Denial of Service

Stack buffer overflow in SIPp through 3.7.7 allows unauthenticated remote attackers to crash the process by sending a crafted SIP message whose To header tag parameter is 2049 bytes or longer. The get_peer_tag() function in sip_parser.cpp copies the tag value into a fixed-size static buffer without a bounds check, enabling the overflow and resulting in a process crash. No public exploit has been identified at time of analysis, but the trigger condition is trivial to reproduce given the precise byte threshold documented by VulnCheck, and an upstream fix has been committed.

Quadratic time complexity in Nodemailer's addressparser component, versions 9.1.0 through 10.0.4, allows remote unauthenticated attackers to block the Node.js event loop for multiple seconds by supplying crafted email addresses containing RFC 5322 comment-separated atoms. The root cause is a `slice(-1)` call on a growing string accumulator in `_handleAddress` that forces JavaScript engine string-flattening on every token, producing O(n²) parse time - empirical test data in the fix commit shows 1.5 MB of crafted input caused approximately 10 seconds of event-loop stall before the patch. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack payload is trivially constructable by simple string repetition and requires no authentication.

Denial of service in UnrealIRCd's embedded webserver (versions 6.0.5-6.2.6) allows unauthenticated remote attackers to exhaust server memory by sending an HTTP request containing an unbounded number of headers, rendering the IRC daemon unresponsive. The attack surface exists only when a WebSocket or JSON-RPC listener is explicitly enabled, both of which are disabled in the default configuration. The issue is resolved in version 6.2.7 per the vendor advisory, and no public exploit code has been identified at time of analysis.

Uncontrolled memory allocation in vLLM's transcription endpoint before 0.28.0 allows authenticated API clients to crash the entire server process by submitting FLAC audio files with forged, inflated sample rate headers. Because vLLM commonly operates as a shared API server across multiple tenants, a single authenticated attacker can deny service to all concurrent users. VulnCheck reported this with a CVSS 4.0 score of 7.1; no public exploit code or CISA KEV listing has been identified at time of analysis.

Memory corruption in ArduinoBLE's ATT layer write request handler allows an unauthenticated BLE client within Bluetooth range to overflow the ATTClass global object's write buffer by sending a crafted ATT Write Request. Versions prior to 2.0.2 are affected exclusively when at least one BLE characteristic is configured with the BLEEncryption property. No public exploit has been identified at time of analysis, but vendor-released patch version 2.0.2 fully resolves the flaw.

Overlayfs in the Linux kernel exposes an unprivileged local DoS - and a theoretical privilege-escalation path - through a double `end_creating()` call in `ovl_create_real()` when a casefold consistency mismatch is detected during directory creation. The double call unlocks the parent directory's `i_rwsem` twice and calls `dput()` twice on the same dentry: the spurious unlock wedges every subsequent creation under that parent indefinitely, and the spurious `dput()` creates a reference-count imbalance that could underpin a use-after-free chain. The flaw is reachable without root in a user namespace on most modern Linux distributions. No public exploit has been identified at time of analysis and EPSS is 0.18%.

An infinite loop in the Linux kernel's device property subsystem causes system hangs when iterating firmware nodes (fwnodes) with a secondary fwnode containing more than one child. Affected are Linux kernel versions across multiple stable branches (5.10.x through 6.19.x pre-patch). An attacker or malformed firmware blob that produces such a node topology can cause a kernel thread to spin indefinitely, consuming a CPU core and ultimately triggering a watchdog reset or complete system hang. No active exploitation has been confirmed, and EPSS stands at 0.17%.

