer triggered by a null value in a specific query clause; because Elasticsearch treats assertion failures as fatal, the node process exits immediately. Single-node deployments lose service entirely; in clustered environments, each targeted node reduces available search capacity. No public exploit has been identified at time of analysis, and Elastic has released patched versions 8.19.19, 9.3.8, and 9.4.4 per advisory ESA-2026-64.
Null pointer dereference in Gitea's AddTime API (versions prior to 1.27.0) allows an authenticated repository administrator to crash the server by specifying a non-existent username in a time-tracking request. The root cause is a missing `return` statement in `routers/api/v1/repo/issue_tracked_time.go` after `GetUserByName()` returns an error, causing `AddTime()` to dereference a nil user pointer and trigger a Go runtime panic. No active exploitation is confirmed (not in CISA KEV), but a proof-of-concept is embedded in the GHSA advisory, making the issue trivially reproducible by any repository administrator.
Denial of service in Gitea's NPM package registry API allows any authenticated user to crash the entire server process with a single HTTP request by exploiting an unbounded `io.ReadAll()` call in the `AddPackageTag` handler. Gitea versions up to and including v1.26.2 are confirmed vulnerable, with the fix shipped in v1.27.0. Because self-registration is enabled by default, external unauthenticated attackers can register a free account and immediately exploit this to take down all Gitea-hosted services including repositories, CI/CD pipelines, and issue tracking; a detailed proof-of-concept with video evidence is publicly available in the advisory.
Kibana's Canvas functionality allows any authenticated low-privileged user to crash the Kibana server process via a specially crafted request, causing a complete denial of service for all users of the affected instance. The root cause is uncontrolled resource consumption (CWE-400 / CAPEC-130), where Canvas fails to bound server-side resource allocation when processing attacker-controlled input. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity once authenticated makes independent rediscovery plausible.
Denial of service in Gitea's Debian package registry (all versions before 1.27.0) lets any authenticated user with package write access crash the server with a single .deb upload. The parser's ParseControlFile decompresses control.tar.gz with no size limit and tees the entire stream into a strings.Builder, so an 83 MB payload expands to 16+ GB and exhausts memory; a companion O(N²) string concatenation on Description continuation lines can independently saturate a CPU core. A complete working proof-of-concept is published in the advisory, so publicly available exploit code exists, though there is no public exploit identified as used in active attacks and the issue is not in CISA KEV.
Gitea's Arch package registry allows authenticated users with package-publishing permissions to trigger severe resource amplification by uploading crafted `.pkg.tar.gz` archives containing large numbers of empty file entries. A 470 KB compressed archive can produce 4.5 MB of database-stored metadata and a repository index with 100,001 lines - approximately 45x amplification - affecting CPU, memory, database storage, and index generation. Publicly available exploit code exists (a complete Python POC is included in the advisory); no active exploitation is confirmed in CISA KEV. The vulnerability is patched in Gitea v1.27.0.
Heap exhaustion in Elasticsearch allows authenticated users holding search privileges to crash individual data nodes by submitting specially crafted search requests, degrading or taking down the cluster and requiring manual administrator intervention to restore service. Affected versions span the 8.x and 9.x release lines per vendor advisory ESA-2026-60, with fixes available in 8.19.15, 9.2.9, and 9.3.4 as inferred from the advisory URL. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low authentication barrier makes it a meaningful risk for multi-tenant or shared Elasticsearch deployments.
Denial of service in Elasticsearch allows a low-privileged authenticated user to crash an Elasticsearch node by submitting a specially crafted EQL sequence query against an index they control, triggering uncontrolled memory consumption (CWE-400, CAPEC-130). Affected across all tracked versions per CPE wildcard, with Elastic releasing fixes in versions 8.19.18, 9.3.7, and 9.4.4 per advisory ESA-2026-57. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad Elasticsearch deployment footprint make this a credible internal threat in multi-tenant or shared cluster environments.
Denial of service in Kibana's Entity Analytics feature allows authenticated users to render the application unavailable by submitting oversized input values to affected API endpoints. The root cause is CWE-770 - absent resource allocation limits on specific Entity Analytics endpoints - enabling a single crafted request to trigger excessive memory or CPU consumption disproportionate to normal operation. No public exploit code has been identified at time of analysis, and the PR:L authentication requirement constrains opportunistic exploitation to credentialed actors.
Denial of service in Docker BuildKit (moby/buildkit) allows a malicious or compromised client or frontend to crash the BuildKit daemon (buildkitd) by sending a specially crafted request that triggers an unhandled Go panic. The vulnerability affects all versions of moby/buildkit (CPE cpe:2.3:a:moby:buildkit:*). Any authenticated BuildKit client or frontend - including those operating in CI/CD pipelines, Kubernetes build nodes, or Docker Desktop environments - with network access to the daemon can exploit this to disrupt all concurrent and subsequent build operations. No public exploit is identified at time of analysis and the vulnerability has not been added to the CISA KEV catalog.
Out-of-bounds read in Qt's QTextCodec::codecForName() causes incorrect text codec selection or a process crash (denial of service) when the function is supplied a non-NUL-terminated QByteArray constructed via QByteArray::fromRawData(). Affected components span Qt Core (qtbase) in Qt 4.x and 5.x, and the Qt5Compat module in Qt 6.0.0 onward. No public exploit has been identified and no CISA KEV listing exists; real-world risk is confined to applications whose codec-selection paths are reachable from attacker-controlled input and that specifically construct raw, non-NUL-terminated byte arrays before passing them to this API.
Unbounded memory growth in libssh's SFTP client allows a malicious server to exhaust client-side memory by sending responses for unknown request IDs, resulting in a denial-of-service condition against any application using libssh for SFTP operations. Affected deployments include libssh as packaged in Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images. No public exploit code and no active exploitation have been identified at time of analysis; the CVSS score of 5.3 (Medium) reflects the limited availability impact and the requirement that a victim client connect to an attacker-controlled server.
Stack-based buffer overflow in rpcbind's rpcinfo client utility crashes the rpcinfo process when a user or administrator runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint. The flaw is in the `rpcbdump()` short-mode function, which writes version number data from a remote RPCBPROC_DUMP reply into a fixed-size stack buffer without bounds validation. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10 as well as OpenShift Container Platform 4; no public exploit has been identified and this vulnerability does not appear in the CISA KEV catalog, placing real-world urgency in the medium tier despite the network-accessible attack vector.
Signal misdelivery in libssh's ProxyCommand handling allows a low-privileged local user to trigger a local denial of service affecting their entire accessible process tree. When fork() fails during ProxyCommand execution, the error return value of -1 is stored unchecked as a child process ID; at cleanup, libssh signals PID -1, which Linux interprets as a broadcast to all processes the caller has permission to signal. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, but the CVSS scope-changed metric (S:C) confirms that impact extends beyond the libssh component itself to co-located user processes.
CPU exhaustion via malformed SSH channel negotiation in libssh allows an authenticated remote peer to cause indefinite server-side looping and denial of service. By advertising a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, the attacker forces subsequent channel writes into an infinite loop, fully consuming CPU on the affected host. This affects libssh as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images; no public exploit or CISA KEV listing has been identified at time of analysis.
Uncontrolled resource consumption in FreeScout's file upload endpoint allows any user to flood the server with upload requests, overloading the database and causing denial of service for all platform users on versions prior to 1.8.224. The root cause is the complete absence of rate limiting on the upload route - a low-complexity, network-accessible weakness requiring no special privileges per the CVSS vector. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial exploitation mechanics mean any motivated user can weaponize this without tooling.
NULL pointer dereference in NanoMQ 0.24.11 and earlier allows an authenticated REST API user to crash the entire broker process with a single malformed HTTP request. The `properties_parse()` function fails to validate that `user_properties` is a JSON object before iterating its elements, calling `strlen()` on a NULL pointer and causing a fatal segmentation fault. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; a vendor patch is available in version 0.24.14.
NULL pointer dereference in NanoMQ 0.24.11 and earlier allows a malicious MQTT broker to remotely crash any connecting NanoMQ MQTTv5 client - including bridge mode - with a single 35-byte crafted packet, triggering SIGSEGV and denial of service. The bug in mqtt_codec.c:1863 arises when a CONNECT packet carries will properties (will_prop != NULL) but no connect-level properties (prop == NULL); the code erroneously dereferences prop->next, reading from virtual address 0x38 (NULL plus struct field offset). No CISA KEV listing or public exploit is confirmed at time of analysis, but the minimal 35-byte trigger and auto-reconnect behavior in bridge mode can convert a single crash into a persistent DoS loop.
