Denial Of Service
Monthly
Null pointer dereference in the ALSA TASCAM US-144MKII USB audio driver allows local attackers with physical access to a malicious USB device to cause a kernel panic and denial of service. The vulnerability exists because the driver fails to validate that USB interface 0 exists before dereferencing it, and attackers can craft a malicious USB configuration that includes only interface 1, triggering the crash when the device is connected.
Divide-by-zero denial of service in Linux kernel framebuffer driver tdfxfb allows local authenticated users to crash the system by issuing a malformed FBIOPUT_VSCREENINFO ioctl with zero pixclock value. The vulnerability affects the framebuffer video mode setting functionality when pixclock is used directly in division operations without validation, triggering a kernel panic.
Null pointer dereference in the Renesas USB3 gadget driver allows local authenticated attackers to trigger a denial of service by sending crafted USB standard requests with invalid endpoint indices that bypass validation in GET_STATUS and SET/CLEAR_FEATURE handlers. The vulnerability affects multiple stable kernel versions and requires local access with user-level privileges, resulting in potential system crash or service disruption.
Divide-by-zero crash in the Linux kernel's udlfb (USB DisplayLink framebuffer) driver allows a local low-privileged user to trigger a kernel panic via the FBIOPUT_VSCREENINFO ioctl when pixclock is zero. The flaw, classified CWE-369, mirrors an identical class of defect previously corrected in the fb_pm2fb driver (commit 19f953e74356). Patched kernel versions are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
NULL pointer dereference in the Linux kernel's vidtv virtual DVB-T test driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service. The flaw resides in vidtv_channel_pmt_match_sections(), which calls vidtv_psi_pmt_stream_init() without validating whether the return value is NULL on memory allocation failure; a subsequent field access on the NULL pointer triggers a general protection fault. No public exploit or active KEV-listed exploitation exists; EPSS at 0.02% (5th percentile) reflects negligible real-world exploitation probability.
Kernel panic in the Linux kernel's ocfs2 (Oracle Cluster File System 2) resize path allows a local low-privileged user to crash the system via a crafted filesystem image. The ocfs2_group_extend() function in fs/ocfs2/resize.c:308 unconditionally asserts that the global bitmap buffer contains a valid dinode signature using BUG_ON, but the JBD2 journaling layer's buffer path bypasses structural validation, permitting an invalid dinode to reach the resize ioctl and trigger a kernel BUG. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.02% (5th percentile), reflecting minimal exploitation activity; patches are available across multiple stable kernel branches.
Null pointer dereference in the Linux kernel's KVM SEV subsystem crashes the host with a kernel panic when a low-privileged local user issues a specific ioctl sequence. The missing `kvm->lock` acquisition before the `sev_guest()` check in `sev_mem_enc_register_region()` allows exploitation when `KVM_SEV_INIT{2}` fails and leaves `sev->regions_list` uninitialized - a subsequent `KVM_MEM_ENCRYPT_REG_REGION` ioctl then dereferences the null list head. No confirmed active exploitation (not in CISA KEV), but a syzbot-generated reproducer is embedded in the CVE description; EPSS is 0.02% (4th percentile), consistent with the local-only, denial-of-service nature. Patched kernel versions 6.18.24, 6.19.14, and 7.0.1 are available.
Kernel crash risk in Linux KVM's AMD SEV-SNP guest launch path allows a local attacker with KVM vCPU management privileges to crash the host by exploiting a missing vCPU lock during VMSA synchronization. The SEV-SNP `KVM_SNP_LAUNCH_FINISH` path failed to lock all vCPUs before encrypting their save areas, permitting concurrent userspace manipulation that corrupts per-vCPU state or triggers a kernel panic. No public exploit code has been identified and the EPSS score of 0.02% (4th percentile) reflects extremely low exploitation probability, making this a targeted concern for AMD EPYC-based KVM hypervisors running SNP guests.
Deadlock in the Linux kernel WireGuard subsystem can cause a hung task and system-level denial of service for authenticated local users. The `wg_netns_pre_exit()` pernet callback manually acquires `rtnl_lock()`, blocking indefinitely if `rtnl_mutex` is concurrently held by the `cleanup_net` workqueue or `setup_net` failure rollback path. No public exploit exists and EPSS is extremely low (0.02%, 4th percentile); however, the issue spans a broad range of kernel versions and has been patched in stable releases 6.18.24, 6.19.14, and 7.0.1.
NULL pointer dereference in the Linux kernel's nilfs2 filesystem driver allows a local, low-privileged attacker to crash the kernel by invoking the NILFS_IOCTL_CLEAN_SEGMENTS ioctl immediately after mounting a nilfs2 filesystem, before the DAT inode's btree node cache is lazily initialized. The impact is a general protection fault and full denial of service; no confidentiality or integrity impact is possible. No public exploit is known at time of analysis, and EPSS at 0.02% (5th percentile) reflects extremely low real-world exploitation probability.
NULL pointer dereference in the Linux kernel's MediaTek DSI DRM driver causes a kernel panic during module initialization on ARM64 systems with MediaTek display hardware. The crash occurs because `mipi_dsi_host_register` triggers the `mtk_dsi_bind` callback before the `mtk_dsi` struct is stored in driver data, dereferencing a NULL pointer inside `drm_mode_object_add` and acquiring `mode_config.idr_mutex` before panicking - blocking all subsequent DRM operations on the system. No public exploit exists and EPSS stands at 0.02%, consistent with a hardware-specific local denial-of-service with no confidentiality or integrity impact.
The Linux kernel's x86 FRED (Flexible Return and Event Delivery) initialization path crashes AMD SEV-ES, SEV-SNP, and Intel TDX confidential VM guests via triple fault when any exception is triggered during the brief AP initialization window before FRED MSRs are configured. A prior attempted mitigation introduced a secondary risk: temporarily disabling CR4 pinning for offline CPUs created a path where a local attacker could flip a single RW-memory bit (the CPU online flag) to suppress CR4 security controls and disable SMEP/SMAP protections. No public exploit has been identified at time of analysis; EPSS is 0.02% (5th percentile), consistent with the narrow real-world exploitability of this flaw.
Null pointer dereference in the Linux kernel's spi-dw-dma driver crashes the system when an error occurs during a DMA transaction and the current SPI message pointer is NULL at the time error-log printing is attempted. Systems running the DesignWare SPI DMA driver are exposed to a local denial-of-service condition triggerable by a low-privileged user. No public exploit exists and EPSS probability is 0.02% (5th percentile), indicating negligible current exploitation interest; however, the crash path is deterministic once the error condition is induced.
Null pointer dereference in the Linux kernel's LoongArch architecture code can crash the kernel during early boot when kstrdup() fails to allocate memory while parsing CPU model strings from the device tree. Affected systems running unpatched kernels on LoongArch hardware may experience a kernel oops and complete system unavailability if memory is exhausted at boot time. No public exploit exists and EPSS is 0.02% (6th percentile), reflecting very low exploitation probability; this is not listed in CISA KEV.
NULL pointer dereference in the Linux kernel's cp2615 i2c driver crashes the kernel when a USB device lacking a serial number string is probed, resulting in denial of service. The cp2615 driver unconditionally uses the USB serial string as the i2c adapter name without first verifying the pointer is non-NULL, a flaw exploitable by connecting a crafted or malformed CP2615 USB-to-I2C bridge device. No active exploitation is confirmed (not in CISA KEV) and the EPSS score of 0.02% at the 7th percentile reflects negligible exploitation interest; impact is limited to availability with no code execution or data exposure possible.
NULL pointer dereference in the Linux kernel bonding driver's RLB debug interface allows a local low-privileged user to crash the kernel, causing a denial of service. Specifically, bond_debug_rlb_hash_show in bond_debugfs.c dereferences client_info->slave without a NULL guard - a condition intentionally created by rlb_clear_slave when no replacement bonding slave is available - producing a BUG: kernel NULL pointer dereference at address 0x0. Affected across multiple stable kernel trees from 5.10.x through 7.0; no public exploit code exists and EPSS is 0.02%, consistent with low opportunistic risk, though Siemens PSIRT has issued downstream advisories (SSA-019113, SSA-082556) indicating industrial/embedded impact.
A NULL pointer dereference in the Linux kernel ARM SCMI firmware driver allows local authenticated users to trigger a denial of service by causing the system to crash. The vulnerability exists in the __scmi_event_handler_get_ops helper function, which can return NULL instead of the expected ERR_PTR on failure, causing downstream code to dereference a NULL pointer when handling unsupported SCMI events. The flaw was introduced in commit b5daf93b809d1 and affects multiple stable kernel versions; patches are available in Linux 6.18.20, 6.19.10, and 7.0.
Debug logging in the Linux kernel's crash_dump module exposes dm-crypt key material when debug logging is enabled, allowing local privileged users to read encryption keys from kernel logs and potentially cause denial of service through availability impact on crash dump functionality. The vulnerability affects Linux kernel versions prior to 6.18.20, 6.19.10, and 7.0, with an EPSS score of 0.02% indicating low exploitation probability despite the information disclosure risk.
A null pointer dereference in the i915 GPU driver's graphics translation table (GT) submission logic causes kernel panic and denial of service when the i915 firmware binaries are absent and the system attempts to suspend. Local authenticated attackers with normal user privileges can trigger this crash by initiating system suspend on affected Intel graphics systems without required firmware, resulting in denial of service. No public exploit code identified at time of analysis; EPSS score of 0.02% indicates low exploitation probability in practice.
