Denial of Service

Heap exhaustion denial of service in FasterXML jackson-core 2.16.0 and later allows an unauthenticated remote attacker to force allocation of roughly 100 MB or more per oversized JSON property name whenever untrusted JSON is parsed from a character-based source (String, Reader, or char[]), which is the normal path for a request body already read into a String. Because the maxNameLength bound (default 50,000 characters, ~100 KB) is only validated after the entire name has been buffered, the much larger maxStringLength bound (default 100,000,000 characters, roughly 200 MB with segment bookkeeping overhead) governs first, and repeating this across concurrent requests can exhaust the heap and crash the process. The impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.

Unauthenticated attackers with network reachability to the Boa-based web management interface of a Netcore NR256CN router (firmware through 1.5.140116) can crash the device's main Boa process by sending a Basic Authorization header whose base64-decoded value contains no colon separator - for example a value that decodes to a single character - to an auth-protected CGI route such as /router/get_user_type.cgi. The outcome is a denial of service that terminates the management interface until the web server process is restarted; per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) there is no confidentiality or integrity impact and no code execution, and real-world risk is bounded by whether the management interface is reachable outside the LAN. No vendor patch is identified in the available data and no public exploit code is confirmed at time of analysis, though the trigger itself is trivially crafted once the interface is reachable.

Local privilege escalation in Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 allows a low-privileged local user to gain elevated privileges and, in some exploitation paths, to disrupt the service and cause denial of service. The victim must already have an authenticated local session on the affected machine (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0); attack complexity is high, indicating a non-deterministic race or specific runtime state is required rather than a reliable one-shot trigger, and no user interaction is needed. No public exploit code has been identified at time of analysis, no CISA KEV listing is present, and no EPSS score was provided, so this should be treated as a moderate-priority local hardening issue rather than an urgent remote-exploitation emergency.

Memory corruption in RIOT OS (versions prior to 2026.04) with the ATWINC15x0 Wi-Fi driver and MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled allows an adjacent unauthenticated attacker to trigger a buffer overflow by advertising a malformed or oversized SSID, potentially leading to a hard fault, denial of service, or code execution. Exploitation requires the device to perform a Wi-Fi scan and the attacker to be within radio range. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 2026.04.

Integer overflow in RIOT OS nanocoap CoAP server allows remote unauthenticated attackers to trigger out-of-bounds memory access, denial of service, or memory corruption by sending a crafted Block2 option with a block number exceeding the 20-bit maximum. Affected versions are prior to 2026.07, specifically builds around master baseline commit aeeae69e on 32-bit targets. No public exploit code or active exploitation has been identified at time of analysis. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

Algorithmic resource exhaustion in destructive_command_guard (dcg) versions prior to 0.6.6 lets a crafted shell command - a destructive command followed by nested or unclosed $( or $(( substitution sequences - trigger exponential-time rescans in the split_command_segments scanners (src/packs/mod.rs), hanging the process. Because dcg runs as a PreToolUse guard hook for AI coding agents and that hook fails open on timeout, the hang does not block the command but instead allows the destructive command to be executed - turning a denial-of-service bug (CWE-400) into a safety-control bypass with high integrity impact. The issue is rated 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating a local attack path with no privileges required but requiring user interaction (the command must actually be submitted), and the fix is the vendor-released version 0.6.6; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.

Unauthenticated denial of service in Countly Server prior to 24.05.50 and 25.03.44 lets any remote network attacker crash the Node.js process that serves the analytics API by requesting a public image or screenshot route (star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and other */screenshots/* paths) whose path contains a URL-encoded dot. On deployments using Countly's local filesystem storage backend, that crafted path makes createReadStream open a directory instead of a file; the resulting asynchronous EISDIR error has no listener on the piped stream, so it surfaces as an unhandled exception and terminates the server process. Repeated requests keep the API unavailable; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a low-complexity, unauthenticated, availability-only impact with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was identified at time of analysis.

Denial of service in mz-automation libIEC61850 prior to 1.6.2 allows an unauthenticated remote peer to exhaust CPU indefinitely by sending a malformed ACSE AARE PDU during association establishment. The bug is an out-of-bounds read (CWE-125) in parseUserInformation when a truncated long-form BER length makes BerDecoder_decodeLength return a negative position that is not validated, leading to a buffer[-1] access and a parse-reset loop; a process abort is possible only when the preceding byte lies on an inaccessible memory page, making that outcome memory-layout dependent. No public exploit code or active exploitation was identified at time of analysis, and the assessed impact is availability only (CVSS 3.1 7.5), not code execution or data disclosure.

Denial of service in mz-automation libIEC61850 before 1.6.2 lets a remote, unauthenticated attacker crash IEC 61850 servers by sending a single defineNamedVariableList MMS request. The bug is a stack out-of-bounds read (CWE-125) in checkDataSetAccess, where source and destination arguments are reversed in a StringUtils_copyStringToBuffer call used to build an MMS_ASSOCIATION_SPECIFIC dataset reference, so an uninitialized 130-byte stack buffer is treated as a source string and strlen walks past its bounds before those bytes are copied into the caller-owned listName buffer. Exposure is conditional: the server must have the dynamic dataset service enabled and a dataset access handler installed, both non-default integration choices, but any network-reachable server configured that way is trivially hit for a full loss of availability; the vulnerability is fixed in release v1.6.2 and no public exploit code was identified at time of analysis. No CISA KEV entry is associated with this CVE, and the tags indicating information disclosure reflect leaked stack bytes rather than a confirmed confidentiality breach, since the assessed impact is availability-only.

Remote MMS Read requests can crash libIEC61850 MMS servers running versions prior to 1.6.2 when the server's data model contains array-typed variables. An unauthenticated attacker (CVSS vector PR:N, AV:N) sends an alternate-array-access read with numberOfElements greater than zero and a sub-array range that exceeds the array bounds; the resulting out-of-range MmsValue_getElement call returns NULL, which is then passed to MmsValue_isDeletable and dereferenced, producing a NULL pointer dereference and process crash. Impact is availability-only (CVSS 7.5, C:N/I:N/A:H) and scoped to the array sub-access code path, since the single-element error path handles the same invalid index safely; no public exploit identified at time of analysis.

Rendering untrusted Markdown with the Go library github.com/gomarkdown/markdown while the html.Safelink hardening flag is enabled can crash the calling process: parser.IsSafeURL slices a link destination before validating its length and panics on empty, '.', or '..' destinations such as the input `[x]()`, and every version before 0.0.0-20260724235538-61af6e1e6971 is affected. The same panic is reachable without that flag by any downstream caller that passes a 0/1/2-byte attacker-controlled URL directly to the exported parser.IsSafeURL function, yielding a remote, unauthenticated, availability-only denial of service (CVSS 3.1 score 7.5; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation is conditional rather than universal - the default render path with Safelink disabled never reaches the vulnerable code, there is no confirmed active exploitation (not in CISA KEV), and the upstream advisory itself publicly documents the minimal crash trigger.