NULL pointer dereference in the Linux kernel's DualPI2 traffic scheduler crashes the kernel when GSO segmentation accounting mismatches occur under a QFQ parent queueing discipline. Systems running Linux kernels prior to 6.18.39, 7.1.4, or 7.2-rc1 with DualPI2 configured as a child of QFQ are vulnerable to a local denial-of-service via kernel panic. No public exploit code exists and EPSS is 0.15% (5th percentile), reflecting the niche configuration required; however, the availability impact is total (kernel crash) when conditions are met.
Incorrect error-path logic in the Linux kernel's i2c-i801 SMBus driver allows a local, low-privileged user to trigger a hardware state machine corruption leading to a system-wide hung task panic. When i801_check_pre() returns -EBUSY because the BIOS/ACPI firmware legitimately holds the SMBus controller, the driver unconditionally writes to SMBHSTSTS hardware registers without owning the controller, destroying the firmware's in-progress transaction and permanently corrupting the SMBus state machine. This produces an infinite 'SMBus is busy' error log flood, causes a console livelock that starves processes competing for mmap_lock, and ultimately triggers the hung task watchdog. No public exploit is identified at time of analysis; EPSS is 0.17% (6th percentile) and the vulnerability is not in CISA KEV.
Kernel panic via NULL dereference in the Linux kernel BPF subsystem affects systems compiled with CONFIG_BPF_LSM=y where the BPF LSM is not activated at boot. A locally authenticated user with low privileges can create a BPF_MAP_TYPE_INODE_STORAGE map under this misconfigured state, causing bpf_inode() to alias the struct rcu_head.func callback pointer; when map cleanup nulls this aliased pointer, rcu_do_batch() subsequently attempts an instruction fetch at address 0x0, triggering an immediate kernel panic and complete system denial of service. No public exploit is identified at time of analysis; EPSS sits at 0.14% (4th percentile), consistent with the narrow triggering conditions required.
NULL pointer dereference in the Linux kernel's team network driver (net/team/team_core.c) allows a local attacker with CAP_NET_ADMIN to crash the kernel by racing a mode change against concurrent packet transmission. The vulnerability arises because __team_change_mode() wipes team->ops via memset() before reinstalling safe dummy handlers, creating a window where team_xmit() running under RCU on a parallel CPU can invoke a NULL function pointer. No public exploit code exists and the issue is not listed in CISA KEV, but the availability impact is total (kernel panic), and the fix is present in upstream stable commits.
NULL pointer dereference in the Linux kernel XFS log recovery path allows a local attacker to crash the kernel by mounting a crafted XFS filesystem image. The flaw exists in xlog_recover_reorder_trans() at fs/xfs/xfs_log_recover.c:1836, where a committed log transaction containing zero regions leaves ri_buf NULL, causing a fatal dereference when ITEM_TYPE() is called during recovery. EPSS is 0.16% (5th percentile) and no active exploitation has been observed; the vulnerability was discovered through an AI-assisted code audit, not in-the-wild activity.
Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory (IFD) index values before passing them to libexif, enabling a crash via null pointer dereference when a crafted image with an out-of-range IFD tag group index is processed. All platforms running libvips through its EXIF parsing path are affected, including downstream consumers such as Node.js sharp and other language bindings that link against libvips. No public exploit has been identified and active exploitation is not confirmed, but the fix is publicly visible and the crash condition is straightforward to reproduce.
Stack-based buffer overflow in the rpcinfo client utility (part of the rpcbind package) crashes the client process when querying a malicious or compromised rpcbind server using the `-l` flag. Address data returned by the server is copied into a fixed-size stack buffer without bounds validation (CWE-121), enabling a server-side attacker to trigger a denial of service against any administrator or script that runs `rpcinfo -l` against their controlled endpoint. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to client-side availability with no confidentiality or integrity exposure.
Denial of service in SurrealDB's embedded JavaScript scripting engine allows any query-executing user - including unauthenticated guests when guest access is enabled alongside scripting - to immediately crash the server process by passing an oversized string to the QuickJS-NG v0.8 runtime for compilation, triggering a null pointer dereference. The crash requires a manual operator restart with no graceful shutdown, and cannot be leveraged for code execution or data compromise. The attack is constrained to instances where the non-default `--allow-scripting` capability is active; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Pre-authentication memory amplification in SurrealDB before 3.1.0 allows unauthenticated network attackers to exhaust server memory by streaming oversized WebSocket frames to the /sql endpoint, which fails to enforce the operator-configured SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit before buffering incoming bytes. The /sql WebSocket upgrade handler accepts anonymous connections and accumulates up to 16 MiB per frame and 64 MiB per reassembled message in per-connection read buffers - the full WebSocket library default - before the authentication check (check_anon) can reject the payload, meaning memory cost is incurred regardless of whether the caller holds any SurrealQL permissions. No public exploit has been identified at time of analysis, but the unauthenticated network-accessible attack surface requires no special prerequisites beyond network connectivity and sustained bandwidth.
Denial of service in SurrealDB's SurrealML header parser allows an authenticated Owner-role user to crash the entire server process by uploading a malformed .surml file to the /ml/import endpoint. Non-numeric input-dimensions or other invalid header fields trigger unchecked Rust unwrap() calls, causing a process-aborting panic that denies service to all databases hosted on the affected instance simultaneously. No public exploit code has been identified at time of analysis; vendor-released patch is available in SurrealDB 3.2.0.
Resource exhaustion in GLib's GDBus authentication component allows attackers to crash or hang processes by sending unbounded data streams before authentication completes. The `gdbusauth` handler reads lines from connecting clients without enforcing any maximum length, meaning an attacker who can reach a GDBus endpoint can force the target process to allocate unbounded memory and saturate CPU cycles. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the unbounded allocation primitive (CWE-770) in a widely-deployed system library warrants attention from Red Hat and GNOME ecosystem consumers.
Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3, where a low-privileged remote attacker can submit a container image containing malformed APK package-database data to trigger an out-of-bounds read (CWE-125) that panics the Go scanner. If the panic is not recovered, the Clair indexer process crashes, interrupting container vulnerability scanning workflows. No public exploit code exists and this CVE is not listed in the CISA KEV catalog, placing this at moderate priority despite network reachability.
HAProxy Community Edition 3.2.x and 3.3.x contains a varint mishandling defect that allows remote network clients to trigger an infinite loop or process crash, resulting in denial of service. The flaw affects Community Edition 3.2.x before 3.2.12 and 3.3.x before 3.3.3, and is explicitly confirmed to also affect HAProxy Enterprise and ALOHA commercial distributions. No public exploit has been identified and CISA has not listed this in KEV; however, HAProxy's role as a critical network gateway in many enterprise environments elevates the operational impact of even a Low-severity availability disruption.
NULL pointer dereference in the Linux kernel's EFI runtime subsystem crashes affected systems when ACPI Platform Runtime Mechanism (PRM) handlers are invoked during early boot before the EFI runtime workqueue has been allocated. Systems with EFI PRM-capable firmware running unpatched kernels between the introduction of commit 5894cf571e14 and the respective stable-branch fixes are affected. No public exploit or CISA KEV listing exists; the vulnerability manifests as a kernel panic during initialization on susceptible hardware, resulting in a denial of service.
NULL pointer dereference in the Linux kernel's SPI QUP (Qualcomm Universal Peripheral) driver causes a local denial-of-service condition affecting Qualcomm SoC-based Linux systems. When DMA setup fails during driver probe, the fallback to PIO mode leaves DMA channel pointers in a stale error state rather than clearing them to NULL; a subsequent probe failure or driver unbind then dereferences those error pointers, triggering a kernel panic. Patches are available across all active stable branches (5.10.259, 5.15.210, 6.1.176, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1); no public exploit has been identified and EPSS is at the 6th percentile, indicating negligible exploitation probability at this time.
Error pointer dereference in the Linux kernel ep93xx SPI driver causes kernel panic (denial of service) under specific driver lifecycle conditions on Cirrus Logic EP93xx ARM SoC hardware. When DMA channel setup fails during driver probe and falls back to PIO mode, the driver fails to clear the DMA channel pointers; any subsequent probe error or driver unbind then dereferences those stale error pointers, triggering a kernel oops or panic. No public exploit exists and EPSS of 0.16% (5th percentile) reflects negligible real-world exploitation probability - this is a targeted stability fix for a niche embedded platform.