NFSD's seq-lock-like rq_status_counter protocol in nfsd_dispatch() is broken on three non-success exit paths - cache-hit (RC_REPLY), drop (RC_DROPIT/RQ_DROPME), and encode-error - leaving the counter permanently odd and exposing actively-mutating kernel fields to the lockless reader in nfsd_nl_rpc_status_get_dumpit(). A local low-privileged user on an NFS server who can poll NFSD RPC status via the netlink interface while requests traverse these paths can trigger out-of-bounds reads past the 8-element inline ops array embedded in the rqstp structure, disclosing kernel memory or causing a kernel panic. No public exploit exists (EPSS 0.19%), but the 6.12 LTS series appears unpatched, with fixes confined to 7.2.4 and 7.3-rc1.

NULL pointer dereference in Linux kernel NFSD's NFSv4.2 compound dispatch loop allows remote clients to crash NFS servers built with CONFIG_NFSD_V4_2_INTER_SSC. By inserting an operation such as SETATTR between a foreign PUTFH and SAVEFH within a crafted COMPOUND request, an attacker causes fh_want_write() to dereference a NULL fh_export pointer - killing the nfsd kthread and denying NFS service to all clients. No public exploit has been identified and EPSS stands at 0.22%, reflecting low current exploitation interest.

Persistent denial-of-service in the Linux kernel's NFSv4 server grace-period logic allows any reachable NFSv4 client to hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests. The root cause is a clock-domain mismatch in clients_still_reclaiming(): the deadline is derived from nn->boot_time (CLOCK_REALTIME, ~1.7 billion seconds since epoch) but compared against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since last boot - orders of magnitude smaller), making the comparison permanently false. As long as any client continues sending CLAIM_PREVIOUS, the grace period never ends, blocking all non-reclaim NFSv4 operations for every other connected client. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.

POSIX ACL reference-count leaks in Linux kernel NFSD allow a remote attacker to exhaust kernel memory via malformed NFSv4 OPEN compound requests. When the NFS server decodes an OPEN compound carrying valid POSIX ACL createhow4 attributes but encounters a non-seqid-mutating error from claim4 decoding, the compound dispatcher short-circuits before nfsd4_open() executes, permanently leaking both op_pacl and op_dpacl references because OP_OPEN lacked an op_release handler; a secondary leak exists on the NFSv4.0 replay path where op_release was never called from nfsd4_encode_replay(). No public exploit code has been identified and EPSS is 0.20%, but repeated malformed requests against a network-reachable NFSv4 server could drive the kernel toward OOM-induced service failure.

Kernel crash in the Linux libceph client allows a malicious or compromised authenticated Ceph OSD to trigger a BUG_ON assertion in ceph_msg_data_next() by sending a crafted sparse-read reply. The flaw in net/ceph/osd_client.c:osd_sparse_read() validates total data length against summed extents but omits per-extent monotonicity, overlap, and bounds checks, enabling a far-forward extent offset to advance the message-data cursor past the request buffer. Impact is limited to availability - a targeted kernel panic on any Linux client mounting a RADOS-backed filesystem or block device (RBD/CephFS). No public exploit code has been identified at time of analysis, and EPSS is low at 0.20%.

Denial of service and stale-memory disclosure in the Linux kernel SMB/CIFS client (cifs.ko) arise from an integer-overflow in symlink_data()'s error-context parsing loop. A previous fix (commit 7d9a7f1f96cd) checked the post-ALIGN() length against the remaining buffer, but ALIGN() itself overflows: an ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9) makes ALIGN(x,8) wrap to 0, so the bounds check passes and the loop advances by zero bytes, spinning indefinitely while 'p' points into stale data. A malicious or MITM SMB server can trigger this against a connecting client; no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).

Out-of-bounds read in the Linux kernel's eCryptfs filesystem packet parser allows a local low-privileged attacker to leak kernel memory or trigger a denial of service by opening a crafted encrypted file with a version 1 header. The root cause is that ecryptfs_parse_packet_set() computes remaining buffer space using a fixed PAGE_SIZE - 8 formula instead of the actual packet-set buffer length, overstating available bytes for version 1 headers where the packet set begins later. Patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified.