Denial of service in pupnp (libupnp) releases prior to 22.0.4 lets remote unauthenticated attackers stall the UPnP miniserver by feeding it hostnames that resolve slowly or not at all: parse_hostport() in uri.c synchronously calls getaddrinfo() while parsing inbound HTTP request targets and GENA SUBSCRIBE CALLBACK headers, so each request pins a worker thread for the resolver timeout. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with only availability impact (C:N/I:N/A:H, 7.5), a small number of crafted requests can exhaust the bounded miniserver worker pool and deny UPnP service to legitimate devices; no public exploit code was identified at the time of analysis, though the upstream fix commit and advisory are public. Realistically the issue is bounded and self-recovering - once the hostile requests stop, threads free up - and exploitation in practice presumes LAN reachability, since miniservers are normally bound to the local network.

Integer overflow in pupnp's HTTP Content-Length parser (raw_to_int in upnp/src/genlib/net/http/httpparser.c) allows a remote adjacent-network attacker to desynchronize the parser from the declared body length on LP64 builds, enabling either request smuggling in persistent or proxied contexts or a denial of service by forcing a worker to wait for an oversized body. Affected are all pupnp releases prior to 2.0.2 across the whole CPE range cpe:2.3:a:pupnp:pupnp:*:*:*:*:*:*:*:*; no authentication (PR:N) and no user interaction (UI:N) are required, though exploitation is limited to adjacent/link-local reachability (AV:A) and to 64-bit builds where long is 64 bits and int is 32 bits. No public exploit identified at time of analysis; vendor-released patch: 2.0.2.

Denial of service in pupnp (the portable UPnP SDK) versions prior to 2.0.2 allows unauthenticated remote attackers to exhaust process resources by sending HTTP messages that use Transfer-Encoding: chunked, which the internal parser decodes and buffers without ever enforcing the configured g_maxContentLength limit on the decoded entity. The flaw is reachable through default-enabled SOAP, GENA, miniserver, and control-point HTTP response paths, so any host that can reach a pupnp-based UPnP endpoint - commonly other devices on the same LAN segment - can trigger memory/resource exhaustion with no authentication or user interaction (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; the vendor has shipped a fix in release 2.0.2.

Denial of service in pupnp (portable UPnP SDK) versions prior to 2.0.2 affects remote, unauthenticated deployments whose applications parse attacker-controlled XML and invoke ixmlElement_removeAttributeNode, causing the process to crash when ixmlNode_compare passes NULL nodeValue, namespaceURI, prefix, or localName fields to strcmp. The NULL fields arise legitimately from non-namespaced attributes created by ixmlDocument_createAttribute, and the crash occurs only when find_condition_node compares two distinct attribute objects with the same nodeName so the pointer-identity shortcut does not apply. No public exploit code or active exploitation was identified at time of analysis, and the vendor fixed the issue in 2.0.2 via commit 4b2f775e; impact is limited to availability (CWE-476, CVSS 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no code execution or data disclosure.

Remote unauthenticated denial of service in rust-libp2p Gossipsub affects versions prior to 0.49.5 and allows any peer that can reach a Gossipsub listener to repeatedly send novel GRAFT topic hashes. The handler unconditionally records those attacker-supplied topics in the per-peer connected_peer.topics map, so memory grows cumulatively without being bounded by subscription filters, peer scoring, or per-message size limits, eventually exhausting process memory and taking the node down. No public exploit identified at time of analysis; the issue is availability-only (CVSS 4.0 8.7 / assessed CVSS 3.1 7.5), and reachability of the Gossipsub listener is the practical prerequisite.

Malformed MP4 box-size fields submitted to the MP4Parser component in j4care dcm4chee-arc-light drive the parser into a non-terminating loop that repeatedly reprocesses the same input, consuming CPU and hanging the affected ingestion service. The defect is classified CWE-835 (loop with unreachable exit condition) and is network-reachable and unauthenticated per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so any actor able to reach an archive endpoint that accepts and parses DICOM-encapsulated MP4 media can trigger it; impact is availability-only with no confidentiality or integrity consequence. No public exploit code was identified at time of analysis, and the issue is documented by CISA in ICS medical advisory ICSMA-26-288-02.

JPEGParser in j4care's dcm4chee-arc-light can be driven into an infinite loop by a specially crafted or truncated JPEG-encoded stream delivered to the archive's image/DICOM ingestion path, resulting in a denial-of-service condition (CWE-835). Per the supplied CVSS 4.0 vector the flaw is network-reachable and requires no authentication and no user interaction (AV:N, AC:L, PR:N, UI:N), but the impact is availability-only (VA:H with VC:N/VI:N) - no code execution, data disclosure, or integrity loss is described. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is bounded by network reachability: deployments that expose a JPEG/DICOM parsing endpoint beyond a segmented clinical network are the ones materially at risk.

Remote unauthenticated requests to a network-reachable CSAF Provider instance can exhaust CPU resources through unbounded resource allocation, leading to a denial of service. The flaw (CWE-770) affects the gocsaf development community's CSAF Provider, with no specific version constraints identified in the CPE data (all versions appear affected). No public exploit code was identified at time of analysis and there is no CISA KEV entry, though the CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with no confidentiality or integrity loss.

Resource exhaustion in Apache Kylin 4.0.0 through 5.0.4 lets an attacker who already holds project admin permission abuse a cache API to drive computed-column processing into unbounded resource allocation, degrading or denying availability of the Kylin service. The weakness is reachable only by authenticated users with high privileges (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), so a compromised or malicious project administrator account is a prerequisite; there is no confidentiality or integrity impact and no public exploit identified at time of analysis. Severity is low, no CISA KEV entry or public exploit exists, and the vendor-released fix is Kylin 5.0.5 (tracked as KYLIN-6112).

Nezha monitoring dashboards running versions 1.0.0 through 2.3.14 can be knocked offline by an authenticated user who holds file-manager scope, because the dashboard's file manager WebSocket handler (fmStream) never imposes a read limit on incoming frames. A single oversized binary message sent to /api/v1/ws/file/:id is buffered whole by gorilla/websocket, exhausting process memory until the kernel OOM-killer terminates the dashboard - which in turn severs monitoring visibility for every agent the dashboard managed. There is no public exploit identified at time of analysis, but a vendor patch (2.3.15) and the upstream fixing commit are already public, so any dashboard exposed to users with file-manager permissions should be treated as a moderate-priority availability risk rather than a critical one; the attacked service is the dashboard itself, not the monitored endpoints.

Resource exhaustion in Nezha 2.0.13 through 2.3.14 allows an authenticated user to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint and hold thousands of ServerTransferClass.Subscribe subscriptions without limit, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections. Exploitation requires a valid authenticated dashboard session (CVSS vector includes PR:L), with no user interaction and no non-default configuration beyond a login-capable account; the impact is limited to availability of the dashboard and agent connectivity, and no public exploit has been identified at time of analysis. A vendor patch is available in Nezha 2.3.15 and later.