Denial of service in Hostbill versions 2025-11-24 and 2025-12-01 allows remote unauthenticated attackers to degrade service availability through the Checkout Authentication Flow component via uncontrolled resource consumption (likely improper rate limiting). The vulnerability has a low-to-moderate CVSS score (5.3) reflecting limited impact scope, but exploitation requires no authentication or user interaction and can be triggered over the network.
Denial of service via improper resource handling in the Client Balance component of Hostbill v.2025-11-24 and v.2025-12-01 allows high-privileged remote attackers to disrupt service availability and trigger limited integrity impacts. The vulnerability stems from insufficient input validation in CWE-400 (Uncontrolled Resource Consumption), requiring administrator-level access but presenting moderate real-world risk due to the low attack complexity and network accessibility of the affected component.
Denial of service in OpenClaw versions 2026.2.26 through pre-2026.3.31 allows unauthenticated remote attackers to exhaust the shared pending pairing-request window on multi-account channel deployments, blocking legitimate accounts from initiating new pairing or onboarding. The root flaw is a quota-scoping error: the cap on pending requests was enforced per channel file rather than per account, so one actor's requests consume capacity allocated to unrelated accounts. The GHSA advisory confirms this is an availability-only impact - no cross-account data access, approval, or authorization bypass is possible. No public exploit or CISA KEV listing exists; EPSS probability is 0.10%, reflecting minimal real-world exploitation pressure at time of analysis.
Denial of service in go-ntlmssp (pkg:go/github.com/Azure/go-ntlmssp) versions prior to 0.1.1 allows a malicious HTTP server to crash any Go process that uses ntlmssp.Negotiator as its HTTP transport by returning a crafted NTLM challenge message. The malformed payload triggers a slice out-of-bounds panic - a fatal runtime condition in Go - causing complete process termination. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS at 0.06% (18th percentile) reflects very low opportunistic exploitation probability at time of analysis.
Unbounded HTTP response body allocation in OpenTelemetry.Sampler.AWS allows an attacker who controls the configured X-Ray sampling endpoint or who holds a network MitM position to exhaust heap memory and crash the consuming .NET process via OutOfMemoryException. Both NuGet packages OpenTelemetry.Sampler.AWS (versions below 0.1.0-alpha.8) and OpenTelemetry.Resources.AWS (versions below 1.15.1) are affected, with AWSXRaySamplerClient.DoRequestAsync calling ReadAsStringAsync() with no response size cap. No public exploit has been identified and EPSS sits at 0.01% (2nd percentile), consistent with SSVC exploitation status of none and CISA KEV absence, making this a low-urgency but patchable DoS risk.
Uncontrolled memory allocation in OpenTelemetry dotnet's propagation header parsing exposes .NET applications to denial of service. OpenTelemetry.Api versions 0.5.0-beta.2 through 1.15.2 and OpenTelemetry.Extensions.Propagators versions 1.3.1 through 1.15.2 contain BaggagePropagator, B3Propagator, and JaegerPropagator implementations that eagerly allocate intermediate arrays before enforcing size limits, allowing malformed headers with excessive delimiter characters to trigger disproportionate memory consumption. No active exploitation is confirmed (not in CISA KEV), EPSS is extremely low at 0.02%, and a vendor-released patch exists at version 1.15.3.
Memory exhaustion via unbounded protobuf allocation in OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) affects versions 1.13.1 through 1.15.2 when exporting telemetry over OTLP/gRPC. An attacker controlling the gRPC collector endpoint or intercepting telemetry traffic can return a malformed grpc-status-details-bin trailer on a retryable response, causing the instrumented .NET process to attempt an arbitrarily large byte array allocation and exhaust available memory. No public exploit exists and SSVC confirms no active exploitation; a vendor patch is available in 1.15.3.
Heap-based buffer overflow in Libgcrypt before 1.12.2 allows local attackers to trigger denial of service and corrupt memory via crafted ECDH ciphertext passed to gcry_pk_decrypt, affecting cryptographic operations in dependent applications including GnuPG. No public exploit code or active exploitation has been identified at time of analysis; vendor has released patched versions 1.10.4, 1.11.3, and 1.12.2 to resolve the vulnerability.
Authenticated users can trigger a denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 for Linux, UNIX, and Windows through improper neutralization of special elements in database query logic, causing service unavailability without requiring user interaction or special configuration. The vulnerability affects both standalone Db2 instances and Db2 Connect Server deployments, with CVSS 6.5 reflecting network accessibility and authenticated access requirements. No public exploit code or active exploitation has been identified at the time of analysis.
OpenMcdf fails to detect cycles in Compound File Binary (CFB) directory entry red-black trees, causing indefinite loops in Storage.EnumerateEntries() and Storage.OpenStream() when processing crafted CFB files with sibling ID cycles. This denial-of-service vulnerability consumes the calling thread permanently with no recovery path via exception handling, affecting any application opening untrusted CFB documents. Patch available in version 3.1.3.
Denial of service in nimiq-libp2p prior to version 1.3.0 allows remote peers to exhaust node resources by sending partial frames on inbound substreams and keeping them open. The vulnerability combines unbounded stream reading via `read_to_end()` with a high concurrent stream limit of 1000, enabling attackers to accumulate stalled slots and degrade network availability without authentication or user interaction.
Nimiq Core-rs-Albatross prior to v1.3.0 crashes when processing malformed transaction inclusion proofs with mismatched history and positions arrays. A remote attacker can trigger a denial of service by sending a crafted ResponseTransactionsProof with unequal array lengths, causing the HistoryTreeProof::verify function to panic. The vulnerability requires high attack complexity and user interaction, limiting real-world impact despite network accessibility.
Denial of service in Nimiq's vesting contract allows remote unauthenticated attackers to crash nodes by crafting a vesting contract with `total_amount` exceeding the actual contract balance, then triggering a panic during error handling when `min_cap > balance`. The vulnerability exploits insufficient validation of vesting contract creation data and integer underflow in the `Coin::sub` operation, affecting all versions before 1.3.0. Active exploitation would require ability to broadcast transactions to the Nimiq network.
The env utility in uutils coreutils incorrectly rejects valid backslash escape sequences in single-quoted strings when using the -S (split-string) option, terminating with exit status 125 and causing local denial of service for scripts relying on GNU env compatibility. The implementation performs overly strict validation that diverges from GNU behavior, where backslashes outside of \\ and \' are treated literally rather than invalid, breaking automated administrative workflows.
The ln utility in uutils coreutils fails to process source paths containing non-UTF-8 filename bytes when using target-directory forms, rejecting valid filenames that GNU ln handles correctly. This logic error affects automated scripts and system tasks on Unix filesystems where non-UTF-8 filenames are common, causing denial of service for those specific operations. SSVC classifies exploitation as possible (POC available) but not automatable, with partial technical impact.
Local denial of service in uutils coreutils kill utility before version 0.6.0 allows unprivileged users to crash the system or terminate all visible processes by exploiting incorrect argument parsing that sends SIGTERM to PID -1 instead of reporting a missing PID argument. The vulnerability requires local access and can be triggered without user interaction, distinguishing it from the correct behavior in GNU coreutils where -1 is interpreted as a signal number rather than a process identifier.
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across filesystem boundaries, allowing local authenticated users to trigger resource exhaustion via disk space consumption, disclose sensitive data through unexpected file duplication, or cause denial of service through infinite symlink loop recursion. Affected versions prior to 0.7.0 are vulnerable; a vendor-released patch is available.
The cp utility in uutils coreutils versions before 0.7.0 incorrectly handles recursive copy operations (-R flag) by converting character and block device nodes into regular files instead of preserving them via mknod, destroying device semantics and enabling denial of service through disk exhaustion or process hangs when unbounded device nodes are copied.
The sort utility in uutils coreutils crashes with a process panic when the --files0-from option processes inputs containing non-UTF-8 filenames, allowing local authenticated attackers to cause denial of service. Unlike GNU sort, which handles filenames as raw bytes, uutils enforces UTF-8 encoding via expect() calls that immediately panic on invalid sequences. A proof-of-concept exploit exists; SSVC analysis indicates partial technical impact with non-automatable exploitation.
Authenticated users can trigger denial of service in GitLab CE/EE versions 10.6 through 18.11.0 by sending crafted requests to the discussions endpoint that exhaust server resources. The vulnerability requires valid authentication credentials and affects all affected versions across the 10.6, 18.9, 18.10, and 18.11 release branches. Publicly available exploit code exists; CISA has not yet listed this in the Known Exploited Vulnerabilities catalog, but active exploitation likelihood is moderate given public POC availability and the low complexity of resource exhaustion attacks.
Authenticated users can trigger denial of service in GitLab by overwhelming system resources through the GraphQL API due to insufficient resource allocation limits. Affected versions span from 12.4 through 18.11.0 across three release branches. Publicly available exploit code exists, though active exploitation has not been confirmed in CISA KEV. CVSS 6.5 reflects moderate severity with high availability impact but requires valid authentication.
Denial of service in GitLab CE/EE affects authenticated users who can trigger resource exhaustion when retrieving notes under specific conditions, causing service unavailability. Versions 9.2 through 18.9.5, 18.10.0 through 18.10.3, and 18.11.0 are vulnerable. An authenticated attacker with standard user privileges can exploit this remotely without user interaction via crafted note retrieval requests. A publicly available exploit exists, and patches have been released by GitLab.