Error pointer dereference in the Linux kernel's spi-sprd driver causes local denial of service on systems equipped with Spreadtrum (SPRD) SoC hardware. When DMA setup fails during driver probe and the driver falls back to PIO mode, a subsequent late probe error triggers a cleanup path that does not check the dma.enabled flag before attempting to release DMA channels - resulting in an error pointer dereference or double-channel-release and consequent kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the highly hardware-specific nature of this flaw. Vendor-released patches are confirmed across multiple Linux stable branches.
Crash kernel panic in Linux kernel's KHO (Kexec Handover) subsystem causes kdump capture to fail due to a missing crash-kernel guard in kho_fill_kimage(). Systems configured with both KHO and a crash kernel (kdump) are affected: when a kernel crash transfers control to the crash kernel, KHO metadata pointing outside the reserved crash region triggers an invalid phys_to_virt() translation in kho_memory_init(), crashing the crash kernel itself and defeating the crash dump mechanism. No public exploit exists and EPSS at 0.16% (6th percentile) reflects appropriately low exploitation probability given the local-only, configuration-dependent nature of the flaw.
NULL pointer dereference in the Linux kernel's ARM Firmware Framework for Armv8-A (arm_ffa) bus driver allows a local actor with kernel module loading rights to crash the host system. The bus match callback unconditionally dereferences the id_table pointer of any registering FF-A client driver; a driver that omits id_table triggers an immediate kernel panic, producing a denial-of-service condition. EPSS at 0.17% (6th percentile) and absence from the CISA KEV catalog indicate no public exploit and negligible observed exploitation activity.
Early boot initialization on ARM Integrator/CP hardware in the Linux kernel triggers a NULL pointer dereference by invoking memory allocation routines before the memory management subsystem is operational, causing a kernel panic that renders affected systems unbootable. The regression was introduced by commit bdb249fce9ad4 and affects all Linux stable branches from that point through patched releases (5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1). No public exploit exists, CISA KEV does not list this vulnerability, and EPSS sits at 0.17% (7th percentile), reflecting the narrowly scoped, hardware-specific nature of the defect.
Sleep-in-atomic-context denial of service in the Linux kernel btrfs filesystem driver allows a local low-privileged user to crash the system by triggering file sync operations while kernel tracing is active. The btrfs_sync_file trace event erroneously calls dput() - a function that may sleep - within an atomic context where sleeping is forbidden, producing a kernel BUG splat and potential panic. No active exploitation has been identified, EPSS is 0.16% (6th percentile), and the vulnerability requires a non-default kernel tracing configuration to be exploitable, substantially limiting real-world exposure.
Kernel panic in the Linux kernel's kprobes self-test module (test_kprobes) allows a local attacker or privileged user with debugfs write access to crash the kernel by triggering the KUnit kprobes test suite twice in succession. The root cause is that static kprobe and kretprobe variables retain stale address and flag data after unregister_kprobe, causing re-registration to fail with -EINVAL and subsequently triggering a kernel paging fault on the second test run. No public exploit is identified at time of analysis; EPSS at the 6th percentile and absence from CISA KEV confirm this as low-priority in production contexts.
The pds_core driver in the Linux kernel leaks debugfs dentry references on every firmware reset recovery due to missing dput() calls after debugfs_lookup(), and can crash the kernel when CONFIG_DEBUG_FS is disabled because ERR_PTR(-ENODEV) is not properly distinguished from NULL. A local user with standard privileges on a system hosting AMD/Pensando DPU hardware can trigger repeated firmware reset cycles to exhaust kernel memory, causing denial of service; on kernels with CONFIG_DEBUG_FS=n, a single reset recovery call can immediately crash the system via an invalid dput() on an error pointer. No public exploit exists and EPSS is 0.18% (7th percentile), but patches are available across multiple stable branches.
Null pointer dereference in the Linux kernel's Bluetooth ISO reassembly path allows any Bluetooth broadcaster within radio range to crash a victim Linux host by transmitting an ISO_END PDU without a preceding ISO_START on a BIS (Broadcast Isochronous Stream) connection. Affected kernels span all stable branches from the ISO introduction commit (ccf74f2390d60a2f9a75ef496d2564abb478f46a) through fixed releases 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.18% (8th percentile), reflecting low current exploitation probability despite the unauthenticated wireless trigger available to BIS attackers.
NULL pointer dereference in the Linux kernel's ethtool PHY subsystem allows a local low-privileged user to crash the kernel and cause a denial of service. The flaw in `phy_prepare_data()` fails to check return values from `kstrdup()` for the strings `name`, `drvname`, `upstream_sfp_name`, and `downstream_sfp_name`; when allocation fails and returns NULL, `phy_reply_size()` subsequently calls `strlen()` unconditionally on the NULL pointer, triggering a kernel oops and system panic. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), but the availability impact is total - a kernel panic - making this a standard patching priority for any multi-user or shared Linux environment.
NULL pointer dereference in the Linux kernel's PCM512x ASoC audio codec driver crashes the kernel when a local low-privileged user writes to the overclocking mixer kcontrol. The driver's pcm512x_overclock_xxx_put() handler incorrectly invokes snd_soc_dapm_kcontrol_to_dapm() on a standard mixer kcontrol - an accessor only valid for DAPM kcontrols - returning NULL and triggering a kernel panic. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), reflecting low exploitation likelihood; impact is confined to denial of service on systems with PCM512x audio hardware.
NULL pointer dereference in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem crashes the kernel when a hard interface is concurrently decoupled from its mesh interface during ARP processing. Local users with low privileges on systems running batman-adv mesh networking can trigger a kernel panic, causing a full denial of service. No public exploit exists and EPSS stands at 0.21% (11th percentile), marking this as a low-urgency stability fix rather than an active threat.
Heap buffer overflow in the Linux kernel's hwmon adm1266 PMBus driver allows a local attacker or a malicious/buggy PMBus device to crash the kernel by inducing a record_count value exceeding 32 in a BLACKBOX_INFO response, overrunning the fixed 2048-byte dev_mem allocation in adm1266_nvmem_read_blackbox(). Systems with the adm1266 driver loaded against ADM1266 hardware are affected across multiple stable kernel branches; patched versions are confirmed across Linux 5.10.258 through 7.0.11. EPSS at 0.18% and absence of KEV listing indicate no active exploitation at time of analysis.
NULL pointer dereference in the Linux kernel netfilter x_tables subsystem allows a local attacker to crash the kernel via a race condition during network namespace teardown. The flaw exists because arp/ip(6)t_register_table() adds a table to the per-netns linked list before allocating its per-namespace hook ops structure, leaving a window where ops=NULL is visible to concurrent readers. If a network namespace exit runs concurrently during this window, nf_unregister_net_hooks() receives a NULL ops pointer and triggers a general protection fault. No public exploit has been identified at time of analysis, and EPSS is very low at 0.15%.
Bio memory leak in the Linux kernel NVMe driver causes kernel memory exhaustion under integrity-mapping failure conditions, affecting local low-privileged users on systems with NVMe integrity features enabled. The defect lies in the NVMe block-I/O path: a local `bio` pointer is always NULL, so when integrity mapping fails the associated bio object is never freed - the fix retrieves the bio directly from the request structure. With EPSS at 0.17% (7th percentile) and no CISA KEV listing, no public exploit has been identified at time of analysis, and real-world risk is confined to gradual memory exhaustion rather than immediate system compromise.
Preempt count leak in four hv-gpci sysfs show() callbacks in the Linux kernel powerpc subsystem causes progressive kernel stability degradation on IBM Power systems compiled with CONFIG_PREEMPT=y. Each successful read of the affected sysfs nodes leaves one preempt_disable() unmatched, incrementally raising preempt_count; once the count becomes non-zero on return to userspace, the next page fault is misidentified as occurring in an atomic context, generating SIGSEGV and triggering 'BUG: scheduling while atomic' during the resulting coredump. Patches are available across the 6.6, 7.0, and 7.1 stable kernel trees, with no public exploit identified at time of analysis.
Kernel panic (BUG) in the Linux netfs subsystem's netfs_write_begin() function causes local denial of service when a folio is unlocked without holding the lock, triggering the VM_BUG_ON_FOLIO(!folio_test_locked(folio)) assertion at mm/filemap.c:1504. The defect surfaces under concurrent write workloads on Ceph-backed filesystems using the netfs layer - the generic/013 xfstests case reproduces it with approximately 30% probability per run. A local, low-privileged user who can write to a Ceph mount can crash the kernel; no confidentiality or integrity impact is observed. No public exploit code exists and EPSS stands at 0.17% (6th percentile), consistent with a race-condition DoS confined to specific filesystem configurations.