Unauthenticated memory exhaustion in the FreeRDP server-side component (3.0.0 through 3.31.x) allows a remote attacker to drive the process toward out-of-memory failure by completing a TLS handshake and then streaming bytes that do not begin with the DER SEQUENCE tag 0x30, which causes parse_nla_mode_pdu to grow the receive buffer without bound before NLA authentication ever completes. No credentials, user interaction, or non-default feature flag are required, but the attack surface is limited to hosts running a FreeRDP-based server with TLS reachable on its listening port; the far more common client role is not affected. Impact is availability-only (no code execution, no data disclosure), and no public exploit code or confirmed active exploitation has been identified at time of analysis.

Memory exhaustion in FreeRDP 2.0.0 through 3.31.x lets an authenticated RDP client degrade or crash a server that exposes FreeRDP's listener role: the attacker opens a static virtual channel message and then streams endless channel-data fragments while withholding the CHANNEL_FLAG_LAST terminator, so the server-side reassembly buffer grows without bound. The issue is scored 7.1 under CVSS 4.0 and independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, meaning availability-only impact with no confidentiality or integrity loss. Exploitation is not confirmed in the wild (no CISA KEV listing) and no public exploit identified at time of analysis; the practical exposure is narrowed because the vulnerable code path is server-side and the attacker must already hold an authenticated RDP session.

Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.

Use-after-free in the V8 JavaScript engine in Google Chrome before 155.0.8059.84 allows unauthenticated remote attackers to achieve arbitrary code execution inside the renderer sandbox by persuading a victim to load a crafted HTML page; only default JavaScript settings are required, with no privileges needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Vendor patches are available in Chrome 155.0.8059.84, and no public exploit code has been identified at time of analysis per CISA SSVC (Exploitation: none). The resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be required to compromise the underlying host; the exposure window closes once the browser auto-updates to the patched build.

Use-after-free in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Successful exploitation is gated by mandatory user interaction (CVSS UI:R) and needs no authentication (PR:N), so a single visit to an attacker-controlled or compromised page is enough, though the resulting code execution stays confined to the renderer sandbox under the assessed S:U scope and would require a separate sandbox-escape to compromise the host. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in release 155.0.8059.84 (Chromium severity: High).

Use-after-free in Google Chrome's Prerender component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page, and Google rates the flaw Critical with a CVSS base score of 8.8. All Chrome builds prior to 155.0.8059.84 are affected, and exploitation requires user interaction (UI:R) since the attacker cannot trigger the flaw without the victim loading the malicious content, though no authentication or special privileges are needed. Vendor-released patch: 155.0.8059.84; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the SSVC assessment records exploitation as none, making this a high-priority patching target rather than an emergency.

Out-of-bounds read in the Driftregion iso14229 UDS server library before version 0.10.1 lets an unauthenticated sender crash the diagnostic stack or disclose adjacent memory by submitting a short RequestFileTransfer (SID 0x38) request whose filePathAndNameLength field is set to 0xFFFC-0xFFFF, wrapping the length arithmetic and defeating the buffer-length check before file-transfer callbacks read past the receive buffer. The issue carries a CVSS 4.0 base score of 8.8 and is assessed as AV:N/AC:L/PR:N/UI:N with low confidentiality and high availability impact (CWE-190 integer wraparound), so no credentials or user interaction are required once the handler is reachable. No public exploit code has been identified at time of analysis and no EPSS score was supplied; real-world exposure is gated by transport, since AV:N holds only where the server is reachable over an IP transport such as DoIP, whereas the typical CAN/ISO-TP deployment restricts an attacker to the vehicle or device bus.

Unbounded resource allocation in ASP.NET Core - reachable through the System.Formats.Cbor component shipped with Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 - lets unauthenticated remote attackers exhaust server resources and cause a denial of service. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact), meaning any network-exposed service that actually parses attacker-supplied CBOR input through the vulnerable path can be driven into resource exhaustion without credentials or user interaction. Exploitation is bounded by reachability: deployments that never process untrusted external CBOR/network data, or that sit behind request-size limits, rate limiting, timeouts, or a WAF, have materially reduced exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available via the Microsoft Security Response Center advisory.

Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.

Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.

Authorization bypass in CyberArk Conjur 13.9.0 allows an authenticated user holding only limited privileges to perform actions on a policy branch they are not entitled to, and under specific circumstances to retrieve unauthorized secrets, alter administrative access controls on that branch, or cause a denial of service. The flaw is network-reachable and low-complexity (CVSS 4.0 8.6; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality and integrity impact), but it requires a pre-existing, valid Conjur account with access to the affected policy branch, so there is no unauthenticated or default-configuration mass-exploitation path. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status; the primary exposure is to Conjur 13.9.0 deployments with broad multi-tenant policy trees and loosely scoped low-privilege roles.

Unauthenticated denial of service in LightLLM through 1.2.0 lets any remote attacker who can reach the /generate endpoint take down the inference worker with a single crafted request: supplying the internal pd_kv_trans_params field causes a pickle.loads failure in InferSamplingParams that kills the inference thread. Because the /health endpoint keeps responding normally, monitoring will not detect the failure, and every subsequent request hangs until the process is restarted. Publicly available exploit code exists (referenced in the upstream GitHub issue), and no CISA KEV entry or EPSS data was provided; the assessed impact is availability-only with no confidentiality or integrity loss.

Denial of service in AdonisJS HTTP Server (adonisjs/http-server) lets unauthenticated remote attackers stall the Node.js event loop: versions prior to 8.2.2 and 9.1.1 contain a catastrophic-backtracking regular expression in router.matchers.slug(), and a long slug ending in a character rejected by the final assertion triggers quadratic CPU consumption. Because the matcher runs during route matching and before route and group middleware, authentication or rate-limiting middleware attached to the affected route does not prevent the request from blocking the worker and starving unrelated requests and health checks. Impact is availability-only with no data exposure, the CVSS 4.0 base score is 8.7 (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no public exploit identified at time of analysis, and exploitation requires the application to explicitly apply the slug matcher to an externally reachable, attacker-controlled route parameter rather than affecting every AdonisJS deployment.

Denial of service in the undici HTTP client library for Node.js allows any attacker-controlled or compromised HTTPS endpoint to terminate the client process by performing a TLS 1.2 renegotiation. When a server renegotiates after the connection is established and presents a different CA-trusted certificate whose hostname does not match the requested host, Node.js re-runs hostname verification and destroys the socket with a certificate-altname error; undici's established-socket error handler treated that error code as impossible, so the peer-controlled condition became an uncaught assertion (CWE-248) that crashes Node.js and kills all in-flight requests and background work. The flaw affects undici 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 on both the HTTP/1.1 and HTTP/2 paths, and is reachable through Node's global fetch() as well as direct library use; it is remotely triggerable without authentication or a CA compromise (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), though only TLS 1.2 connections are exploitable since TLS 1.3 removed renegotiation. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation, but exploitation is trivial for any adversary who can serve an endpoint the victim fetches from, and patched releases 6.29.1, 7.30.1, and 8.12.2 are available.