Denial of service in GitLab CE/EE versions 12.3 through 18.11.0 allows authenticated users to trigger excessive resource consumption during issue import operations due to improper input validation on user-supplied data. The vulnerability affects all minor versions from 12.3 onwards until patched versions 18.9.6, 18.10.4, and 18.11.1. Publicly available exploit code exists, and CISA SSVC assessment indicates the vulnerability is exploitable but not automatable at scale.
Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Libefiboot in efivar fails to validate that EFI device path node length fields meet the 4-byte minimum requirement, allowing local users to trigger infinite recursion and stack exhaustion via crafted device paths. The vulnerability requires user interaction but causes denial of service by crashing affected processes, with no privilege escalation or data compromise. No active exploitation has been confirmed at the time of analysis.
Memory corruption in GNU Emacs SVG/CSS processing allows local attackers to trigger denial of service or information disclosure by convincing users to open specially crafted SVG files. The vulnerability requires user interaction (file opening) and local access, but results in significant impact including service disruption and potential data leakage through memory corruption exploitation.
Denial of service in PowerDNS secondary servers occurs when a rogue primary server sends crafted DNS update requests that cause file descriptor exhaustion on the secondary, eventually rendering the secondary unable to process legitimate DNS queries. The attack requires network-level coordination between a compromised or attacker-controlled primary server and a target secondary server, with moderate attack complexity due to the need to establish a primary-secondary relationship. No active exploitation has been confirmed in CISA KEV at time of analysis.
DNSdist is vulnerable to denial of service via out-of-bounds write when processing crafted UDP responses from a rogue backend server. An attacker controlling a backend DNS server can send a specially crafted UDP response with a query ID set off-by-one from the maximum configured value, triggering memory corruption that crashes the DNS forwarder. The CVSS score of 6.5 reflects network attack vector with high complexity and absence of confidentiality impact, though availability and integrity are affected.
Denial of service in dnsdist via crafted PRSD (PowerDNS Response Detection) queries causes assertion failure and service disruption on remote DNS resolvers. The vulnerability requires specific network conditions and crafted packet construction (AC:H) but affects default configurations without authentication. CVSS 3.7 reflects low availability impact with non-trivial exploitation complexity.
dnsdist allows remote denial-of-service attacks through memory exhaustion by generating numerous error responses on single DoQ (DNS-over-QUIC) and DoH3 (DNS-over-HTTPS/3) connections. An unauthenticated remote attacker can trigger excessive memory allocation by rapidly sending queries that produce error responses, with resources not properly released until connection termination. CVSS 5.3 (AV:N/AC:L/PR:N/UI:N) reflects network-accessible availability impact; no public exploit identified at time of analysis.
dnsdist can be forced into excessive memory allocation when a client generates high volumes of DNS queries routed to an overloaded DNS-over-HTTPS (DoH) backend, causing queries to accumulate in an unbounded buffer that persists until connection closure. This denial-of-service condition affects dnsdist deployments with DoH backends under load, allowing unauthenticated remote attackers to exhaust server memory with sustained query traffic.
DNSdist allows remote attackers to create unlimited concurrent DoQ (DNS over QUIC) or DoH3 (DNS over HTTPS/3) connections, triggering unbounded memory allocation and denial of service. The vulnerability affects configurations where these protocols are explicitly enabled, as both are disabled by default. No authentication is required for exploitation, and CVSS 5.3 (AC:L, AV:N) indicates straightforward network-based triggering under default conditions.
A denial-of-service vulnerability in the Linux kernel's Btrfs filesystem implementation allows local authenticated attackers to cause filesystem corruption and crashes through a race condition during subvolume creation and lookup. When a newly created Btrfs subvolume's dentry cache is dropped before the BTRFS_ROOT_ORPHAN_CLEANUP flag is set, concurrent orphan cleanup operations can fail with ENOENT, creating negative dentries that prevent subvolume deletion and cause filesystem aborts. EPSS score of 0.02% indicates this is a low-probability exploitation scenario requiring specific timing and configuration conditions, though the impact is severe for affected systems. No public exploit code is identified at time of analysis.
Denial of service in Linux kernel af_key module allows local authenticated attackers to crash the system via buffer overflow in pfkey_send_migrate() function. The vulnerability occurs because pfkey_send_migrate() fails to validate address family parameters before passing them to set_ipsecrequest(), causing truncation that overfills the socket buffer and triggers kernel panic in skb_put(). EPSS score of 0.02% indicates minimal real-world exploitation risk despite moderate CVSS severity.
Null pointer dereference in the Linux kernel Bluetooth L2CAP implementation allows local authenticated attackers to cause a kernel panic and denial of service via the l2cap_sock_ready_cb function during L2CAP connection initialization. The vulnerability occurs when a socket pointer is dereferenced without null validation, triggering a KASAN null-ptr-deref exception that crashes the kernel. EPSS score of 0.02% indicates low real-world exploitation probability despite the moderate CVSS score; no public exploit code or active KEV listing has been identified at time of analysis.
Denial of service via infinite loop in Bluetooth L2CAP ERTM reconfiguration allows local authenticated attackers to exhaust system memory. The vulnerability arises from two distinct flaws: improper handling of L2CAP channel reconfiguration that leaks ERTM resources and fails to validate minimum PDU size, causing an infinite loop in l2cap_segment_sdu() when remote_mps is set to zero. EPSS score of 0.02% indicates limited exploitation likelihood despite the high CVSS score, reflecting the requirement for local access and authenticated Bluetooth channel state.
Kernel panic via null pointer dereference in the tracing subsystem occurs when boot-time trigger registration fails and kthread creation does not succeed, allowing deferred trigger frees to accumulate indefinitely and crash the system. Local authenticated attackers can trigger this by specifying malformed trace event parameters on the kernel command line, resulting in denial of service. EPSS exploitation probability is 0.02% (very low) despite moderate CVSS score, suggesting this requires specific boot-time configuration and local access.
Denial of service in Linux kernel IPTFS (IP Traffic Flow Security) subsystem allows local authenticated attackers to trigger an infinite loop via crafted ESP packets with malformed inner IPv4 headers containing tot_len=0. The vulnerability bypasses input validation in __input_process_payload() that should reject IPv4 packets where tot_len is less than the header length, causing the kernel to spin indefinitely in softirq context and hang the system.
Memory leak in Linux kernel DAMON subsystem allows local authenticated users to exhaust system memory via failed allocation in damon_sysfs_new_test_ctx(), causing denial of service. The vulnerability affects kernel versions 6.17.6 through 7.0-rc1 when DAMON_SYSFS is enabled. A privileged user can trigger the leak by making specific control sequences that cause early function returns, bypassing cleanup code and leaving param_ctx unfreed.
Denial of service via null pointer dereference in Linux kernel DAMON sysfs module allows local privileged users to crash the system by setting nr_contexts to zero while DAMON is running, then issuing state-change commands that dereference an empty contexts array without bounds checking. EPSS exploitation probability is minimal at 0.02%, reflecting the requirement for local privileged access and active DAMON configuration.
Null pointer dereference in Linux kernel DAMON sysfs interface allows local authenticated users to cause denial of service by setting nr_contexts to zero while DAMON is running, triggering dereference of uninitialized context array pointers in damon_sysfs_repeat_call_fn(). The vulnerability requires local access and low-level privileges (non-root user with sysfs write access), with an EPSS exploitation probability of 0.02% indicating low real-world attack likelihood despite the straightforward trigger mechanism.
Null pointer dereference in Linux kernel DAMON subsystem allows local authenticated attackers to cause denial of service when memory allocation failures occur during online parameter updates. The vulnerability affects DAMON's context commit mechanism (damon_commit_ctx), which can partially corrupt kernel state if internal memory allocation fails, potentially leading to NULL pointer dereference in damos_commit_dests(). While real-world impact is rare due to the low probability of allocation failure, the severe consequence of kernel panic necessitates this fix.
Denial of service in the Linux kernel dmaengine idxd subsystem allows local attackers with low privileges to crash the system by triggering a Function Level Reset when the hardware does not support event log reporting. The vulnerability occurs when the driver attempts to restore or free an event log that was never allocated, resulting in a kernel crash with high availability impact.
Kernel panic in the Linux netfs subsystem's netfs_limit_iter() function crashes systems when a process writes a core dump to a 9P-mounted filesystem. The function handles only ITER_FOLIOQ, ITER_BVEC, and ITER_XARRAY iterator types, triggering a hard BUG() when __kernel_write() supplies an ITER_KVEC iterator via netfs_unbuffered_write(), producing a local denial of service via kernel panic. No public exploit code exists and no active exploitation has been identified; this is a no public exploit identified at time of analysis scenario with EPSS at 0.02% (5th percentile), indicating minimal widespread exploitation interest.
NULL pointer dereference in the Linux kernel's netfs subsystem crashes the kernel when retrying unbuffered writes on filesystems that omit the prepare_write stream operation, such as 9P. A local low-privilege user who can write to such a mounted filesystem and induce a get_user_pages() -EFAULT failure can trigger a kernel panic, causing a denial of service. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects negligible observed exploitation probability; the vulnerability is not listed in CISA KEV.
Denial of service in PowerDNS Recursor via null pointer dereference in the zoneToCache function when processing zone data from a malicious authoritative server. Affects Recursor 5.2.0 through 5.4.0 and requires high privileges and non-standard network conditions to exploit, resulting in service availability impact but not data compromise. Patch available from vendor.