Kernel crash via NULL pointer dereference in the Linux netfs layer is triggered by a local low-privileged user combining a streaming write, file truncation, and mmap read on the same netfs-backed file. Affected kernel versions span from 6.8 (commit 9ebff83e) through stable branches prior to 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and EPSS is 0.17%, indicating very low observed exploitation probability; however, a precise reproduction recipe is embedded in the upstream fix commit, substantially lowering the knowledge barrier for any attacker already holding local access.
Write-through mode deadlock in the Linux kernel netfs subsystem allows a local low-privileged user to hang the kernel, causing a denial of service. The defect in netfs_advance_writethrough() fails to unconditionally unlock a supplied folio, and prematurely marks it for writeback before the folio is fully written, creating a lock-ordering conflict against concurrent mmapped reads and writes. Patches are available across multiple stable kernel branches; no public exploit code or active exploitation has been identified.
Reference leak in the Linux kernel netfs subsystem exposes systems with network filesystem mounts to a local denial-of-service condition. The `netfs_write_begin()` function fails to drop its held reference on the netfs request object when `netfs_wait_for_read()` returns an error, violating reference-counting invariants in the kernel's network filesystem abstraction layer. A low-privileged local user who can trigger repeated write errors on a netfs-backed mount (NFS, Ceph, AFS, or similar) can slowly exhaust kernel memory resources. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with a low-priority kernel maintenance fix.
Reference leaks and memory corruption in the Linux kernel netfs subsystem allow a local unprivileged user to crash the system via crafted write operations on network-backed filesystems. The flaw in netfs_perform_write() incorrectly transitions folio->private between NULL, the NETFS_FOLIO_COPY_TO_CACHE sentinel, netfs_group pointers, and netfs_folio structs, enabling multiple private-data attachments, folio reference leaks, and netfs_group struct leaks that can exhaust kernel resources or trigger a kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), indicating no observed exploitation activity.
Null pointer dereference in the Linux kernel's block bio-integrity subsystem (`bio_integrity_map_user()`) allows a local low-privileged attacker to crash the kernel, causing a denial of service. The flaw stems from `pin_user_pages_fast()` being permitted to return a partial page-pin result that is never validated before `bvec_from_pages()` dereferences the uninitialized zero-address entry. Patches are available across multiple stable kernel branches and Ubuntu has issued USN-8593-1; no active exploitation has been identified (EPSS 0.17%, no CISA KEV listing).
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to crash or indefinitely hang affected instances across four active release branches via crafted TCP communication. The attack requires no user interaction and only low privileges, making it a realistic and automatable threat for any enterprise environment where Coherence cluster ports are reachable by authenticated or low-privileged users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Oracle's own assessment rates this as network-accessible with low complexity.
Partial denial-of-service in Oracle Coherence 15.1.1.0.0 (Core component) allows a low-privileged attacker with TCP network access to intermittently degrade availability of the in-memory data grid. The CVSS 3.1 score of 4.3 reflects constrained impact - confidentiality and integrity are unaffected, and no complete service outage is possible. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; Oracle addressed this vulnerability in the July 2026 Critical Patch Update.
Denial-of-service and partial data integrity compromise in Oracle Coherence's Core component allows unauthenticated network attackers to hang or crash the service or manipulate a subset of accessible data via HTTP. Affected are three actively supported versions - 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - spanning the current Oracle Fusion Middleware release train. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the zero-confidentiality-impact, high-availability-impact profile is consistent with a resource exhaustion or malformed-request crash class of flaw that may attract opportunistic targeting of exposed Coherence cluster endpoints.
Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.
Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin allows a high-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing exist at time of analysis; the high attack complexity and high privilege requirement substantially limit real-world exploitation reach.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause a complete hang or frequently repeatable crash of the database server. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the combination of high attack complexity and high privilege requirements substantially limits realistic exploitation risk.
Denial-of-service in MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-based attacker to cause a repeatable server hang or crash under difficult-to-reproduce conditions. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47 and the same 8.4/9.7 ranges, with Oracle issuing a fix via the July 2026 Critical Patch Update. No public exploit has been identified and this CVE is not listed in CISA KEV, but the broad version coverage across active MySQL release trains warrants timely patching for environments running MySQL replication.
Denial-of-service exploitation in Oracle MySQL Server and MySQL Cluster via the Clone Plugin allows a high-privileged, network-connected attacker to cause a complete hang or repeatedly repeatable crash of the database server. Affected version ranges span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed in Oracle's July 2026 Critical Patch Update. No public exploit or active exploitation has been identified; attack complexity is high and requires pre-existing high database privileges, significantly constraining real-world risk to insider or post-breach scenarios.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Clone Plugin allows a high-privileged, network-connected attacker to crash or hang the database server through a difficult-to-exploit attack path. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and Oracle disclosed this via its July 2026 Critical Patch Update; exploitation would result in complete availability loss for the targeted database instance.
Denial-of-service via the Optimizer component in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-authenticated attacker to cause a complete, repeatable hang or crash of the database service. The flaw is network-reachable over multiple protocols and requires no user interaction, making it straightforward to trigger by any user holding even minimal database credentials. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this in the Critical Patch Update for July 2026.
Oracle MySQL Cluster's Server: Optimizer component in versions 8.0.0 through 8.0.47 can be exploited by a high-privileged remote attacker to cause a complete denial of service via repeated hang or crash of the cluster. Oracle disclosed and patched this in the July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation has been identified at time of analysis, and CISA KEV listing is absent.
Oracle VM VirtualBox 7.2.12 contains a Core component vulnerability exploitable by high-privileged local attackers that produces a scope change, potentially compromising systems beyond VirtualBox itself. Successful exploitation yields complete confidentiality loss of all VirtualBox-accessible data and a partial denial of service, making this an isolation-breach risk in multi-tenant or shared virtualization environments. No public exploit identified at time of analysis, and the AC:H rating signals difficult exploitation, but the scope change (S:C) elevates real-world concern for environments where VirtualBox hosts sensitive guest workloads.
Oracle VM VirtualBox 7.2.12 on the host infrastructure is vulnerable to a local denial-of-service and limited data integrity attack requiring human interaction from a third party. An attacker with logon access to the host - but no specific privileges on VirtualBox - can trigger a complete hang or repeated crash of the hypervisor, plus unauthorized modification of a subset of accessible VM data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low complexity and no-privileges-required local vector make this straightforward to execute once host access is obtained.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local attacker, under high-complexity conditions, to break VM isolation boundaries and compromise data integrity of the hypervisor and potentially adjacent systems. Successful exploitation can result in unauthorized creation, deletion, or modification of critical VirtualBox-accessible data, along with partial denial of service. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis, but the scope change (S:C) elevates priority in multi-tenant or shared-host VirtualBox deployments where VM boundary integrity is a security guarantee.
Oracle Workflow's Notification Mailer component within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) contains a locally-exploitable flaw that enables a low-privileged attacker with infrastructure logon access to partially corrupt workflow data and degrade service availability. The CVSS score of 3.6 reflects the real-world difficulty: local access is mandatory, attack complexity is rated High, and no confidentiality exposure exists. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, making this a low-priority operational finding relative to typical enterprise vulnerability backlogs.
Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Local exploitation of the Core component in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker to perform unauthorized creation, deletion, or modification of critical VirtualBox data and cause a partial denial of service - provided a second user's interaction can be induced. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), classifying it as easily exploitable under those local conditions. No public exploit code or active exploitation has been identified at time of analysis, and the mandatory human-interaction requirement (UI:R) materially constrains unassisted or automated attacks.
Denial-of-service vulnerability in Oracle MySQL Server and MySQL Cluster's InnoDB storage engine component allows high-privileged network-authenticated attackers to cause a complete, frequently repeatable crash or hang of the database server. Affected deployments span MySQL Server 8.4.x and 9.7.x, as well as MySQL Cluster 8.0.x through 9.7.x, making this a broad cross-version exposure within Oracle's primary database products. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high privilege requirement substantially narrows the real-world attacker population.
Local denial-of-service in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker with local logon access to the host system to repeatedly crash or hang the VirtualBox process, rendering the hypervisor unavailable. The flaw resides in the Core component and requires no user interaction once the attacker has a local session on the infrastructure host. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to availability - confidentiality and integrity are unaffected.
Oracle VM VirtualBox 7.2.12 Core component allows a high-privileged local attacker to cause a complete denial-of-service by crashing or hanging the hypervisor, with a scope change indicating the impact can extend beyond the primary VirtualBox process to affect additional products on the same infrastructure. The vulnerability is confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code or active exploitation has been identified at time of analysis.