Unbounded response-header buffering in ReactPHP's HTTP client (react/http) versions 1.0.0 through 1.11.0 allows a malicious or compromised remote server to exhaust the PHP memory_limit of an application that uses React\Http\Browser to fetch attacker-influenced URLs. Because CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H rates this 7.5, the impact is availability-only (event-loop or worker process crash), with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. The vendor-released patch is version 1.11.1, which enforces a 65536-byte response-header cap and raises an OverflowException when exceeded.

Denial of service in Junrar before 7.6.1 allows unauthenticated remote attackers to exhaust CPU and archive-processing worker capacity by supplying a crafted RAR4 archive. The archive drives the built-in RAR virtual machine into an infinite loop via a VM_JMP instruction targeting an address at or beyond the prepared program's codeSize; because the VM cannot execute native code, the supported impact is availability loss rather than code execution. No public exploit code or confirmed active exploitation has been identified, and the flaw is fixed in version 7.6.1.

Denial of service in the undici HTTP client library for Node.js (6.23.0-6.29.0, 7.18.0-7.30.0, and 8.0.0-8.12.1) lets a malicious or compromised remote server terminate the entire Node.js process with a single crafted response. When the server advertises more than five stacked content codings and then closes the connection before sending the body, undici rejects the response over its content-encoding limit, but it has already created the internal response stream and returns without attaching an error listener or aborting the request; the early close then surfaces a content-length mismatch on the orphaned stream as an uncaught error that Node.js handles by aborting the process. The flaw is client-side and remote-triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and - critically - the crash occurs even when the application correctly catches the fetch() rejection, so there is no public exploit identified at time of analysis and no vendor-provided workaround other than upgrading.

Denial of service in Lychee before 7.7.0 allows an authenticated user with upload/import permission to tie up image-processing capacity by submitting a tiny PDF whose first page declares an oversized /MediaBox. Lychee hands PDFs to ImageMagick with Ghostscript enabled and applies no pre-render page-size check in ImagickHandler::loadPdf(), so Ghostscript burns CPU rasterizing an enormous page before the pixel-cache policy rejects the result; in synchronous QUEUE_CONNECTION deployments a single request occupies a web worker, while the official asynchronous Docker setup instead backs up the shared image-processing queue and delays other users' work. Exploitation is gated behind authentication, only availability is affected (no confidentiality, integrity, or Ghostscript sandbox-escape impact), and no public exploit was identified at time of analysis. The vendor/CNA scored this 7.1 under CVSS 4.0, whereas the independent assessment rates the same issue CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (4.3), reflecting limited per-request availability impact.

Unauthenticated remote requests can crash Go services that embed kin-openapi before 0.148.0: posting a YAML body containing .nan, .inf, or -.inf to an OpenAPI 3.1 operation carrying a numeric constraint drives the bundled santhosh-tekuri/jsonschema v6.0.2 into a nil big.Rat dereference, panicking inside ValidateRequest. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), reflecting availability-only impact: a standard net/http server recovers the panic per connection so the effect is usually a single dropped request, while non-net/http hosts or panics raised in application goroutines can terminate the process. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; the need to reach an OAS 3.1 spec, accept application/yaml (or application/x-yaml), and hit an operation with a numeric constraint keeps this a genuine but bounded denial-of-service issue.

Nil-pointer dereference in kin-openapi 0.136.0 through 0.148.x lets an unauthenticated remote client reliably panic Go applications that run openapi3filter request validation against an OpenAPI 3.1 spec declaring an array schema without an items definition. Three decoder paths are affected: a plain array query parameter, a deepObject query parameter whose object contains an array property, and an application/x-www-form-urlencoded body whose array property appears inside an allOf, anyOf, or oneOf subschema - each passes a nil items schema into urlValuesDecoder.parseArray or buildResObj, which dereferences it. Impact is availability-only (CVSS 7.5, CWE-476), exploitation is conditional on the target application actually exposing such a nil-items array schema on a validated route, and no public exploit code or CISA KEV entry is identified at time of analysis; the vendor fixed the issue in 0.149.0.

Response validation in kin-openapi (openapi3filter.ValidateResponse) panics with a nil pointer dereference when an OpenAPI 3.x document declares a response header using a 'content' media-type object instead of a 'schema' field - the document itself validates successfully, but every response validation for the affected operation dereferences the nil schema and crashes, even when the response omits the declared header entirely. All versions prior to 0.146.0 are affected, and the flaw is unauthenticated and network-reachable (CVSS 4.0 AV:N/PR:N), though the decisive qualifier is AT:P: remote availability impact realistically applies only to applications that ingest untrusted or third-party specifications, while applications using only trusted local specs suffer a self-inflicted crash when the affected operation is exercised. No public exploit code and no confirmed active exploitation were identified at time of analysis; the upstream commit adds a regression test and a nil-schema guard in the decoder. EPSS data was not provided for this CVE.

A nil-pointer panic in kin-openapi's openapi3filter validation path can crash any Go service that embeds versions 0.136.0 through 0.142.x and serves an OpenAPI 3.1 document with an array schema that omits the items keyword. Unauthenticated remote clients (CVSS vector PR:N/UI:N) only need to send a single nonempty application/x-www-form-urlencoded or multipart/form-data request to an affected operation - or trigger a matching response on a surface such as a response header - to deterministically panic ValidateRequest or ValidateResponse, producing denial of service with no confidentiality or integrity impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5). The risk is real but bounded: only OpenAPI 3.1 specs containing the specific malformed-but-spec-legal array shape are exposed, JSON request bodies use a different decoder, and OpenAPI 3.0 documents are rejected at validation time. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.

Denial of service in Symfony's ExpressionLanguage component lets a remote, unauthenticated attacker crash the PHP process by submitting a single expression built from tens of thousands of nested unary operators, array/hash literals, binary operators, property accesses or ternaries. The parser places no bound on the depth of the node tree it builds, and when that tree is destroyed PHP's recursive free overflows the native stack; the crash occurs while the tree is being freed, so it happens even if the expression itself would never be evaluated. Symfony applications that lint user-supplied expressions - most directly through the #[Assert\ExpressionSyntax] validator, which forwards the validated value to ExpressionLanguage::lint(), or any code calling parse()/lint() on untrusted input - are affected in versions up to 5.4.53, 6.4.47, 7.4.20 and 8.1.8. Impact is availability-only (CVSS:4.0 base 8.7 per NVD; our independent CVSS:3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), there is no data exposure or code execution, no public exploit code has been identified at time of analysis, and vendor patches are available.

Unbounded recursion in the Symfony YAML inline lexer lets a single document made of deeply nested inline collections (for example [[[[...]]]] or {{{...'}) exhaust the PHP call stack, crashing the worker process or ending the request with a fatal error in symfony/yaml prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The highest-exposure path is fully unauthenticated: a controller using #[MapRequestPayload] with the Yaml component installed and no acceptFormat restriction will accept a YAML content-type request that reaches Parser::lexInlineStructure() directly, and any application that parses untrusted YAML is affected. Impact is availability-only per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), exploitation is bounded by whether attacker-controlled input ever reaches the parser and by PHP version and stack settings. Vendor-released fixes exist for all maintained branches and no public exploit identified at time of analysis.