Null pointer dereference in PowerDNS Recursor allows remote attackers to trigger a denial of service by sending crafted DNS replies that bypass a missing consistency check. The vulnerability affects Recursor versions 5.2.0 through 5.2.8, 5.3.0 through 5.3.5, and 5.4.0, with CVSS 5.9 reflecting high availability impact but requiring special network conditions (AC:H). No public exploit code identified at time of analysis.
PowerDNS Recursor versions 5.2.x, 5.3.x, and 5.4.0 are vulnerable to denial of service when processing a zone transition from NSEC to NSEC3 DNSSEC record types, causing internal inconsistency and resolver unavailability. The vulnerability requires network access but elevated attack complexity, affecting recursive DNS resolvers in production environments. Vendor patches are available for all affected branches.
Denial of service in PowerDNS Authoritative, Recursor, and dnsdist via unbounded memory allocation in their internal web servers when processing specially crafted web requests. Multiple product lines are affected across several version ranges. The internal web server is disabled by default, significantly limiting real-world exposure. A vendor-released patch is available. CVSS 5.3 (low severity) with network-accessible vector but no authentication required reflects the ease of exploitation offset by the availability limitation and DoS-only impact.
PowerDNS Recursor versions 5.2.0-5.2.8, 5.3.0-5.3.5, and 5.4.0 suffer denial of service and potential data corruption when a malfunctioning RPZ provider causes concurrent transfers of the same RPZ zone, leading to use-after-free conditions, inconsistent zone data, and recursor crashes. The vulnerability requires high privilege attacker control over an RPZ provider and non-standard network conditions, resulting in availability and integrity impact with a CVSS score of 5.0.
Denial of service in PowerDNS Recursor allows remote unauthenticated attackers to exhaust resolver memory by publishing and querying crafted DNS zones that trigger excessive allocation in the negative and aggressive NSEC(3) caches. The vulnerability affects Recursor versions 5.2.0-5.2.8, 5.3.0-5.3.5, and 5.4.0, with a CVSS score of 5.3 reflecting low severity due to availability impact only (no code execution or data breach). Vendor-released patches are available.
Unlimited memory allocation in PowerDNS internal web server allows remote denial of service via crafted web requests. The vulnerability affects multiple PowerDNS products (dnsdist, Authoritative, and Recursor) across multiple versions, though the internal web server is disabled by default, significantly limiting real-world exposure. CVSS 5.3 reflects low attack complexity and no authentication requirements, but the default-disabled state and requirement to enable the internal web server substantially reduce practical risk.
Denial of service via unlimited memory allocation in PowerDNS Recursor's internal web server affects versions 5.2.0-5.2.8, 5.3.0-5.3.5, and 5.4.0. An unauthenticated remote attacker can send a crafted web request to exhaust server memory when the internal web server is enabled, causing service unavailability. No public exploit code or active exploitation has been identified, but patch versions are available from the vendor.
Denial of service in PowerDNS Recursor occurs when processing a malicious Response Policy Zone (RPZ) from an authoritative server, triggering a null pointer dereference due to missing validation logic. Versions 5.2.0-5.2.8, 5.3.0-5.3.5, and 5.4.0 are affected. An authenticated remote attacker controlling an authoritative nameserver can crash the Recursor service by sending a specially crafted RPZ response, requiring high privilege level (PR:H) and complex attack conditions (AC:H) as mitigating factors.
The readelf utility in binutils is vulnerable to denial of service through two distinct flaws triggered by maliciously crafted ELF files: a resource exhaustion vulnerability (CWE-400) causing out-of-memory conditions and a null pointer dereference (CWE-476) causing segmentation faults. Both vulnerabilities require local access and user interaction to open a malicious file, resulting in the readelf utility crashing or becoming unresponsive. No public exploit code or active exploitation has been identified at the time of analysis.
Format string vulnerability in nano's statusline() function allows local users to trigger a segmentation fault via directory names containing printf specifiers, causing denial of service. Exploitation requires user interaction (opening a directory with the crafted name) on systems where nano is available to local users. No public exploit code identified at time of analysis.
The readelf utility in binutils is vulnerable to denial of service through null pointer dereference when processing specially crafted ELF files. A local attacker with limited privileges can trigger excessive resource consumption or program crashes by convincing a user to process a malicious ELF binary, affecting Red Hat Enterprise Linux 6, 7, 8, and 10. No public exploit code or active exploitation has been confirmed at this time.
CRLF injection in HTTP Headers WordPress plugin up to version 1.19.2 allows authenticated administrators to inject arbitrary Apache directives into .htaccess files via unsanitized custom header fields, causing configuration parse errors and potential site-wide denial of service. Attack requires Administrator-level WordPress access and no user interaction. CVSS 5.5 reflects high availability impact (A:H) balanced against high privilege requirements (PR:H).
Uncontrolled resource consumption in Tanium Interact allows authenticated high-privilege administrators to trigger a denial of service condition through network-accessible endpoints. The vulnerability requires high-level administrative privileges (PR:H) and produces only availability impact with no confidentiality or integrity compromise. CVSS base score of 2.7 reflects the severe privilege barrier and limited impact scope.
Unbounded memory allocation in Tekton Pipelines' HTTP resolver allows any authenticated tenant to crash the shared resolver pod for an entire Kubernetes cluster. The `FetchHttpResource` function reads HTTP response bodies without a byte-level size cap, so a low-privileged user who can create TaskRuns or PipelineRuns can direct the resolver at an attacker-controlled server delivering multi-gigabyte responses, exhausting the pod's 4 GiB memory limit and triggering an OOM-kill. Because all resolver types - Git, Hub, Bundle, Cluster, and HTTP - share the same `tekton-pipelines-resolvers` pod, repeated exploitation causes a sustained crash loop that denies CI/CD pipeline resolution to every tenant on the cluster. A PoC is included in the GHSA advisory and SSVC confirms exploit code exists; however, no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
Uncontrolled resource consumption in Sanluan PublicCMS versions 6.202506.a through 6.202506.d enables low-privileged remote attackers to trigger denial-of-service conditions by manipulating the ZipSecureFile.setMinflateRatio function within the document-to-HTML conversion utility DocToHtmlUtils.java. The flaw (CWE-400) causes the server to exhaust resources when processing attacker-controlled input through the affected code path. No public exploit exists, EPSS sits at 0.03% (10th percentile), SSVC confirms no known exploitation and non-automatable attack profile - real-world priority is low for most deployments, though the vendor's non-response to disclosure leaves patch status unresolved.
Partial denial-of-service in Oracle VM VirtualBox 7.2.6 Core component allows a locally authenticated, high-privileged attacker to degrade availability of the hypervisor. Exploitation is limited to the local system and requires pre-existing administrative-level access, with no confidentiality or integrity impact. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog; EPSS at 0.01% (2nd percentile) reflects near-zero exploitation probability.
Oracle VM VirtualBox 7.2.6 contains an improper access control flaw in its Core component that enables a highly privileged local attacker to partially compromise confidentiality, integrity, and availability - with a scope change indicating potential bleed beyond the VirtualBox process boundary to adjacent products or guest VMs on the same host. Exploitation requires local logon with high privileges and high attack complexity, making opportunistic exploitation unlikely; EPSS at the 2nd percentile and SSVC exploitation status of 'none' corroborate low real-world risk. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog.
Improper access control in the IDM Authentication component of Oracle Life Sciences InForm 7.0.1.0 and 7.0.1.1 exposes the platform to unauthenticated network-based attacks over HTTP that require victim user interaction to succeed. Successful exploitation yields unauthorized partial read, write/delete, and denial-of-service impact against InForm clinical trial data. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' confirm minimal real-world threat at this time.
Local denial-of-service in MySQL Shell's Core Client component allows a low-privileged OS user, with required interaction from a legitimate victim user, to repeatedly crash or hang the MySQL Shell process across three active release branches. Affected deployments span 8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0, as confirmed by Oracle's April 2026 CPU. EPSS sits at the 2nd percentile with no public exploit code and no CISA KEV listing, placing this squarely in the routine-patching tier rather than emergency response.
Denial-of-service in Oracle MySQL Shell's Core Client component allows a low-privileged local attacker, with required human interaction from another user, to cause a hang or repeatable crash of MySQL Shell across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit has been identified, EPSS sits at 0.01% (2nd percentile), and SSVC assesses exploitation as 'none' with non-automatable attack conditions - all signals converging on minimal real-world risk. Impact is strictly limited to availability; there is no confidentiality or integrity exposure.
Denial-of-service in Oracle MySQL Server's JSON component allows authenticated low-privileged network users to hang or repeatedly crash the database server across all three supported release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The flaw is classified as CWE-400 (Uncontrolled Resource Consumption), meaning specially crafted JSON-related queries exhaust server resources without adequate bounds checking. No public exploit code or active exploitation has been identified; EPSS of 0.04% at the 12th percentile and SSVC 'Exploitation: none' together confirm this is not under active threat at time of analysis.
Denial-of-service in MySQL Server's InnoDB component allows high-privileged authenticated attackers with network access to crash or hang the database server via multiple protocols. Affected versions span three major release lines - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - covering a broad footprint of Oracle MySQL deployments including downstream Red Hat and SUSE packages. Proof-of-concept exploit code exists per SSVC classification, though EPSS stands at 0.04% (11th percentile) with no CISA KEV listing, indicating low observed exploitation probability consistent with the high-privilege prerequisite.