Partial availability disruption in Oracle Siebel CRM End User (Redwood UI component, versions 24.4 through 26.3) can be triggered by a highly privileged network attacker over HTTP under difficult exploitation conditions that also require victim interaction, potentially causing cascading availability degradation in interconnected systems due to a confirmed scope change. The CVSS 3.1 base score of 2.6 (Low) reflects the extremely restrictive prerequisite chain - high privileges, user interaction, and high attack complexity must all align. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt availability across a broad range of supported versions, including the current releases 25.0.3 and 26.0.1. The attack surface is unusually wide: exploitation is possible through any protocol supported by the JVM, via APIs exposed in the Libraries component, through web services that internally invoke those APIs, and through the sandboxed Java Web Start or applet execution path when loading untrusted code. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivial exploitation conditions (AC:L/PR:N/UI:N) and the ubiquity of Java deployments elevate realistic risk beyond the moderate CVSS score alone.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause repeated crashes or indefinite hangs across affected 8.0, 8.4, and 9.7 release branches. Exploitation is straightforward (AC:L) but gated entirely by the requirement for high database privileges, substantially narrowing the realistic threat population. No public exploit identified at time of analysis and no CISA KEV listing; risk is most acute in replication-dependent high-availability clusters where availability SLAs are critical.
Local partial denial-of-service in Oracle GoldenGate Stream Analytics 26.1.0.0.0 allows a low-privileged attacker with logon access to the host infrastructure to degrade availability of the analytics service. The vulnerability resides in the Security component and requires no user interaction once local access is established. No public exploit code has been identified at time of analysis, and the low CVSS score of 3.3 reflects a limited, non-critical impact confined to availability.
Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to disrupt service availability with no authentication and low attack complexity. Affected releases span a broad range including Java SE 8u491 through 26.0.1, GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18 - covering virtually every supported Java SE release as of the July 2026 CPU. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though Oracle characterizes the vulnerability as 'easily exploitable', indicating automated exploitation is plausible.
Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated attackers across multiple network protocols, confirmed by Oracle's Critical Patch Update for July 2026. The vulnerability manifests in two distinct deployment contexts: server-side web services that pass externally supplied data to JavaFX APIs, and client-side sandboxed environments (Java Web Start applications or Java applets) that load and execute untrusted internet code. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; however, the low-complexity, no-authentication-required attack surface makes exploitation straightforward should a proof-of-concept emerge.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Optimizer component allows a high-privileged, network-connected attacker to crash or hang the database server. Affected products span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; the high privilege and high complexity requirements materially constrain real-world risk.
Denial-of-service in Oracle MySQL Server and MySQL Cluster versions 9.7.0-9.7.1 allows a high-privileged, network-adjacent attacker to repeatedly hang or crash the InnoDB storage engine via multiple supported protocols. The CVSS 3.1 score of 4.9 reflects the PR:H prerequisite, which significantly limits the exploitable population to authenticated database administrators or equivalently privileged accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.
Divide-by-zero in Zephyr's DesignWare SPI driver exposes kernel crash to locally-authorized userspace threads on all releases through v4.4.0. The spi_transceive syscall verify handler in spi_handlers.c copies the caller-supplied spi_config from userspace without validating the frequency field, allowing a thread with SPI device object access to pass frequency=0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(), which raises a CPU exception on Cortex-M Mainline and ARC platforms and halts the system. No public exploit has been identified at time of analysis; exploitation is gated behind a non-default build configuration and explicit privilege grant.
Kernel heap exhaustion in Zephyr RTOS affects all builds with CONFIG_USERSPACE enabled from v1.12.0 through v4.4.1, allowing any low-privilege user thread to permanently leak kernel memory by supplying a forged object handle to k_poll(). The z_vrfy_k_poll() syscall verifier allocates a kernel-side event copy but, prior to the fix, killed the calling thread via K_OOPS without freeing that buffer - a path any user thread can trigger repeatedly. By spawning additional threads that inherit the parent's resource_pool, an attacker can multiply the leak rate until the shared kernel heap is depleted, causing system-wide denial of service affecting queues, message buffers, and all future k_poll calls. No public exploit code or CISA KEV listing has been identified at time of analysis.
Zephyr RTOS Bluetooth Mesh PB-ADV provisioning can be permanently denied on any affected device within BLE advertising range by an unauthenticated remote attacker exploiting a timer-reset logic flaw in subsys/bluetooth/mesh/pb_adv.c. The watchdog timer governing protocol timeouts was rescheduled unconditionally before validity checks, allowing an attacker to hold a dead provisioning link open indefinitely by sending FCS-valid PDUs faster than the 60-120 second timeout interval. The device's unprovisioned beacon is suppressed and all new Link Open requests are rejected for as long as the attacker transmits, rendering the device permanently un-provisionable without a reboot. No public exploit is identified and the vulnerability is not listed in CISA KEV, though the attack requires no authentication and low complexity to execute from within BLE range.
Persistent denial of service in the NXP LPUART serial driver for Zephyr RTOS allows an unprivileged userspace thread to deterministically crash the entire embedded system by issuing a uart_configure() call with an unsupported parameter value while CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled. The driver's configure path calls LPUART_Deinit() before validating the requested configuration, gating the peripheral clock; if validation then rejects the parameters, the clock is never restored, and any subsequent LPUART register access - from any thread or interrupt handler - triggers a hard fault and system reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fault path is trivially and deterministically reproducible from userspace on affected NXP MCU targets.
Remote denial-of-service in Gitea versions prior to 1.27.0 allows any authenticated user to crash the server by exploiting an O(N²) string concatenation flaw in the RFC 4716 SSH key parser. Submitting a single crafted SSH2 public key with hundreds of thousands of short content lines forces quadratic heap allocation that exhausts CPU and RAM within seconds, taking the entire Gitea instance offline. A functional, Docker-packaged proof-of-concept is publicly available per the Gitea security advisory; no active exploitation has been confirmed in CISA KEV, but the trivially low barrier - any valid user account suffices - elevates real-world risk considerably.
Node process termination in Elasticsearch allows a low-privileged authenticated user to crash any reachable cluster node with a single malformed search request. The vulnerability stems from a reachable assertion in the query parsing layer triggered by a null value in a specific query clause; because Elasticsearch treats assertion failures as fatal, the node process exits immediately. Single-node deployments lose service entirely; in clustered environments, each targeted node reduces available search capacity. No public exploit has been identified at time of analysis, and Elastic has released patched versions 8.19.19, 9.3.8, and 9.4.4 per advisory ESA-2026-64.
Null pointer dereference in Gitea's AddTime API (versions prior to 1.27.0) allows an authenticated repository administrator to crash the server by specifying a non-existent username in a time-tracking request. The root cause is a missing `return` statement in `routers/api/v1/repo/issue_tracked_time.go` after `GetUserByName()` returns an error, causing `AddTime()` to dereference a nil user pointer and trigger a Go runtime panic. No active exploitation is confirmed (not in CISA KEV), but a proof-of-concept is embedded in the GHSA advisory, making the issue trivially reproducible by any repository administrator.
Denial of service in Gitea's NPM package registry API allows any authenticated user to crash the entire server process with a single HTTP request by exploiting an unbounded `io.ReadAll()` call in the `AddPackageTag` handler. Gitea versions up to and including v1.26.2 are confirmed vulnerable, with the fix shipped in v1.27.0. Because self-registration is enabled by default, external unauthenticated attackers can register a free account and immediately exploit this to take down all Gitea-hosted services including repositories, CI/CD pipelines, and issue tracking; a detailed proof-of-concept with video evidence is publicly available in the advisory.
Kibana's Canvas functionality allows any authenticated low-privileged user to crash the Kibana server process via a specially crafted request, causing a complete denial of service for all users of the affected instance. The root cause is uncontrolled resource consumption (CWE-400 / CAPEC-130), where Canvas fails to bound server-side resource allocation when processing attacker-controlled input. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity once authenticated makes independent rediscovery plausible.
Denial of service in Gitea's Debian package registry (all versions before 1.27.0) lets any authenticated user with package write access crash the server with a single .deb upload. The parser's ParseControlFile decompresses control.tar.gz with no size limit and tees the entire stream into a strings.Builder, so an 83 MB payload expands to 16+ GB and exhausts memory; a companion O(N²) string concatenation on Description continuation lines can independently saturate a CPU core. A complete working proof-of-concept is published in the advisory, so publicly available exploit code exists, though there is no public exploit identified as used in active attacks and the issue is not in CISA KEV.