Unauthenticated remote denial of service in Symfony's HttpFoundation component (v4.1.0-BETA1 up to 5.4.54, v6.0.0-BETA1 up to 6.4.46, v7.0.0-BETA1 up to 7.4.19, and v8.0.0-BETA1 up to 8.1.7) allows any attacker who can send an HTTP request to burn roughly a second of CPU per request by placing a run of whitespace before a separator in the Cache-Control header. The flaw is automatically reachable because HeaderBag invokes HeaderUtils::split() on Cache-Control every time a Request object is constructed, so no authentication, plugin, or special configuration is required; a single crafted request costs about 813 ms on PHP 8.5 (17 spaces in an 8 KB header), doubling with each additional space, so sustained denial of service requires a stream of such requests rather than one packet. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor patches are released and the reachability is trivial, making this a practical denial-of-service risk rather than a theoretical one.

Unauthenticated remote attackers can cause the HPE NonStop ANSI SQLUTIL service to terminate unexpectedly, producing a denial-of-service condition on the targeted system. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning it is remotely reachable at low complexity with no credentials or user interaction required, and its impact is confined entirely to availability - there is no confidentiality or integrity effect. Root cause is classified as CWE-248 (Uncaught Exception), consistent with an unhandled error path that aborts the SQLUTIL process; no public exploit code has been identified at time of analysis, and the practical risk depends heavily on whether the SQLUTIL service is exposed to untrusted networks rather than restricted to internal administrative segments, since the affected component is part of the specialized HPE NonStop SQL/MX platform.

Unbounded inbound memory retention in the Eclipse Vert.x MQTT client (io.vertx:vertx-mqtt) allows a malicious or compromised MQTT broker to drive the Vert.x process into memory exhaustion and eventual out-of-memory termination. Client-side applications embedded in Vert.x 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 that subscribe to QoS 2 (exactly-once) topics are affected; the attacker supplies QoS 2 PUBLISH packets with distinct packet identifiers and never sends the matching PUBREL, so each message is retained indefinitely in the client's internal qos2inbound map. The assessed vectors rate this AV:N/AC:H/PR:N with high availability impact only (no confidentiality or integrity impact), reflecting that exploitation requires the attacker to occupy the broker role rather than being an arbitrary remote peer; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and EPSS data was not provided. Note that the maxInflightQueue option does not mitigate this issue because it constrains only the outbound publish path.

Denial of service in Eclipse Vert.x JSON Schema validation (io.vertx:vertx-json-schema) allows a remote unauthenticated attacker to burn disproportionate CPU by sending a single moderately sized JSON array to any endpoint whose active schema uses the uniqueItems keyword. The affected ranges are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and the defect propagates to the dependent modules vertx-web-openapi-router, vertx-web-validation and vertx-openapi. No public exploit code was identified at time of analysis, yet the issue is rated CVSS 4.0 8.7 (HIGH) entirely on availability impact (VA:H with VC:N/VI:N), and applications that do not use uniqueItems in attacker-reachable schemas or that cap request body/array size upstream are not practically exploitable.

Unbounded direct-memory allocation in Eclipse Vert.x's MySQL client (io.vertx:vertx-mysql-client) versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 allows a malicious, compromised, or man-in-the-middle MySQL server to crash the client with an out-of-memory condition before authentication completes. The attacker sends a continuous stream of maximum-length (0xFFFFFF) MySQL protocol packets, preventing the decoder from reaching the end-of-message boundary. This is a denial-of-service issue; no public exploit code has been identified at time of analysis (not in CISA KEV).

An unbounded-memory denial of service in the Eclipse Vert.x PostgreSQL client (io.vertx:vertx-pg-client) allows a malicious, compromised, or man-in-the-middle PostgreSQL server to crash a client application by sending a wire-protocol message header whose 4-byte length field is set to an extremely large value (up to Integer.MAX_VALUE). The client-side decoder performs no maximum-size validation, so it keeps accumulating TCP data into a composite buffer until the JVM exhausts heap and terminates; the abuse happens during connection startup, before authentication completes, so no valid database credentials are required - the attacker only needs to control the server side of the connection or sit on the client-to-PostgreSQL TCP path. Per the independent assessment this is a genuine but conditional availability risk (CVSS 8.2, AV:N/AC:H, availability-only impact) rather than a mass-exploitation priority: no public exploit code or confirmed active exploitation was identified at time of analysis, and clients that connect exclusively to trusted, authenticated, TLS-verified PostgreSQL servers are not realistically exposed.

Denial of service in the Vert.x MySQL client (io.vertx:vertx-mysql-client) lets an attacker who controls or intercepts the client-to-database path crash a Vert.x application: a crafted MySQL result-set packet declaring an extremely large column count causes the client to attempt an unbounded heap allocation, and the resulting OutOfMemoryError kills the Netty event loop thread, taking down all connections and verticles in the process. Affected builds are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, across all platforms where vertx-mysql-client is used. No authentication or user interaction is required once the hostile source or man-in-the-middle position exists (CVSS 4.0 PR:N), but the vendor rates the attack complexity as high (AC:H) because the database endpoint is normally trusted and operator-controlled; there is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Denial of service in Eclipse Vert.x's vertx-pg-client component allows an attacker controlling the PostgreSQL server or positioned as a man-in-the-middle on an unencrypted connection to crash the client application. The flaw resides in the binary array decoder (DataTypeCodec.binaryDecodeArray), which allocates a Java array based on a server-supplied 32-bit dimension count without upper bound checking, leading to a multi-gigabyte heap allocation and OutOfMemoryError. Affected versions include 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. Exploitation requires no authentication (PR:N) but does require control of the database server or a MITM position on a non-TLS connection (AC:H), and no public exploit code has been identified at time of analysis.

Denial of service in undici 8.11.0 and 8.11.1 allows a malicious or attacker-controlled HTTP/2 WebSocket server to terminate the Node.js process of any client that connects to it. Because the experimental WebSocket client is enabled by default whenever HTTP/2 is permitted (allowH2 defaults to true), an unauthenticated remote server can abort a failed handshake, leave the underlying HTTP/2 stream orphaned without an error listener, and then destroy the connection so the stream emits an uncaught error that crashes Node.js. Severity is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248); there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and vendor-released patch 8.11.2 is available.

Eclipse Vert.x DB2 Client versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 can deserialize attacker-controlled DRDA UDT column data, enabling remote code execution if a Java deserialization gadget chain is present on the classpath or denial of service otherwise. The affected component is io.vertx:vertx-db2-client, and exploitation requires an application to connect to a malicious or man-in-the-middle DRDA server that returns a result-set column tagged with FDOCA LID 0x50; legitimate DB2 servers never emit that type, and client-side TLS is disabled by default. The CVSS 4.0 score is 9.2 with PR:N, but practical exploitation requires attacker server-side/MITM position (AC:H) and, for RCE, a classpath gadget chain; no public exploit identified at time of analysis, and the real-world blast radius is narrower than the score alone suggests.