Null pointer dereference in the ALSA TASCAM US-144MKII USB audio driver allows local attackers with physical access to a malicious USB device to cause a kernel panic and denial of service. The vulnerability exists because the driver fails to validate that USB interface 0 exists before dereferencing it, and attackers can craft a malicious USB configuration that includes only interface 1, triggering the crash when the device is connected.
Divide-by-zero denial of service in Linux kernel framebuffer driver tdfxfb allows local authenticated users to crash the system by issuing a malformed FBIOPUT_VSCREENINFO ioctl with zero pixclock value. The vulnerability affects the framebuffer video mode setting functionality when pixclock is used directly in division operations without validation, triggering a kernel panic.
Null pointer dereference in the Renesas USB3 gadget driver allows local authenticated attackers to trigger a denial of service by sending crafted USB standard requests with invalid endpoint indices that bypass validation in GET_STATUS and SET/CLEAR_FEATURE handlers. The vulnerability affects multiple stable kernel versions and requires local access with user-level privileges, resulting in potential system crash or service disruption.
Divide-by-zero crash in the Linux kernel's udlfb (USB DisplayLink framebuffer) driver allows a local low-privileged user to trigger a kernel panic via the FBIOPUT_VSCREENINFO ioctl when pixclock is zero. The flaw, classified CWE-369, mirrors an identical class of defect previously corrected in the fb_pm2fb driver (commit 19f953e74356). Patched kernel versions are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
NULL pointer dereference in the Linux kernel's vidtv virtual DVB-T test driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service. The flaw resides in vidtv_channel_pmt_match_sections(), which calls vidtv_psi_pmt_stream_init() without validating whether the return value is NULL on memory allocation failure; a subsequent field access on the NULL pointer triggers a general protection fault. No public exploit or active KEV-listed exploitation exists; EPSS at 0.02% (5th percentile) reflects negligible real-world exploitation probability.
Kernel panic in the Linux kernel's ocfs2 (Oracle Cluster File System 2) resize path allows a local low-privileged user to crash the system via a crafted filesystem image. The ocfs2_group_extend() function in fs/ocfs2/resize.c:308 unconditionally asserts that the global bitmap buffer contains a valid dinode signature using BUG_ON, but the JBD2 journaling layer's buffer path bypasses structural validation, permitting an invalid dinode to reach the resize ioctl and trigger a kernel BUG. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.02% (5th percentile), reflecting minimal exploitation activity; patches are available across multiple stable kernel branches.
Null pointer dereference in the Linux kernel's KVM SEV subsystem crashes the host with a kernel panic when a low-privileged local user issues a specific ioctl sequence. The missing `kvm->lock` acquisition before the `sev_guest()` check in `sev_mem_enc_register_region()` allows exploitation when `KVM_SEV_INIT{2}` fails and leaves `sev->regions_list` uninitialized - a subsequent `KVM_MEM_ENCRYPT_REG_REGION` ioctl then dereferences the null list head. No confirmed active exploitation (not in CISA KEV), but a syzbot-generated reproducer is embedded in the CVE description; EPSS is 0.02% (4th percentile), consistent with the local-only, denial-of-service nature. Patched kernel versions 6.18.24, 6.19.14, and 7.0.1 are available.
Kernel crash risk in Linux KVM's AMD SEV-SNP guest launch path allows a local attacker with KVM vCPU management privileges to crash the host by exploiting a missing vCPU lock during VMSA synchronization. The SEV-SNP `KVM_SNP_LAUNCH_FINISH` path failed to lock all vCPUs before encrypting their save areas, permitting concurrent userspace manipulation that corrupts per-vCPU state or triggers a kernel panic. No public exploit code has been identified and the EPSS score of 0.02% (4th percentile) reflects extremely low exploitation probability, making this a targeted concern for AMD EPYC-based KVM hypervisors running SNP guests.
Deadlock in the Linux kernel WireGuard subsystem can cause a hung task and system-level denial of service for authenticated local users. The `wg_netns_pre_exit()` pernet callback manually acquires `rtnl_lock()`, blocking indefinitely if `rtnl_mutex` is concurrently held by the `cleanup_net` workqueue or `setup_net` failure rollback path. No public exploit exists and EPSS is extremely low (0.02%, 4th percentile); however, the issue spans a broad range of kernel versions and has been patched in stable releases 6.18.24, 6.19.14, and 7.0.1.
NULL pointer dereference in the Linux kernel's nilfs2 filesystem driver allows a local, low-privileged attacker to crash the kernel by invoking the NILFS_IOCTL_CLEAN_SEGMENTS ioctl immediately after mounting a nilfs2 filesystem, before the DAT inode's btree node cache is lazily initialized. The impact is a general protection fault and full denial of service; no confidentiality or integrity impact is possible. No public exploit is known at time of analysis, and EPSS at 0.02% (5th percentile) reflects extremely low real-world exploitation probability.
NULL pointer dereference in the Linux kernel's MediaTek DSI DRM driver causes a kernel panic during module initialization on ARM64 systems with MediaTek display hardware. The crash occurs because `mipi_dsi_host_register` triggers the `mtk_dsi_bind` callback before the `mtk_dsi` struct is stored in driver data, dereferencing a NULL pointer inside `drm_mode_object_add` and acquiring `mode_config.idr_mutex` before panicking - blocking all subsequent DRM operations on the system. No public exploit exists and EPSS stands at 0.02%, consistent with a hardware-specific local denial-of-service with no confidentiality or integrity impact.
The Linux kernel's x86 FRED (Flexible Return and Event Delivery) initialization path crashes AMD SEV-ES, SEV-SNP, and Intel TDX confidential VM guests via triple fault when any exception is triggered during the brief AP initialization window before FRED MSRs are configured. A prior attempted mitigation introduced a secondary risk: temporarily disabling CR4 pinning for offline CPUs created a path where a local attacker could flip a single RW-memory bit (the CPU online flag) to suppress CR4 security controls and disable SMEP/SMAP protections. No public exploit has been identified at time of analysis; EPSS is 0.02% (5th percentile), consistent with the narrow real-world exploitability of this flaw.
Null pointer dereference in the Linux kernel's spi-dw-dma driver crashes the system when an error occurs during a DMA transaction and the current SPI message pointer is NULL at the time error-log printing is attempted. Systems running the DesignWare SPI DMA driver are exposed to a local denial-of-service condition triggerable by a low-privileged user. No public exploit exists and EPSS probability is 0.02% (5th percentile), indicating negligible current exploitation interest; however, the crash path is deterministic once the error condition is induced.
Null pointer dereference in the Linux kernel's LoongArch architecture code can crash the kernel during early boot when kstrdup() fails to allocate memory while parsing CPU model strings from the device tree. Affected systems running unpatched kernels on LoongArch hardware may experience a kernel oops and complete system unavailability if memory is exhausted at boot time. No public exploit exists and EPSS is 0.02% (6th percentile), reflecting very low exploitation probability; this is not listed in CISA KEV.
NULL pointer dereference in the Linux kernel's cp2615 i2c driver crashes the kernel when a USB device lacking a serial number string is probed, resulting in denial of service. The cp2615 driver unconditionally uses the USB serial string as the i2c adapter name without first verifying the pointer is non-NULL, a flaw exploitable by connecting a crafted or malformed CP2615 USB-to-I2C bridge device. No active exploitation is confirmed (not in CISA KEV) and the EPSS score of 0.02% at the 7th percentile reflects negligible exploitation interest; impact is limited to availability with no code execution or data exposure possible.
NULL pointer dereference in the Linux kernel bonding driver's RLB debug interface allows a local low-privileged user to crash the kernel, causing a denial of service. Specifically, bond_debug_rlb_hash_show in bond_debugfs.c dereferences client_info->slave without a NULL guard - a condition intentionally created by rlb_clear_slave when no replacement bonding slave is available - producing a BUG: kernel NULL pointer dereference at address 0x0. Affected across multiple stable kernel trees from 5.10.x through 7.0; no public exploit code exists and EPSS is 0.02%, consistent with low opportunistic risk, though Siemens PSIRT has issued downstream advisories (SSA-019113, SSA-082556) indicating industrial/embedded impact.
A NULL pointer dereference in the Linux kernel ARM SCMI firmware driver allows local authenticated users to trigger a denial of service by causing the system to crash. The vulnerability exists in the __scmi_event_handler_get_ops helper function, which can return NULL instead of the expected ERR_PTR on failure, causing downstream code to dereference a NULL pointer when handling unsupported SCMI events. The flaw was introduced in commit b5daf93b809d1 and affects multiple stable kernel versions; patches are available in Linux 6.18.20, 6.19.10, and 7.0.
Debug logging in the Linux kernel's crash_dump module exposes dm-crypt key material when debug logging is enabled, allowing local privileged users to read encryption keys from kernel logs and potentially cause denial of service through availability impact on crash dump functionality. The vulnerability affects Linux kernel versions prior to 6.18.20, 6.19.10, and 7.0, with an EPSS score of 0.02% indicating low exploitation probability despite the information disclosure risk.
A null pointer dereference in the i915 GPU driver's graphics translation table (GT) submission logic causes kernel panic and denial of service when the i915 firmware binaries are absent and the system attempts to suspend. Local authenticated attackers with normal user privileges can trigger this crash by initiating system suspend on affected Intel graphics systems without required firmware, resulting in denial of service. No public exploit code identified at time of analysis; EPSS score of 0.02% indicates low exploitation probability in practice.