Gitea's Arch package registry allows authenticated users with package-publishing permissions to trigger severe resource amplification by uploading crafted `.pkg.tar.gz` archives containing large numbers of empty file entries. A 470 KB compressed archive can produce 4.5 MB of database-stored metadata and a repository index with 100,001 lines - approximately 45x amplification - affecting CPU, memory, database storage, and index generation. Publicly available exploit code exists (a complete Python POC is included in the advisory); no active exploitation is confirmed in CISA KEV. The vulnerability is patched in Gitea v1.27.0.
Heap exhaustion in Elasticsearch allows authenticated users holding search privileges to crash individual data nodes by submitting specially crafted search requests, degrading or taking down the cluster and requiring manual administrator intervention to restore service. Affected versions span the 8.x and 9.x release lines per vendor advisory ESA-2026-60, with fixes available in 8.19.15, 9.2.9, and 9.3.4 as inferred from the advisory URL. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low authentication barrier makes it a meaningful risk for multi-tenant or shared Elasticsearch deployments.
Denial of service in Elasticsearch allows a low-privileged authenticated user to crash an Elasticsearch node by submitting a specially crafted EQL sequence query against an index they control, triggering uncontrolled memory consumption (CWE-400, CAPEC-130). Affected across all tracked versions per CPE wildcard, with Elastic releasing fixes in versions 8.19.18, 9.3.7, and 9.4.4 per advisory ESA-2026-57. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad Elasticsearch deployment footprint make this a credible internal threat in multi-tenant or shared cluster environments.
Denial of service in Kibana's Entity Analytics feature allows authenticated users to render the application unavailable by submitting oversized input values to affected API endpoints. The root cause is CWE-770 - absent resource allocation limits on specific Entity Analytics endpoints - enabling a single crafted request to trigger excessive memory or CPU consumption disproportionate to normal operation. No public exploit code has been identified at time of analysis, and the PR:L authentication requirement constrains opportunistic exploitation to credentialed actors.
Denial of service in Docker BuildKit (moby/buildkit) allows a malicious or compromised client or frontend to crash the BuildKit daemon (buildkitd) by sending a specially crafted request that triggers an unhandled Go panic. The vulnerability affects all versions of moby/buildkit (CPE cpe:2.3:a:moby:buildkit:*). Any authenticated BuildKit client or frontend - including those operating in CI/CD pipelines, Kubernetes build nodes, or Docker Desktop environments - with network access to the daemon can exploit this to disrupt all concurrent and subsequent build operations. No public exploit is identified at time of analysis and the vulnerability has not been added to the CISA KEV catalog.
Out-of-bounds read in Qt's QTextCodec::codecForName() causes incorrect text codec selection or a process crash (denial of service) when the function is supplied a non-NUL-terminated QByteArray constructed via QByteArray::fromRawData(). Affected components span Qt Core (qtbase) in Qt 4.x and 5.x, and the Qt5Compat module in Qt 6.0.0 onward. No public exploit has been identified and no CISA KEV listing exists; real-world risk is confined to applications whose codec-selection paths are reachable from attacker-controlled input and that specifically construct raw, non-NUL-terminated byte arrays before passing them to this API.
Unbounded memory growth in libssh's SFTP client allows a malicious server to exhaust client-side memory by sending responses for unknown request IDs, resulting in a denial-of-service condition against any application using libssh for SFTP operations. Affected deployments include libssh as packaged in Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images. No public exploit code and no active exploitation have been identified at time of analysis; the CVSS score of 5.3 (Medium) reflects the limited availability impact and the requirement that a victim client connect to an attacker-controlled server.
Stack-based buffer overflow in rpcbind's rpcinfo client utility crashes the rpcinfo process when a user or administrator runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint. The flaw is in the `rpcbdump()` short-mode function, which writes version number data from a remote RPCBPROC_DUMP reply into a fixed-size stack buffer without bounds validation. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10 as well as OpenShift Container Platform 4; no public exploit has been identified and this vulnerability does not appear in the CISA KEV catalog, placing real-world urgency in the medium tier despite the network-accessible attack vector.
Signal misdelivery in libssh's ProxyCommand handling allows a low-privileged local user to trigger a local denial of service affecting their entire accessible process tree. When fork() fails during ProxyCommand execution, the error return value of -1 is stored unchecked as a child process ID; at cleanup, libssh signals PID -1, which Linux interprets as a broadcast to all processes the caller has permission to signal. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, but the CVSS scope-changed metric (S:C) confirms that impact extends beyond the libssh component itself to co-located user processes.
CPU exhaustion via malformed SSH channel negotiation in libssh allows an authenticated remote peer to cause indefinite server-side looping and denial of service. By advertising a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, the attacker forces subsequent channel writes into an infinite loop, fully consuming CPU on the affected host. This affects libssh as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images; no public exploit or CISA KEV listing has been identified at time of analysis.
Uncontrolled resource consumption in FreeScout's file upload endpoint allows any user to flood the server with upload requests, overloading the database and causing denial of service for all platform users on versions prior to 1.8.224. The root cause is the complete absence of rate limiting on the upload route - a low-complexity, network-accessible weakness requiring no special privileges per the CVSS vector. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial exploitation mechanics mean any motivated user can weaponize this without tooling.
NULL pointer dereference in NanoMQ 0.24.11 and earlier allows an authenticated REST API user to crash the entire broker process with a single malformed HTTP request. The `properties_parse()` function fails to validate that `user_properties` is a JSON object before iterating its elements, calling `strlen()` on a NULL pointer and causing a fatal segmentation fault. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; a vendor patch is available in version 0.24.14.
NULL pointer dereference in NanoMQ 0.24.11 and earlier allows a malicious MQTT broker to remotely crash any connecting NanoMQ MQTTv5 client - including bridge mode - with a single 35-byte crafted packet, triggering SIGSEGV and denial of service. The bug in mqtt_codec.c:1863 arises when a CONNECT packet carries will properties (will_prop != NULL) but no connect-level properties (prop == NULL); the code erroneously dereferences prop->next, reading from virtual address 0x38 (NULL plus struct field offset). No CISA KEV listing or public exploit is confirmed at time of analysis, but the minimal 35-byte trigger and auto-reconnect behavior in bridge mode can convert a single crash into a persistent DoS loop.
NULL pointer dereference in the Linux kernel's DualPI2 traffic scheduler crashes the kernel when GSO segmentation accounting mismatches occur under a QFQ parent queueing discipline. Systems running Linux kernels prior to 6.18.39, 7.1.4, or 7.2-rc1 with DualPI2 configured as a child of QFQ are vulnerable to a local denial-of-service via kernel panic. No public exploit code exists and EPSS is 0.15% (5th percentile), reflecting the niche configuration required; however, the availability impact is total (kernel crash) when conditions are met.
Incorrect error-path logic in the Linux kernel's i2c-i801 SMBus driver allows a local, low-privileged user to trigger a hardware state machine corruption leading to a system-wide hung task panic. When i801_check_pre() returns -EBUSY because the BIOS/ACPI firmware legitimately holds the SMBus controller, the driver unconditionally writes to SMBHSTSTS hardware registers without owning the controller, destroying the firmware's in-progress transaction and permanently corrupting the SMBus state machine. This produces an infinite 'SMBus is busy' error log flood, causes a console livelock that starves processes competing for mmap_lock, and ultimately triggers the hung task watchdog. No public exploit is identified at time of analysis; EPSS is 0.17% (6th percentile) and the vulnerability is not in CISA KEV.
Kernel panic via NULL dereference in the Linux kernel BPF subsystem affects systems compiled with CONFIG_BPF_LSM=y where the BPF LSM is not activated at boot. A locally authenticated user with low privileges can create a BPF_MAP_TYPE_INODE_STORAGE map under this misconfigured state, causing bpf_inode() to alias the struct rcu_head.func callback pointer; when map cleanup nulls this aliased pointer, rcu_do_batch() subsequently attempts an instruction fetch at address 0x0, triggering an immediate kernel panic and complete system denial of service. No public exploit is identified at time of analysis; EPSS sits at 0.14% (4th percentile), consistent with the narrow triggering conditions required.
NULL pointer dereference in the Linux kernel's team network driver (net/team/team_core.c) allows a local attacker with CAP_NET_ADMIN to crash the kernel by racing a mode change against concurrent packet transmission. The vulnerability arises because __team_change_mode() wipes team->ops via memset() before reinstalling safe dummy handlers, creating a window where team_xmit() running under RCU on a parallel CPU can invoke a NULL function pointer. No public exploit code exists and the issue is not listed in CISA KEV, but the availability impact is total (kernel panic), and the fix is present in upstream stable commits.