Unbounded direct-memory allocation in Eclipse Vert.x's MSSQL client (io.vertx:vertx-mssql-client) lets a malicious, compromised, or man-in-the-middle SQL Server endpoint crash a connecting client application by streaming TDS packets that never set the END_OF_MESSAGE status flag. Affected versions are [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9] and 5.2.0: the TDS message decoder aggregates inbound packets into a composite direct-memory buffer with no cumulative size cap, so the buffer grows until memory is exhausted and the process dies (availability impact only, with no confidentiality or integrity loss, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw is reachable before authentication completes, meaning no valid server credentials are required, but exploitation is not available to an arbitrary remote attacker - it demands control of, or a man-in-the-middle position on, the server side of the connection, which is why access complexity is rated High. No public exploit code or confirmed active exploitation was identified at time of analysis.

Denial of service in the Eclipse Vert.x Redis client (io.vertx:vertx-redis-client) affects versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0: the RESP parser trusts a server-declared array, push, or attribute length and pre-allocates that many elements without an upper bound, so a crafted response triggers a massive heap allocation that terminates the Vert.x event-loop thread with OutOfMemoryError and denies service to every connection and verticle sharing that loop. Exploitation is conditional rather than opportunistic - a remote, unauthenticated attacker qualifies only if they control or have compromised the Redis server the client talks to, or if they can occupy a man-in-the-middle position on the client-to-Redis path; neither user interaction nor prior client authentication is required, which is why the assessed vector is AV:N/PR:N but AC:H, and impact is availability-only (no confidentiality or integrity loss). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a genuine but conditional DoS issue rather than a top-tier emergency.

Denial of service in Eclipse Vert.x HTTP proxy (io.vertx:vertx-http-proxy) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, allowing remote unauthenticated attackers to cause indefinite heap allocation. Exploitation requires the application to explicitly configure an intercepting body transformer-a non-default, developer-enabled feature-and the flaw lies in the transformer interceptor's reliance on a max buffered bytes limit that fails to keep per-request buffers bounded. No public exploit code has been identified at time of analysis; the CVSS 4.0 score is 8.7 with high availability impact.

Denial-of-service in Eclipse Vert.x allows unauthenticated remote attackers to exhaust server memory by sending compressed WebSocket frames that decompress to massive sizes (a zip bomb), because the WebSocket implementation lacks a maximum byte-allocation limit during decompression. Affected versions include 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and exploitation requires WebSocket compression (permessage-deflate) to be negotiated. No public exploit code has been identified at time of analysis, but a vendor advisory (GHSA-h722-h6c2-6j3c) is available; the impact is limited to availability loss.

SQL injection in Znuny's ticket-search backend (versions through 7.3.6) allows an authenticated remote attacker with a valid agent or customer account to inject arbitrary SQL through the ContentSearch parameter, enabling theft or modification of ticketing data. The flaw requires the attacker to reach the search interface and supply a value for a parameter that the code expects to contain only the literal 'AND' or 'OR', yet concatenates verbatim into the generated query (CWE-89). No public exploit code was identified at the time of analysis and no CISA KEV listing applies; the assessed impact is high confidentiality and integrity loss with no confirmed availability impact.

Unauthenticated remote attackers can cause a denial of service in the finger daemon of HPE NonStop TCP/IP UTILITIES (version T8602L01^BAA and earlier) by sending crafted requests to the network-reachable finger service. The flaw stems from missing authentication (CWE-306) in the daemon, allowing any remote user to disrupt availability without credentials. No public exploit code has been identified at time of analysis, but the service is legacy and often disabled or firewalled, limiting exposure.

Unauthenticated remote denial of service in SODOLA SL902-SWTGW124AS switch firmware before version 200.2.12 lets any attacker who can reach the device's embedded HTTP management server crash it by sending a crafted multipart/form-data POST request containing an oversized boundary value in the Content-Type header. The overflow leaves the switch fully unresponsive, dropping both management access and traffic forwarding until its self-recovery cycle completes, though the assessment confirms no code execution, data disclosure, or configuration tampering occurs. Publicly available exploit code exists (published by the researcher and documented in the VulnCheck advisory), and the CVE carries a CVSS v4.0 base score of 8.7, but there is no indication of confirmed active exploitation in CISA KEV; the practical risk is governed mainly by whether the web management plane is exposed to attacker-reachable networks.

Denial of service in lottie-android 6.7.1 and earlier allows remote attackers to crash or hang applications by supplying a crafted Lottie animation JSON that contains a cyclic precomposition reference graph, which triggers uncontrolled recursion during layer model construction in BaseLayer.forModel and CompositionLayer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms unauthenticated, network-reachable availability impact with no confidentiality or integrity effect. No CISA KEV entry or public exploit code has been identified at time of analysis, but exploitation requires the host application to parse untrusted or remote Lottie files; applications rendering only bundled, trusted animations are not exposed.

Unauthenticated remote denial of service in FasterXML Jackson 1.x (jackson-mapper-asl 1.8.3 and 1.9.2-1.9.13) allows an attacker to crash or exhaust the stack of an application that deserializes untrusted JSON via ObjectMapper.readValue by supplying deeply nested input. The flaw is CWE-674 uncontrolled recursion: the Jackson 1.x parser performs recursive descent without a configurable nesting-depth limit. No public exploit code identified at time of analysis, and Jackson 2.x deployments are unaffected because that branch enforces StreamReadConstraints depth limits by default.

Denial of service in Nodemailer 3.0.0 through 10.0.9 allows an attacker-controlled or on-path SMTP server to stall a Node.js application by streaming SMTP continuation lines that never deliver a terminating completion line during the greeting/authentication phase. The vulnerable reply parser in SMTPConnection._onData and isPartialResponse re-evaluates its buffered response on every incoming chunk, so parsing cost grows quadratically with the size of the accumulated reply, blocking the single-threaded event loop and consuming memory before authentication completes. No public exploit code was identified at time of analysis, and exploitation is conditional: the client must be configured to connect to an untrusted or attacker-influenceable SMTP server, or an attacker must be positioned on-path on an interceptable SMTP connection, which is why the assessed vector carries AC:H and AT:P and this is a genuine but conditional availability risk rather than a blanket critical one.

Denial of service in Nodemailer versions 3.0.0 up to but not including 10.0.10 allows an attacker who can influence message content - specifically the recipient list (to/cc/bcc) or header fields passed to the message builder - to force quadratic header unfolding in MessageParser.parseHeaders, exhausting CPU and blocking the Node.js event loop while DKIM signing is performed. Only low-privileged access to the send functionality is required (CVSS PR:L), and impact is limited to availability: no data exposure, integrity loss, or code execution is involved. There is no public exploit identified at time of analysis, and exploitation additionally depends on DKIM signing being active in the same process, which makes real-world risk highest for multi-tenant mail-sending services that accept user-controlled recipients or headers.