Denial of service in Hostbill versions 2025-11-24 and 2025-12-01 allows remote unauthenticated attackers to degrade service availability through the Checkout Authentication Flow component via uncontrolled resource consumption (likely improper rate limiting). The vulnerability has a low-to-moderate CVSS score (5.3) reflecting limited impact scope, but exploitation requires no authentication or user interaction and can be triggered over the network.
Denial of service via improper resource handling in the Client Balance component of Hostbill v.2025-11-24 and v.2025-12-01 allows high-privileged remote attackers to disrupt service availability and trigger limited integrity impacts. The vulnerability stems from insufficient input validation in CWE-400 (Uncontrolled Resource Consumption), requiring administrator-level access but presenting moderate real-world risk due to the low attack complexity and network accessibility of the affected component.
Denial of service in OpenClaw versions 2026.2.26 through pre-2026.3.31 allows unauthenticated remote attackers to exhaust the shared pending pairing-request window on multi-account channel deployments, blocking legitimate accounts from initiating new pairing or onboarding. The root flaw is a quota-scoping error: the cap on pending requests was enforced per channel file rather than per account, so one actor's requests consume capacity allocated to unrelated accounts. The GHSA advisory confirms this is an availability-only impact - no cross-account data access, approval, or authorization bypass is possible. No public exploit or CISA KEV listing exists; EPSS probability is 0.10%, reflecting minimal real-world exploitation pressure at time of analysis.
Denial of service in go-ntlmssp (pkg:go/github.com/Azure/go-ntlmssp) versions prior to 0.1.1 allows a malicious HTTP server to crash any Go process that uses ntlmssp.Negotiator as its HTTP transport by returning a crafted NTLM challenge message. The malformed payload triggers a slice out-of-bounds panic - a fatal runtime condition in Go - causing complete process termination. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS at 0.06% (18th percentile) reflects very low opportunistic exploitation probability at time of analysis.
Unbounded HTTP response body allocation in OpenTelemetry.Sampler.AWS allows an attacker who controls the configured X-Ray sampling endpoint or who holds a network MitM position to exhaust heap memory and crash the consuming .NET process via OutOfMemoryException. Both NuGet packages OpenTelemetry.Sampler.AWS (versions below 0.1.0-alpha.8) and OpenTelemetry.Resources.AWS (versions below 1.15.1) are affected, with AWSXRaySamplerClient.DoRequestAsync calling ReadAsStringAsync() with no response size cap. No public exploit has been identified and EPSS sits at 0.01% (2nd percentile), consistent with SSVC exploitation status of none and CISA KEV absence, making this a low-urgency but patchable DoS risk.
Uncontrolled memory allocation in OpenTelemetry dotnet's propagation header parsing exposes .NET applications to denial of service. OpenTelemetry.Api versions 0.5.0-beta.2 through 1.15.2 and OpenTelemetry.Extensions.Propagators versions 1.3.1 through 1.15.2 contain BaggagePropagator, B3Propagator, and JaegerPropagator implementations that eagerly allocate intermediate arrays before enforcing size limits, allowing malformed headers with excessive delimiter characters to trigger disproportionate memory consumption. No active exploitation is confirmed (not in CISA KEV), EPSS is extremely low at 0.02%, and a vendor-released patch exists at version 1.15.3.
Memory exhaustion via unbounded protobuf allocation in OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) affects versions 1.13.1 through 1.15.2 when exporting telemetry over OTLP/gRPC. An attacker controlling the gRPC collector endpoint or intercepting telemetry traffic can return a malformed grpc-status-details-bin trailer on a retryable response, causing the instrumented .NET process to attempt an arbitrarily large byte array allocation and exhaust available memory. No public exploit exists and SSVC confirms no active exploitation; a vendor patch is available in 1.15.3.
Heap-based buffer overflow in Libgcrypt before 1.12.2 allows local attackers to trigger denial of service and corrupt memory via crafted ECDH ciphertext passed to gcry_pk_decrypt, affecting cryptographic operations in dependent applications including GnuPG. No public exploit code or active exploitation has been identified at time of analysis; vendor has released patched versions 1.10.4, 1.11.3, and 1.12.2 to resolve the vulnerability.
Authenticated users can trigger a denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 for Linux, UNIX, and Windows through improper neutralization of special elements in database query logic, causing service unavailability without requiring user interaction or special configuration. The vulnerability affects both standalone Db2 instances and Db2 Connect Server deployments, with CVSS 6.5 reflecting network accessibility and authenticated access requirements. No public exploit code or active exploitation has been identified at the time of analysis.
OpenMcdf fails to detect cycles in Compound File Binary (CFB) directory entry red-black trees, causing indefinite loops in Storage.EnumerateEntries() and Storage.OpenStream() when processing crafted CFB files with sibling ID cycles. This denial-of-service vulnerability consumes the calling thread permanently with no recovery path via exception handling, affecting any application opening untrusted CFB documents. Patch available in version 3.1.3.
Denial of service in nimiq-libp2p prior to version 1.3.0 allows remote peers to exhaust node resources by sending partial frames on inbound substreams and keeping them open. The vulnerability combines unbounded stream reading via `read_to_end()` with a high concurrent stream limit of 1000, enabling attackers to accumulate stalled slots and degrade network availability without authentication or user interaction.
Nimiq Core-rs-Albatross prior to v1.3.0 crashes when processing malformed transaction inclusion proofs with mismatched history and positions arrays. A remote attacker can trigger a denial of service by sending a crafted ResponseTransactionsProof with unequal array lengths, causing the HistoryTreeProof::verify function to panic. The vulnerability requires high attack complexity and user interaction, limiting real-world impact despite network accessibility.
Denial of service in Nimiq's vesting contract allows remote unauthenticated attackers to crash nodes by crafting a vesting contract with `total_amount` exceeding the actual contract balance, then triggering a panic during error handling when `min_cap > balance`. The vulnerability exploits insufficient validation of vesting contract creation data and integer underflow in the `Coin::sub` operation, affecting all versions before 1.3.0. Active exploitation would require ability to broadcast transactions to the Nimiq network.
The env utility in uutils coreutils incorrectly rejects valid backslash escape sequences in single-quoted strings when using the -S (split-string) option, terminating with exit status 125 and causing local denial of service for scripts relying on GNU env compatibility. The implementation performs overly strict validation that diverges from GNU behavior, where backslashes outside of \\ and \' are treated literally rather than invalid, breaking automated administrative workflows.
The ln utility in uutils coreutils fails to process source paths containing non-UTF-8 filename bytes when using target-directory forms, rejecting valid filenames that GNU ln handles correctly. This logic error affects automated scripts and system tasks on Unix filesystems where non-UTF-8 filenames are common, causing denial of service for those specific operations. SSVC classifies exploitation as possible (POC available) but not automatable, with partial technical impact.
Local denial of service in uutils coreutils kill utility before version 0.6.0 allows unprivileged users to crash the system or terminate all visible processes by exploiting incorrect argument parsing that sends SIGTERM to PID -1 instead of reporting a missing PID argument. The vulnerability requires local access and can be triggered without user interaction, distinguishing it from the correct behavior in GNU coreutils where -1 is interpreted as a signal number rather than a process identifier.
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across filesystem boundaries, allowing local authenticated users to trigger resource exhaustion via disk space consumption, disclose sensitive data through unexpected file duplication, or cause denial of service through infinite symlink loop recursion. Affected versions prior to 0.7.0 are vulnerable; a vendor-released patch is available.
The cp utility in uutils coreutils versions before 0.7.0 incorrectly handles recursive copy operations (-R flag) by converting character and block device nodes into regular files instead of preserving them via mknod, destroying device semantics and enabling denial of service through disk exhaustion or process hangs when unbounded device nodes are copied.
The sort utility in uutils coreutils crashes with a process panic when the --files0-from option processes inputs containing non-UTF-8 filenames, allowing local authenticated attackers to cause denial of service. Unlike GNU sort, which handles filenames as raw bytes, uutils enforces UTF-8 encoding via expect() calls that immediately panic on invalid sequences. A proof-of-concept exploit exists; SSVC analysis indicates partial technical impact with non-automatable exploitation.
Authenticated users can trigger denial of service in GitLab CE/EE versions 10.6 through 18.11.0 by sending crafted requests to the discussions endpoint that exhaust server resources. The vulnerability requires valid authentication credentials and affects all affected versions across the 10.6, 18.9, 18.10, and 18.11 release branches. Publicly available exploit code exists; CISA has not yet listed this in the Known Exploited Vulnerabilities catalog, but active exploitation likelihood is moderate given public POC availability and the low complexity of resource exhaustion attacks.
Authenticated users can trigger denial of service in GitLab by overwhelming system resources through the GraphQL API due to insufficient resource allocation limits. Affected versions span from 12.4 through 18.11.0 across three release branches. Publicly available exploit code exists, though active exploitation has not been confirmed in CISA KEV. CVSS 6.5 reflects moderate severity with high availability impact but requires valid authentication.
Denial of service in GitLab CE/EE affects authenticated users who can trigger resource exhaustion when retrieving notes under specific conditions, causing service unavailability. Versions 9.2 through 18.9.5, 18.10.0 through 18.10.3, and 18.11.0 are vulnerable. An authenticated attacker with standard user privileges can exploit this remotely without user interaction via crafted note retrieval requests. A publicly available exploit exists, and patches have been released by GitLab.