NULL pointer dereference in the Linux kernel XFS log recovery path allows a local attacker to crash the kernel by mounting a crafted XFS filesystem image. The flaw exists in xlog_recover_reorder_trans() at fs/xfs/xfs_log_recover.c:1836, where a committed log transaction containing zero regions leaves ri_buf NULL, causing a fatal dereference when ITEM_TYPE() is called during recovery. EPSS is 0.16% (5th percentile) and no active exploitation has been observed; the vulnerability was discovered through an AI-assisted code audit, not in-the-wild activity.
Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory (IFD) index values before passing them to libexif, enabling a crash via null pointer dereference when a crafted image with an out-of-range IFD tag group index is processed. All platforms running libvips through its EXIF parsing path are affected, including downstream consumers such as Node.js sharp and other language bindings that link against libvips. No public exploit has been identified and active exploitation is not confirmed, but the fix is publicly visible and the crash condition is straightforward to reproduce.
Stack-based buffer overflow in the rpcinfo client utility (part of the rpcbind package) crashes the client process when querying a malicious or compromised rpcbind server using the `-l` flag. Address data returned by the server is copied into a fixed-size stack buffer without bounds validation (CWE-121), enabling a server-side attacker to trigger a denial of service against any administrator or script that runs `rpcinfo -l` against their controlled endpoint. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to client-side availability with no confidentiality or integrity exposure.
Denial of service in SurrealDB's embedded JavaScript scripting engine allows any query-executing user - including unauthenticated guests when guest access is enabled alongside scripting - to immediately crash the server process by passing an oversized string to the QuickJS-NG v0.8 runtime for compilation, triggering a null pointer dereference. The crash requires a manual operator restart with no graceful shutdown, and cannot be leveraged for code execution or data compromise. The attack is constrained to instances where the non-default `--allow-scripting` capability is active; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Pre-authentication memory amplification in SurrealDB before 3.1.0 allows unauthenticated network attackers to exhaust server memory by streaming oversized WebSocket frames to the /sql endpoint, which fails to enforce the operator-configured SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit before buffering incoming bytes. The /sql WebSocket upgrade handler accepts anonymous connections and accumulates up to 16 MiB per frame and 64 MiB per reassembled message in per-connection read buffers - the full WebSocket library default - before the authentication check (check_anon) can reject the payload, meaning memory cost is incurred regardless of whether the caller holds any SurrealQL permissions. No public exploit has been identified at time of analysis, but the unauthenticated network-accessible attack surface requires no special prerequisites beyond network connectivity and sustained bandwidth.
Denial of service in SurrealDB's SurrealML header parser allows an authenticated Owner-role user to crash the entire server process by uploading a malformed .surml file to the /ml/import endpoint. Non-numeric input-dimensions or other invalid header fields trigger unchecked Rust unwrap() calls, causing a process-aborting panic that denies service to all databases hosted on the affected instance simultaneously. No public exploit code has been identified at time of analysis; vendor-released patch is available in SurrealDB 3.2.0.
Resource exhaustion in GLib's GDBus authentication component allows attackers to crash or hang processes by sending unbounded data streams before authentication completes. The `gdbusauth` handler reads lines from connecting clients without enforcing any maximum length, meaning an attacker who can reach a GDBus endpoint can force the target process to allocate unbounded memory and saturate CPU cycles. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the unbounded allocation primitive (CWE-770) in a widely-deployed system library warrants attention from Red Hat and GNOME ecosystem consumers.
Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3, where a low-privileged remote attacker can submit a container image containing malformed APK package-database data to trigger an out-of-bounds read (CWE-125) that panics the Go scanner. If the panic is not recovered, the Clair indexer process crashes, interrupting container vulnerability scanning workflows. No public exploit code exists and this CVE is not listed in the CISA KEV catalog, placing this at moderate priority despite network reachability.
HAProxy Community Edition 3.2.x and 3.3.x contains a varint mishandling defect that allows remote network clients to trigger an infinite loop or process crash, resulting in denial of service. The flaw affects Community Edition 3.2.x before 3.2.12 and 3.3.x before 3.3.3, and is explicitly confirmed to also affect HAProxy Enterprise and ALOHA commercial distributions. No public exploit has been identified and CISA has not listed this in KEV; however, HAProxy's role as a critical network gateway in many enterprise environments elevates the operational impact of even a Low-severity availability disruption.
NULL pointer dereference in the Linux kernel's EFI runtime subsystem crashes affected systems when ACPI Platform Runtime Mechanism (PRM) handlers are invoked during early boot before the EFI runtime workqueue has been allocated. Systems with EFI PRM-capable firmware running unpatched kernels between the introduction of commit 5894cf571e14 and the respective stable-branch fixes are affected. No public exploit or CISA KEV listing exists; the vulnerability manifests as a kernel panic during initialization on susceptible hardware, resulting in a denial of service.
NULL pointer dereference in the Linux kernel's SPI QUP (Qualcomm Universal Peripheral) driver causes a local denial-of-service condition affecting Qualcomm SoC-based Linux systems. When DMA setup fails during driver probe, the fallback to PIO mode leaves DMA channel pointers in a stale error state rather than clearing them to NULL; a subsequent probe failure or driver unbind then dereferences those error pointers, triggering a kernel panic. Patches are available across all active stable branches (5.10.259, 5.15.210, 6.1.176, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1); no public exploit has been identified and EPSS is at the 6th percentile, indicating negligible exploitation probability at this time.
Error pointer dereference in the Linux kernel ep93xx SPI driver causes kernel panic (denial of service) under specific driver lifecycle conditions on Cirrus Logic EP93xx ARM SoC hardware. When DMA channel setup fails during driver probe and falls back to PIO mode, the driver fails to clear the DMA channel pointers; any subsequent probe error or driver unbind then dereferences those stale error pointers, triggering a kernel oops or panic. No public exploit exists and EPSS of 0.16% (5th percentile) reflects negligible real-world exploitation probability - this is a targeted stability fix for a niche embedded platform.
Error pointer dereference in the Linux kernel's spi-sprd driver causes local denial of service on systems equipped with Spreadtrum (SPRD) SoC hardware. When DMA setup fails during driver probe and the driver falls back to PIO mode, a subsequent late probe error triggers a cleanup path that does not check the dma.enabled flag before attempting to release DMA channels - resulting in an error pointer dereference or double-channel-release and consequent kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the highly hardware-specific nature of this flaw. Vendor-released patches are confirmed across multiple Linux stable branches.
Crash kernel panic in Linux kernel's KHO (Kexec Handover) subsystem causes kdump capture to fail due to a missing crash-kernel guard in kho_fill_kimage(). Systems configured with both KHO and a crash kernel (kdump) are affected: when a kernel crash transfers control to the crash kernel, KHO metadata pointing outside the reserved crash region triggers an invalid phys_to_virt() translation in kho_memory_init(), crashing the crash kernel itself and defeating the crash dump mechanism. No public exploit exists and EPSS at 0.16% (6th percentile) reflects appropriately low exploitation probability given the local-only, configuration-dependent nature of the flaw.
NULL pointer dereference in the Linux kernel's ARM Firmware Framework for Armv8-A (arm_ffa) bus driver allows a local actor with kernel module loading rights to crash the host system. The bus match callback unconditionally dereferences the id_table pointer of any registering FF-A client driver; a driver that omits id_table triggers an immediate kernel panic, producing a denial-of-service condition. EPSS at 0.17% (6th percentile) and absence from the CISA KEV catalog indicate no public exploit and negligible observed exploitation activity.
Early boot initialization on ARM Integrator/CP hardware in the Linux kernel triggers a NULL pointer dereference by invoking memory allocation routines before the memory management subsystem is operational, causing a kernel panic that renders affected systems unbootable. The regression was introduced by commit bdb249fce9ad4 and affects all Linux stable branches from that point through patched releases (5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1). No public exploit exists, CISA KEV does not list this vulnerability, and EPSS sits at 0.17% (7th percentile), reflecting the narrowly scoped, hardware-specific nature of the defect.
Sleep-in-atomic-context denial of service in the Linux kernel btrfs filesystem driver allows a local low-privileged user to crash the system by triggering file sync operations while kernel tracing is active. The btrfs_sync_file trace event erroneously calls dput() - a function that may sleep - within an atomic context where sleeping is forbidden, producing a kernel BUG splat and potential panic. No active exploitation has been identified, EPSS is 0.16% (6th percentile), and the vulnerability requires a non-default kernel tracing configuration to be exploitable, substantially limiting real-world exposure.