Denial of service in Nodemailer 3.0.0 through 10.0.12 lets a malicious or man-in-the-middle SMTP server stall the Node.js event loop by answering EHLO with a crafted '250-AUTH' line followed by a long whitespace run and a non-matching token, which drives quadratic backtracking in the four AUTH-mechanism detection regexes in SMTPConnection._actionEHLO. No authentication is required from the attacker (PR:N) and the trigger occurs before any authentication step, but the victim application must connect outbound to an attacker-controlled or interceptable SMTP endpoint, so deployments pinned to fixed, trusted, TLS-authenticated mail servers are substantially harder to exploit. Impact is confined to event-loop blocking and availability loss (no confidentiality or integrity effect), and no public exploit code was identified at time of analysis; the vendor fix is Nodemailer 10.0.13.

Regular expression denial of service in GitPython before 3.2.0 allows remote, unauthenticated attackers to exhaust CPU on applications that parse Git commit or tag objects taken from an attacker-controlled repository. The flaw is in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines, which slips into quadratic backtracking when those lines are padded with long space-filled sequences that lack a valid epoch or timezone. Impact is strictly availability (CVSS 4.0 VA:H with VC:N/VI:N) - there is no confidentiality or integrity exposure, so the 8.7 High score reflects CPU exhaustion only, not code execution or data compromise; no public exploit identified at time of analysis.

Unauthenticated remote attackers can terminate the Parse Server process by driving the email verification or password-reset flow while the configured mail provider rejects, rate-limits, or is unavailable - a state an attacker can force by rapidly issuing requests until the provider throttles. Only public application keys are required (no user account), and affected deployments are Parse Server before 8.6.97 and the 9.0.0 line before 9.10.2-alpha.6, with the server's email features enabled. The underlying defect is an uncaught exception (CWE-248) raised on a failed send that aborts the Node.js process, so a single rejected message produces a full service outage; no public exploit identified at time of analysis, and deployments with email flows disabled are unaffected.

Unauthenticated remote attackers can exhaust disk space on n8n deployments before 2.41.4 and 2.42.x before 2.42.1 by abusing the OAuth authorize endpoint to create unlimited first-party OAuth client records, bypassing the registration cap. The flaw arises because the endpoint resolves clients by URL path but stores the caller's raw identifier as the record key, so identifiers differing only in their query string are treated as new clients and persisted indefinitely. Impact is availability-only (disk exhaustion); the independent assessment rates this a genuine but non-emergency availability risk, since sustained request volume is required and exposure depends on whether the OAuth endpoint is reachable. No public exploit identified at time of analysis.

Denial of service in FreeRDP 3.0.0 through 3.31.x allows a malicious RDP gateway to pin a client thread at full CPU indefinitely via an infinite loop in http_response_recv(). An attacker who controls the gateway endpoint the client connects to can return an HTTP response with a nonzero Content-Length and an unrecognized, semicolon-containing Content-Type header, causing the client to consume CPU without progress. Exploitation is unauthenticated but requires the victim to initiate a gateway-mode connection (user interaction); no public exploit code has been identified at time of analysis, and the issue is a moderate-severity availability concern with no impact on confidentiality or integrity.

Null pointer dereference in FreeRDP versions 2.0.0 through 3.31.x allows a malicious RDP server to crash Linux clients that have serial-port redirection enabled. The attacker sends IRP_MJ_READ or IRP_MJ_WRITE requests either before the serial channel is created or after it is closed, causing CommReadFile or CommWriteFile to dereference a null handle and terminate the client. This is an availability-only issue (CVSS 4.0 score 7.1, no confidentiality or integrity impact) that requires the victim to initiate a connection to the attacker-controlled server and have serial redirection active; no public exploit code has been identified at time of analysis.

Unbounded heap accumulation in the FreeRDP proxy (the pf/proxy relay component) lets unauthenticated remote attackers exhaust proxy memory by streaming RDPDR device-redirection fragments that begin with a FIRST fragment but never carry a LAST fragment, so reassembly state grows in proportion to bytes sent. Affected deployments are FreeRDP 3.0.0-beta1 through versions before 3.32.0 that run the proxy with the RDPDR channel reachable from untrusted clients; plain FreeRDP client or server deployments are not the stated target. Rated CVSS 4.0 8.2 (High), with assessed CVSS 3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, this is a slow-burn memory-exhaustion DoS requiring sustained fragment traffic rather than a single packet, and there is no public exploit identified at time of analysis.

Authenticated RDP clients can force unbounded server-side memory allocation in FreeRDP 2.0.0 through 3.31.x by sending a seven-byte DATA_FIRST message on an already-opened dynamic virtual channel (DVC) that declares a large 32-bit length, driving zeroed resident-memory growth until the server's resources are exhausted and service is denied. The flaw is availability-only (CWE-400 resource exhaustion; CVSS 4.0 base 7.1, assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with no code execution or data disclosure impact, and every action requires a valid authenticated session plus a successfully opened DVC - so real exposure depends on who can authenticate to the RDP service, and it is not remotely exploitable without credentials. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.

Client termination in FreeRDP before 3.32.0 occurs when a malicious RDP server sends repeated serial IRP_MJ_CREATE requests, causing the client to accumulate file descriptors until it hits the CommReadFile FD_SETSIZE assertion and crashes. The flaw requires the non-default serial/COM port redirection channel to be active and the victim to connect to an attacker-controlled or compromised server; it is an unauthenticated remote denial of service with no code execution or data exposure. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Null pointer dereference in the FreeRDP client's rdpsnd (audio redirection) channel allows a malicious or compromised RDP server to crash any connecting client running FreeRDP 3.0.0 through 3.31.x, producing a denial of service that terminates the user's RDP session. The trigger is a malformed rdpsnd fragment that sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST and arrives on a fresh channel; the CVSS vectors (4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VA:H, and the assessed 3.1 equivalent AV:N/AC:L/PR:N/UI:R/A:H) confirm unauthenticated remote reach but strictly availability-only impact - no confidentiality, integrity, or code-execution effect. Exploitation requires the victim to initiate a session against the attacker's server and to have audio redirection negotiated; there is no evidence of in-the-wild exploitation and no public exploit identified at time of analysis.

Unbounded HTTP request-body buffering in the Model Context Protocol Python SDK (the 'mcp' package) before 1.29.1 and in 2.0.0a1 through 2.0.1 allows unauthenticated remote attackers who can reach an exposed HTTP transport endpoint to exhaust server memory and potentially terminate the process. The Streamable HTTP session manager, the SSE message endpoint, and the OAuth authorization-server routes read complete request bodies without any maximum-size check, so a single large declared or streamed body can consume multiple times its own size in process memory and repeated requests can drive sustained memory pressure. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) the impact is availability-only, and no public exploit code was identified at time of analysis; stdio-only servers and deployments behind an effective upstream request-size limit are not affected. This is a genuine but bounded-priority availability issue - the fix is a vendor-released patch in 1.29.1 and 2.1.0 that enforces a 4 MiB default body cap and returns HTTP 413, and the primary residual exposure is default HTTP deployments with no reverse-proxy or gateway body limit.