Denial of service in GitLab CE/EE versions 12.3 through 18.11.0 allows authenticated users to trigger excessive resource consumption during issue import operations due to improper input validation on user-supplied data. The vulnerability affects all minor versions from 12.3 onwards until patched versions 18.9.6, 18.10.4, and 18.11.1. Publicly available exploit code exists, and CISA SSVC assessment indicates the vulnerability is exploitable but not automatable at scale.
Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Libefiboot in efivar fails to validate that EFI device path node length fields meet the 4-byte minimum requirement, allowing local users to trigger infinite recursion and stack exhaustion via crafted device paths. The vulnerability requires user interaction but causes denial of service by crashing affected processes, with no privilege escalation or data compromise. No active exploitation has been confirmed at the time of analysis.
Memory corruption in GNU Emacs SVG/CSS processing allows local attackers to trigger denial of service or information disclosure by convincing users to open specially crafted SVG files. The vulnerability requires user interaction (file opening) and local access, but results in significant impact including service disruption and potential data leakage through memory corruption exploitation.
Denial of service in PowerDNS secondary servers occurs when a rogue primary server sends crafted DNS update requests that cause file descriptor exhaustion on the secondary, eventually rendering the secondary unable to process legitimate DNS queries. The attack requires network-level coordination between a compromised or attacker-controlled primary server and a target secondary server, with moderate attack complexity due to the need to establish a primary-secondary relationship. No active exploitation has been confirmed in CISA KEV at time of analysis.
DNSdist is vulnerable to denial of service via out-of-bounds write when processing crafted UDP responses from a rogue backend server. An attacker controlling a backend DNS server can send a specially crafted UDP response with a query ID set off-by-one from the maximum configured value, triggering memory corruption that crashes the DNS forwarder. The CVSS score of 6.5 reflects network attack vector with high complexity and absence of confidentiality impact, though availability and integrity are affected.
Denial of service in dnsdist via crafted PRSD (PowerDNS Response Detection) queries causes assertion failure and service disruption on remote DNS resolvers. The vulnerability requires specific network conditions and crafted packet construction (AC:H) but affects default configurations without authentication. CVSS 3.7 reflects low availability impact with non-trivial exploitation complexity.
dnsdist allows remote denial-of-service attacks through memory exhaustion by generating numerous error responses on single DoQ (DNS-over-QUIC) and DoH3 (DNS-over-HTTPS/3) connections. An unauthenticated remote attacker can trigger excessive memory allocation by rapidly sending queries that produce error responses, with resources not properly released until connection termination. CVSS 5.3 (AV:N/AC:L/PR:N/UI:N) reflects network-accessible availability impact; no public exploit identified at time of analysis.
dnsdist can be forced into excessive memory allocation when a client generates high volumes of DNS queries routed to an overloaded DNS-over-HTTPS (DoH) backend, causing queries to accumulate in an unbounded buffer that persists until connection closure. This denial-of-service condition affects dnsdist deployments with DoH backends under load, allowing unauthenticated remote attackers to exhaust server memory with sustained query traffic.
DNSdist allows remote attackers to create unlimited concurrent DoQ (DNS over QUIC) or DoH3 (DNS over HTTPS/3) connections, triggering unbounded memory allocation and denial of service. The vulnerability affects configurations where these protocols are explicitly enabled, as both are disabled by default. No authentication is required for exploitation, and CVSS 5.3 (AC:L, AV:N) indicates straightforward network-based triggering under default conditions.
A denial-of-service vulnerability in the Linux kernel's Btrfs filesystem implementation allows local authenticated attackers to cause filesystem corruption and crashes through a race condition during subvolume creation and lookup. When a newly created Btrfs subvolume's dentry cache is dropped before the BTRFS_ROOT_ORPHAN_CLEANUP flag is set, concurrent orphan cleanup operations can fail with ENOENT, creating negative dentries that prevent subvolume deletion and cause filesystem aborts. EPSS score of 0.02% indicates this is a low-probability exploitation scenario requiring specific timing and configuration conditions, though the impact is severe for affected systems. No public exploit code is identified at time of analysis.
Denial of service in Linux kernel af_key module allows local authenticated attackers to crash the system via buffer overflow in pfkey_send_migrate() function. The vulnerability occurs because pfkey_send_migrate() fails to validate address family parameters before passing them to set_ipsecrequest(), causing truncation that overfills the socket buffer and triggers kernel panic in skb_put(). EPSS score of 0.02% indicates minimal real-world exploitation risk despite moderate CVSS severity.
Null pointer dereference in the Linux kernel Bluetooth L2CAP implementation allows local authenticated attackers to cause a kernel panic and denial of service via the l2cap_sock_ready_cb function during L2CAP connection initialization. The vulnerability occurs when a socket pointer is dereferenced without null validation, triggering a KASAN null-ptr-deref exception that crashes the kernel. EPSS score of 0.02% indicates low real-world exploitation probability despite the moderate CVSS score; no public exploit code or active KEV listing has been identified at time of analysis.
Denial of service via infinite loop in Bluetooth L2CAP ERTM reconfiguration allows local authenticated attackers to exhaust system memory. The vulnerability arises from two distinct flaws: improper handling of L2CAP channel reconfiguration that leaks ERTM resources and fails to validate minimum PDU size, causing an infinite loop in l2cap_segment_sdu() when remote_mps is set to zero. EPSS score of 0.02% indicates limited exploitation likelihood despite the high CVSS score, reflecting the requirement for local access and authenticated Bluetooth channel state.
Kernel panic via null pointer dereference in the tracing subsystem occurs when boot-time trigger registration fails and kthread creation does not succeed, allowing deferred trigger frees to accumulate indefinitely and crash the system. Local authenticated attackers can trigger this by specifying malformed trace event parameters on the kernel command line, resulting in denial of service. EPSS exploitation probability is 0.02% (very low) despite moderate CVSS score, suggesting this requires specific boot-time configuration and local access.
Denial of service in Linux kernel IPTFS (IP Traffic Flow Security) subsystem allows local authenticated attackers to trigger an infinite loop via crafted ESP packets with malformed inner IPv4 headers containing tot_len=0. The vulnerability bypasses input validation in __input_process_payload() that should reject IPv4 packets where tot_len is less than the header length, causing the kernel to spin indefinitely in softirq context and hang the system.
Memory leak in Linux kernel DAMON subsystem allows local authenticated users to exhaust system memory via failed allocation in damon_sysfs_new_test_ctx(), causing denial of service. The vulnerability affects kernel versions 6.17.6 through 7.0-rc1 when DAMON_SYSFS is enabled. A privileged user can trigger the leak by making specific control sequences that cause early function returns, bypassing cleanup code and leaving param_ctx unfreed.
Denial of service via null pointer dereference in Linux kernel DAMON sysfs module allows local privileged users to crash the system by setting nr_contexts to zero while DAMON is running, then issuing state-change commands that dereference an empty contexts array without bounds checking. EPSS exploitation probability is minimal at 0.02%, reflecting the requirement for local privileged access and active DAMON configuration.
Null pointer dereference in Linux kernel DAMON sysfs interface allows local authenticated users to cause denial of service by setting nr_contexts to zero while DAMON is running, triggering dereference of uninitialized context array pointers in damon_sysfs_repeat_call_fn(). The vulnerability requires local access and low-level privileges (non-root user with sysfs write access), with an EPSS exploitation probability of 0.02% indicating low real-world attack likelihood despite the straightforward trigger mechanism.
Null pointer dereference in Linux kernel DAMON subsystem allows local authenticated attackers to cause denial of service when memory allocation failures occur during online parameter updates. The vulnerability affects DAMON's context commit mechanism (damon_commit_ctx), which can partially corrupt kernel state if internal memory allocation fails, potentially leading to NULL pointer dereference in damos_commit_dests(). While real-world impact is rare due to the low probability of allocation failure, the severe consequence of kernel panic necessitates this fix.
Denial of service in the Linux kernel dmaengine idxd subsystem allows local attackers with low privileges to crash the system by triggering a Function Level Reset when the hardware does not support event log reporting. The vulnerability occurs when the driver attempts to restore or free an event log that was never allocated, resulting in a kernel crash with high availability impact.
Kernel panic in the Linux netfs subsystem's netfs_limit_iter() function crashes systems when a process writes a core dump to a 9P-mounted filesystem. The function handles only ITER_FOLIOQ, ITER_BVEC, and ITER_XARRAY iterator types, triggering a hard BUG() when __kernel_write() supplies an ITER_KVEC iterator via netfs_unbuffered_write(), producing a local denial of service via kernel panic. No public exploit code exists and no active exploitation has been identified; this is a no public exploit identified at time of analysis scenario with EPSS at 0.02% (5th percentile), indicating minimal widespread exploitation interest.
NULL pointer dereference in the Linux kernel's netfs subsystem crashes the kernel when retrying unbuffered writes on filesystems that omit the prepare_write stream operation, such as 9P. A local low-privilege user who can write to such a mounted filesystem and induce a get_user_pages() -EFAULT failure can trigger a kernel panic, causing a denial of service. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects negligible observed exploitation probability; the vulnerability is not listed in CISA KEV.
Denial of service in PowerDNS Recursor via null pointer dereference in the zoneToCache function when processing zone data from a malicious authoritative server. Affects Recursor 5.2.0 through 5.4.0 and requires high privileges and non-standard network conditions to exploit, resulting in service availability impact but not data compromise. Patch available from vendor.