Kernel panic in the Linux kernel's kprobes self-test module (test_kprobes) allows a local attacker or privileged user with debugfs write access to crash the kernel by triggering the KUnit kprobes test suite twice in succession. The root cause is that static kprobe and kretprobe variables retain stale address and flag data after unregister_kprobe, causing re-registration to fail with -EINVAL and subsequently triggering a kernel paging fault on the second test run. No public exploit is identified at time of analysis; EPSS at the 6th percentile and absence from CISA KEV confirm this as low-priority in production contexts.
The pds_core driver in the Linux kernel leaks debugfs dentry references on every firmware reset recovery due to missing dput() calls after debugfs_lookup(), and can crash the kernel when CONFIG_DEBUG_FS is disabled because ERR_PTR(-ENODEV) is not properly distinguished from NULL. A local user with standard privileges on a system hosting AMD/Pensando DPU hardware can trigger repeated firmware reset cycles to exhaust kernel memory, causing denial of service; on kernels with CONFIG_DEBUG_FS=n, a single reset recovery call can immediately crash the system via an invalid dput() on an error pointer. No public exploit exists and EPSS is 0.18% (7th percentile), but patches are available across multiple stable branches.
Null pointer dereference in the Linux kernel's Bluetooth ISO reassembly path allows any Bluetooth broadcaster within radio range to crash a victim Linux host by transmitting an ISO_END PDU without a preceding ISO_START on a BIS (Broadcast Isochronous Stream) connection. Affected kernels span all stable branches from the ISO introduction commit (ccf74f2390d60a2f9a75ef496d2564abb478f46a) through fixed releases 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.18% (8th percentile), reflecting low current exploitation probability despite the unauthenticated wireless trigger available to BIS attackers.
NULL pointer dereference in the Linux kernel's ethtool PHY subsystem allows a local low-privileged user to crash the kernel and cause a denial of service. The flaw in `phy_prepare_data()` fails to check return values from `kstrdup()` for the strings `name`, `drvname`, `upstream_sfp_name`, and `downstream_sfp_name`; when allocation fails and returns NULL, `phy_reply_size()` subsequently calls `strlen()` unconditionally on the NULL pointer, triggering a kernel oops and system panic. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), but the availability impact is total - a kernel panic - making this a standard patching priority for any multi-user or shared Linux environment.
NULL pointer dereference in the Linux kernel's PCM512x ASoC audio codec driver crashes the kernel when a local low-privileged user writes to the overclocking mixer kcontrol. The driver's pcm512x_overclock_xxx_put() handler incorrectly invokes snd_soc_dapm_kcontrol_to_dapm() on a standard mixer kcontrol - an accessor only valid for DAPM kcontrols - returning NULL and triggering a kernel panic. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), reflecting low exploitation likelihood; impact is confined to denial of service on systems with PCM512x audio hardware.
NULL pointer dereference in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem crashes the kernel when a hard interface is concurrently decoupled from its mesh interface during ARP processing. Local users with low privileges on systems running batman-adv mesh networking can trigger a kernel panic, causing a full denial of service. No public exploit exists and EPSS stands at 0.21% (11th percentile), marking this as a low-urgency stability fix rather than an active threat.
Heap buffer overflow in the Linux kernel's hwmon adm1266 PMBus driver allows a local attacker or a malicious/buggy PMBus device to crash the kernel by inducing a record_count value exceeding 32 in a BLACKBOX_INFO response, overrunning the fixed 2048-byte dev_mem allocation in adm1266_nvmem_read_blackbox(). Systems with the adm1266 driver loaded against ADM1266 hardware are affected across multiple stable kernel branches; patched versions are confirmed across Linux 5.10.258 through 7.0.11. EPSS at 0.18% and absence of KEV listing indicate no active exploitation at time of analysis.
NULL pointer dereference in the Linux kernel netfilter x_tables subsystem allows a local attacker to crash the kernel via a race condition during network namespace teardown. The flaw exists because arp/ip(6)t_register_table() adds a table to the per-netns linked list before allocating its per-namespace hook ops structure, leaving a window where ops=NULL is visible to concurrent readers. If a network namespace exit runs concurrently during this window, nf_unregister_net_hooks() receives a NULL ops pointer and triggers a general protection fault. No public exploit has been identified at time of analysis, and EPSS is very low at 0.15%.
Bio memory leak in the Linux kernel NVMe driver causes kernel memory exhaustion under integrity-mapping failure conditions, affecting local low-privileged users on systems with NVMe integrity features enabled. The defect lies in the NVMe block-I/O path: a local `bio` pointer is always NULL, so when integrity mapping fails the associated bio object is never freed - the fix retrieves the bio directly from the request structure. With EPSS at 0.17% (7th percentile) and no CISA KEV listing, no public exploit has been identified at time of analysis, and real-world risk is confined to gradual memory exhaustion rather than immediate system compromise.
Preempt count leak in four hv-gpci sysfs show() callbacks in the Linux kernel powerpc subsystem causes progressive kernel stability degradation on IBM Power systems compiled with CONFIG_PREEMPT=y. Each successful read of the affected sysfs nodes leaves one preempt_disable() unmatched, incrementally raising preempt_count; once the count becomes non-zero on return to userspace, the next page fault is misidentified as occurring in an atomic context, generating SIGSEGV and triggering 'BUG: scheduling while atomic' during the resulting coredump. Patches are available across the 6.6, 7.0, and 7.1 stable kernel trees, with no public exploit identified at time of analysis.
Kernel panic (BUG) in the Linux netfs subsystem's netfs_write_begin() function causes local denial of service when a folio is unlocked without holding the lock, triggering the VM_BUG_ON_FOLIO(!folio_test_locked(folio)) assertion at mm/filemap.c:1504. The defect surfaces under concurrent write workloads on Ceph-backed filesystems using the netfs layer - the generic/013 xfstests case reproduces it with approximately 30% probability per run. A local, low-privileged user who can write to a Ceph mount can crash the kernel; no confidentiality or integrity impact is observed. No public exploit code exists and EPSS stands at 0.17% (6th percentile), consistent with a race-condition DoS confined to specific filesystem configurations.
Kernel crash via NULL pointer dereference in the Linux netfs layer is triggered by a local low-privileged user combining a streaming write, file truncation, and mmap read on the same netfs-backed file. Affected kernel versions span from 6.8 (commit 9ebff83e) through stable branches prior to 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and EPSS is 0.17%, indicating very low observed exploitation probability; however, a precise reproduction recipe is embedded in the upstream fix commit, substantially lowering the knowledge barrier for any attacker already holding local access.
Write-through mode deadlock in the Linux kernel netfs subsystem allows a local low-privileged user to hang the kernel, causing a denial of service. The defect in netfs_advance_writethrough() fails to unconditionally unlock a supplied folio, and prematurely marks it for writeback before the folio is fully written, creating a lock-ordering conflict against concurrent mmapped reads and writes. Patches are available across multiple stable kernel branches; no public exploit code or active exploitation has been identified.
Reference leak in the Linux kernel netfs subsystem exposes systems with network filesystem mounts to a local denial-of-service condition. The `netfs_write_begin()` function fails to drop its held reference on the netfs request object when `netfs_wait_for_read()` returns an error, violating reference-counting invariants in the kernel's network filesystem abstraction layer. A low-privileged local user who can trigger repeated write errors on a netfs-backed mount (NFS, Ceph, AFS, or similar) can slowly exhaust kernel memory resources. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with a low-priority kernel maintenance fix.
Reference leaks and memory corruption in the Linux kernel netfs subsystem allow a local unprivileged user to crash the system via crafted write operations on network-backed filesystems. The flaw in netfs_perform_write() incorrectly transitions folio->private between NULL, the NETFS_FOLIO_COPY_TO_CACHE sentinel, netfs_group pointers, and netfs_folio structs, enabling multiple private-data attachments, folio reference leaks, and netfs_group struct leaks that can exhaust kernel resources or trigger a kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), indicating no observed exploitation activity.
Null pointer dereference in the Linux kernel's block bio-integrity subsystem (`bio_integrity_map_user()`) allows a local low-privileged attacker to crash the kernel, causing a denial of service. The flaw stems from `pin_user_pages_fast()` being permitted to return a partial page-pin result that is never validated before `bvec_from_pages()` dereferences the uninitialized zero-address entry. Patches are available across multiple stable kernel branches and Ubuntu has issued USN-8593-1; no active exploitation has been identified (EPSS 0.17%, no CISA KEV listing).