Unbounded HTTP request-body buffering in the Model Context Protocol (MCP) Java SDK lets an unauthenticated remote client exhaust the JVM heap and render an MCP server unavailable. The flaw affects the Servlet-based SSE, Streamable HTTP, and Stateless server transports in io.modelcontextprotocol.sdk:mcp 0.8.0-0.12.0, mcp-core 0.13.0-0.18.3, 1.0.0-1.1.3, and 2.0.0-M1-2.0.0; a client simply streams an arbitrarily large POST body (including via chunked transfer encoding) until OutOfMemory conditions make the process unresponsive. Rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affecting availability only, the impact is materially reduced for deployments that require authentication, enforce Origin/Host validation, or sit behind a reverse proxy, load balancer, or API gateway with a maximum-body-size limit, all of which reject the oversized request before the vulnerable read; no public exploit code and no confirmed active exploitation were identified at time of analysis.

Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted StartupMessage whose options parameter contains an empty parameter name (for example "-c="), which makes the server's ignore_startup_parameters lookup loop indefinitely during the pre-authentication startup phase. Because PgBouncer serves every client from a single process, the loop pins a CPU core and stalls all connection pools until an administrator manually restarts the daemon, so a lone packet from any TCP-reachable source can take down the entire pooler. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the issue is network-reachable with low complexity, requires no credentials or user interaction, and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting its availability-only impact.

Denial of service in Juniper Networks Junos OS and Junos OS Evolved: a malformed BGP ISO-VPN (CLNS/IS-IS L3VPN) update from an accepted ISO-VPN peer crashes the routing protocol daemon (rpd) when that update is subsequently handled by BMP route monitoring or by NSR replication, taking down routing on the affected device (CVSS 4.0 base 8.7; AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and SA:L). Exploitation requires no credentials on the wire, but it is gated by a pre-established BGP ISO-VPN peering relationship, so realistic exposure is limited to compromised or malicious peers rather than arbitrary internet hosts, and the device must additionally have BMP route monitoring or NSR enabled. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; exploitation yields only availability impact, with no confidentiality or integrity loss on the router itself.

A crafted VPN-flowspec BGP update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos OS Evolved, causing a denial of service, but only when that update is readvertised by the device and BMP post-policy RIB-out monitoring is explicitly configured. The flaw is a NULL pointer dereference (CWE-476) reachable by a remote BGP peer that already has an established peering session with the target (PR:N means no device-level authentication is required, but a configured neighbor relationship is a practical prerequisite). The vendor rates it 8.7 under CVSS 4.0 while our independent assessment scores it 7.5 under CVSS 3.1 (AC:H), reflecting the non-default BMP configuration and readvertisement conditions; impact is availability-only with no confidentiality or integrity effect, and no public exploit code has been identified at time of analysis.

Adjacent attackers can crash the Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted LDP packet into an already-established LDP session, causing a denial of service on the affected router. Only devices running MPLS with LDP enabled and an active LDP peering session are exposed, and the attacker must already hold a position on the adjacent network capable of injecting packets into that session (CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact; vendor CVSS 4.0 base 7.1). There is no confidentiality or integrity impact - the outcome is loss of rpd availability, though repeated crashes can degrade routing stability; no public exploit has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).

Denial of service in Juniper Junos OS and Junos OS Evolved can be triggered by a remote BGP EVPN neighbor when SRv6 EVPN multihoming is configured, causing the routing protocol daemon (rpd) to crash. The issue affects specific Junos OS trains (25.2, 25.4, 26.2) and Junos OS Evolved trains (23.4X100, 25.2, 25.2X100, 25.4, 25.4X300, 26.2) below their fixed service releases. No public exploit identified at time of analysis, and exploitation is gated by the non-default SRv6 EVPN multihoming configuration plus an established BGP EVPN peering relationship.

Denial of service affecting Juniper Networks Junos OS and Junos OS Evolved: an unauthenticated remote attacker who can deliver a specifically malformed BGP EVPN multicast update to a device configured for EVPN multicast can crash the routing protocol daemon (rpd) when that update is processed for readvertisement, taking down routing on the affected box. Per the vendor's CVSS 4.0 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), the impact is availability-only, but exposure is bounded by a real prerequisite: the target must run EVPN multicast (e.g. EVPN handling of IGMP/MLD / SMET multicast routes) with a live BGP session, and the attacker needs a peering relationship or on-path injection capability for the update to arrive and be readvertised. Vendor-released patches are available and no public exploit code has been identified at time of analysis, so this is a genuine but bounded operational risk.

Denial of service in NASA's F´ (F Prime) framework prior to 4.2.0 allows remote attackers to abort or reset the flight software process by delivering a file-uplink packet whose file-packet type byte falls outside the valid Type enum, driving Fw::FilePacket deserialization into an unvalidated FW_ASSERT (CWE-617). The impact is availability-only, matching the assessed CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss, and the practical limiting factor is reachability: the malicious packet must traverse the Svc::FileUplink file-packet path, which in spaceflight deployments is the ground-to-vehicle uplink. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in F Prime 4.2.0.

A specific BGP packet sent by an existing eBGP peer can trigger a NULL pointer dereference in the routing-policy nexthop-ECMP matcher of Juniper Junos OS and Junos OS Evolved, killing the routing daemon and causing a denial of service (CVSS 4.0 base 8.7; independent assessment scores it AV:N/AC:H/PR:N/UI:N/A:H with no confidentiality or integrity impact). Exploitation is gated by two preconditions: the device must have a nexthop-ecmp qualifier attached to a BGP import policy - an explicitly deployed, non-default routing-policy configuration - and the sender must already be a configured eBGP peer, so an arbitrary unauthenticated Internet host cannot reach the flaw; the CVSS vectors carry PR:N, but reachability still requires an established BGP peering session. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available per Juniper advisory JSA112187.

Denial of service in Juniper Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to crash the routing protocol daemon (rpd) by sending specifically malformed LSP-ping packets; this is a moderate-priority availability vulnerability, not a critical compromise, because it requires an adjacent-network position and MPLS LSP-ping processing to be enabled. No public exploit has been identified at time of analysis, and Juniper has released fixed software versions for both Junos OS and Junos OS Evolved. Successful exploitation causes only availability impact to rpd, with no data exposure or modification.

Malformed inter-processor hub traffic can abort or reset NASA's F´ (F Prime) flight-software process in versions prior to 4.2.0, because the Svc::GenericHub receive handler treats externally supplied deserialization results as invariants and aborts via FW_ASSERT when they fail. An unauthenticated remote peer on a hub link (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) can send a truncated buffer, a HubType value at or above HUB_TYPE_MAX, or a header-only command-dispatch payload to trigger the fault, producing availability-only impact. The vendor has released 4.2.0 with hardened bounds and type checks; no public exploit code has been identified at time of analysis, and the issue is confined to deployments that genuinely instantiate GenericHub and expose its link to untrusted or spoofable peers.

Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.