Null pointer dereference in PowerDNS Recursor allows remote attackers to trigger a denial of service by sending crafted DNS replies that bypass a missing consistency check. The vulnerability affects Recursor versions 5.2.0 through 5.2.8, 5.3.0 through 5.3.5, and 5.4.0, with CVSS 5.9 reflecting high availability impact but requiring special network conditions (AC:H). No public exploit code identified at time of analysis.
PowerDNS Recursor versions 5.2.x, 5.3.x, and 5.4.0 are vulnerable to denial of service when processing a zone transition from NSEC to NSEC3 DNSSEC record types, causing internal inconsistency and resolver unavailability. The vulnerability requires network access but elevated attack complexity, affecting recursive DNS resolvers in production environments. Vendor patches are available for all affected branches.
Denial of service in PowerDNS Authoritative, Recursor, and dnsdist via unbounded memory allocation in their internal web servers when processing specially crafted web requests. Multiple product lines are affected across several version ranges. The internal web server is disabled by default, significantly limiting real-world exposure. A vendor-released patch is available. CVSS 5.3 (low severity) with network-accessible vector but no authentication required reflects the ease of exploitation offset by the availability limitation and DoS-only impact.
PowerDNS Recursor versions 5.2.0-5.2.8, 5.3.0-5.3.5, and 5.4.0 suffer denial of service and potential data corruption when a malfunctioning RPZ provider causes concurrent transfers of the same RPZ zone, leading to use-after-free conditions, inconsistent zone data, and recursor crashes. The vulnerability requires high privilege attacker control over an RPZ provider and non-standard network conditions, resulting in availability and integrity impact with a CVSS score of 5.0.
Denial of service in PowerDNS Recursor allows remote unauthenticated attackers to exhaust resolver memory by publishing and querying crafted DNS zones that trigger excessive allocation in the negative and aggressive NSEC(3) caches. The vulnerability affects Recursor versions 5.2.0-5.2.8, 5.3.0-5.3.5, and 5.4.0, with a CVSS score of 5.3 reflecting low severity due to availability impact only (no code execution or data breach). Vendor-released patches are available.
Unlimited memory allocation in PowerDNS internal web server allows remote denial of service via crafted web requests. The vulnerability affects multiple PowerDNS products (dnsdist, Authoritative, and Recursor) across multiple versions, though the internal web server is disabled by default, significantly limiting real-world exposure. CVSS 5.3 reflects low attack complexity and no authentication requirements, but the default-disabled state and requirement to enable the internal web server substantially reduce practical risk.
Denial of service via unlimited memory allocation in PowerDNS Recursor's internal web server affects versions 5.2.0-5.2.8, 5.3.0-5.3.5, and 5.4.0. An unauthenticated remote attacker can send a crafted web request to exhaust server memory when the internal web server is enabled, causing service unavailability. No public exploit code or active exploitation has been identified, but patch versions are available from the vendor.
Denial of service in PowerDNS Recursor occurs when processing a malicious Response Policy Zone (RPZ) from an authoritative server, triggering a null pointer dereference due to missing validation logic. Versions 5.2.0-5.2.8, 5.3.0-5.3.5, and 5.4.0 are affected. An authenticated remote attacker controlling an authoritative nameserver can crash the Recursor service by sending a specially crafted RPZ response, requiring high privilege level (PR:H) and complex attack conditions (AC:H) as mitigating factors.
The readelf utility in binutils is vulnerable to denial of service through two distinct flaws triggered by maliciously crafted ELF files: a resource exhaustion vulnerability (CWE-400) causing out-of-memory conditions and a null pointer dereference (CWE-476) causing segmentation faults. Both vulnerabilities require local access and user interaction to open a malicious file, resulting in the readelf utility crashing or becoming unresponsive. No public exploit code or active exploitation has been identified at the time of analysis.
Format string vulnerability in nano's statusline() function allows local users to trigger a segmentation fault via directory names containing printf specifiers, causing denial of service. Exploitation requires user interaction (opening a directory with the crafted name) on systems where nano is available to local users. No public exploit code identified at time of analysis.
The readelf utility in binutils is vulnerable to denial of service through null pointer dereference when processing specially crafted ELF files. A local attacker with limited privileges can trigger excessive resource consumption or program crashes by convincing a user to process a malicious ELF binary, affecting Red Hat Enterprise Linux 6, 7, 8, and 10. No public exploit code or active exploitation has been confirmed at this time.
CRLF injection in HTTP Headers WordPress plugin up to version 1.19.2 allows authenticated administrators to inject arbitrary Apache directives into .htaccess files via unsanitized custom header fields, causing configuration parse errors and potential site-wide denial of service. Attack requires Administrator-level WordPress access and no user interaction. CVSS 5.5 reflects high availability impact (A:H) balanced against high privilege requirements (PR:H).
Uncontrolled resource consumption in Tanium Interact allows authenticated high-privilege administrators to trigger a denial of service condition through network-accessible endpoints. The vulnerability requires high-level administrative privileges (PR:H) and produces only availability impact with no confidentiality or integrity compromise. CVSS base score of 2.7 reflects the severe privilege barrier and limited impact scope.
Unbounded memory allocation in Tekton Pipelines' HTTP resolver allows any authenticated tenant to crash the shared resolver pod for an entire Kubernetes cluster. The `FetchHttpResource` function reads HTTP response bodies without a byte-level size cap, so a low-privileged user who can create TaskRuns or PipelineRuns can direct the resolver at an attacker-controlled server delivering multi-gigabyte responses, exhausting the pod's 4 GiB memory limit and triggering an OOM-kill. Because all resolver types - Git, Hub, Bundle, Cluster, and HTTP - share the same `tekton-pipelines-resolvers` pod, repeated exploitation causes a sustained crash loop that denies CI/CD pipeline resolution to every tenant on the cluster. A PoC is included in the GHSA advisory and SSVC confirms exploit code exists; however, no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
Uncontrolled resource consumption in Sanluan PublicCMS versions 6.202506.a through 6.202506.d enables low-privileged remote attackers to trigger denial-of-service conditions by manipulating the ZipSecureFile.setMinflateRatio function within the document-to-HTML conversion utility DocToHtmlUtils.java. The flaw (CWE-400) causes the server to exhaust resources when processing attacker-controlled input through the affected code path. No public exploit exists, EPSS sits at 0.03% (10th percentile), SSVC confirms no known exploitation and non-automatable attack profile - real-world priority is low for most deployments, though the vendor's non-response to disclosure leaves patch status unresolved.
Partial denial-of-service in Oracle VM VirtualBox 7.2.6 Core component allows a locally authenticated, high-privileged attacker to degrade availability of the hypervisor. Exploitation is limited to the local system and requires pre-existing administrative-level access, with no confidentiality or integrity impact. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog; EPSS at 0.01% (2nd percentile) reflects near-zero exploitation probability.
Oracle VM VirtualBox 7.2.6 contains an improper access control flaw in its Core component that enables a highly privileged local attacker to partially compromise confidentiality, integrity, and availability - with a scope change indicating potential bleed beyond the VirtualBox process boundary to adjacent products or guest VMs on the same host. Exploitation requires local logon with high privileges and high attack complexity, making opportunistic exploitation unlikely; EPSS at the 2nd percentile and SSVC exploitation status of 'none' corroborate low real-world risk. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog.
Improper access control in the IDM Authentication component of Oracle Life Sciences InForm 7.0.1.0 and 7.0.1.1 exposes the platform to unauthenticated network-based attacks over HTTP that require victim user interaction to succeed. Successful exploitation yields unauthorized partial read, write/delete, and denial-of-service impact against InForm clinical trial data. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' confirm minimal real-world threat at this time.
Local denial-of-service in MySQL Shell's Core Client component allows a low-privileged OS user, with required interaction from a legitimate victim user, to repeatedly crash or hang the MySQL Shell process across three active release branches. Affected deployments span 8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0, as confirmed by Oracle's April 2026 CPU. EPSS sits at the 2nd percentile with no public exploit code and no CISA KEV listing, placing this squarely in the routine-patching tier rather than emergency response.
Denial-of-service in Oracle MySQL Shell's Core Client component allows a low-privileged local attacker, with required human interaction from another user, to cause a hang or repeatable crash of MySQL Shell across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit has been identified, EPSS sits at 0.01% (2nd percentile), and SSVC assesses exploitation as 'none' with non-automatable attack conditions - all signals converging on minimal real-world risk. Impact is strictly limited to availability; there is no confidentiality or integrity exposure.
Denial-of-service in Oracle MySQL Server's JSON component allows authenticated low-privileged network users to hang or repeatedly crash the database server across all three supported release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The flaw is classified as CWE-400 (Uncontrolled Resource Consumption), meaning specially crafted JSON-related queries exhaust server resources without adequate bounds checking. No public exploit code or active exploitation has been identified; EPSS of 0.04% at the 12th percentile and SSVC 'Exploitation: none' together confirm this is not under active threat at time of analysis.
Denial-of-service in MySQL Server's InnoDB component allows high-privileged authenticated attackers with network access to crash or hang the database server via multiple protocols. Affected versions span three major release lines - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - covering a broad footprint of Oracle MySQL deployments including downstream Red Hat and SUSE packages. Proof-of-concept exploit code exists per SSVC classification, though EPSS stands at 0.04% (11th percentile) with no CISA KEV listing, indicating low observed exploitation probability consistent with the high-privilege prerequisite.