Kernel crash exposure in the OMAP SSI/HSI driver stems from a missing DMA mask initialization on the synthetic HSI controller device allocated via hsi_alloc_controller(), which bypasses the normal OF/platform device setup path and leaves the embedded struct device without a valid dma_mask. Following DMA API hardening changes in the kernel, dma_map_sg() and related helpers enforce the presence of a valid mask before proceeding, causing warnings or kernel panics on any OMAP SoC system where the driver attempts DMA mapping. The vulnerability is tightly hardware-gated to Texas Instruments OMAP-based platforms; patches are confirmed available in kernel stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1, and no public exploit or KEV listing exists.

Hugetlb reservation accounting in the Linux kernel underflows when a huge-page folio shared between a parent and child process (after fork) is unmapped by the parent first. Since commit df7a6d1f6405 introduced reservation adjustment logic into `__unmap_hugepage_range()`, the function decrements the reservation counter without verifying that the folio's mapcount has reached zero, leaving the child's mapping unaccounted and the counter in an arbitrarily large (underflowed) state until the child unmaps. Affected kernels from 6.9 through the fix commits expose systems using hugetlb-backed workloads to integrity corruption (overcommit of huge pages) and availability risk (kernel memory management instability). No public exploit or active exploitation is identified at time of analysis.

Out-of-bounds read in Linux kernel ACPI APEI GHES ARM hardware error handler arises from using pointer size instead of structure size when accounting for remaining CPER buffer after skipping the cper_sec_proc_arm header. Affected are stable branches 6.12.x through 6.12.109, 6.18.x through 6.18.50, 7.x through 7.2.4, and pre-7.3-rc1, on ARM systems with ACPI APEI support. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and there is no CISA KEV listing, consistent with a low automated exploitation probability.

TRIM/discard is completely broken on 4Kn (4096-byte native sector) block devices in the Linux kernel's libata-scsi layer, causing every ATA DSM TRIM command to fail with 'Parameter list length error' and trigger WARN_ON() splats on each attempt. The bug is in ata_scsi_write_same_xlat(): ata_format_dsm_trim_descr() caps its output at 2048 bytes (ATA_SCSI_RBUF_SIZE), but the caller compares this return value against the logical sector size - on 4Kn devices (sector_size=4096), this equality check always fails and every TRIM is rejected. No public exploit exists; this is a deterministic functional regression on specific hardware. Vendor-released patches are available in stable kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.

Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into userspace for ISO broadcast sink configurations. When an ISO broadcast sink processes periodic advertising (PA) reports from a remote Bluetooth broadcaster, a PA payload packed with multiple mismatching Service Data fields causes eir_len to undercount by 2 bytes per field iteration - the subtraction uses only the data length (dlen), omitting the 2-byte length+type header - so the pointer eventually reads past hcon->le_per_adv_data[] into the surrounding struct hci_conn; a drifted field matching the BAA UUID causes those bytes to be copied into iso_pi(sk)->base, recoverable by a local or remote-assisted userspace process via getsockopt(BT_ISO_BASE). No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects low opportunistic risk, though the Bluetooth adjacent-network constraint caps mass exploitation potential.

Remote unauthenticated denial-of-service in AirSane scanner server (versions prior to 0.4.12) allows an attacker to crash the daemon by sending an HTTP POST request with an arbitrarily large Content-Length value, triggering memory exhaustion and a std::bad_alloc exception. The root cause is in httpserver.cpp, where the Content-Length header value is passed directly to std::string::resize() with no upper-bound validation. A secondary variant using non-numeric Content-Length values produces undefined behavior via NaN-to-integer conversion. No public exploit or active exploitation has been identified at time of analysis.

Four coupled error-path defects in the Linux kernel's SUNRPC RPCSEC_GSS option-array XDR decoder (`gssx_dec_option_array`) enable kernel NULL-pointer dereference, a `group_info` refcount leak, and a latent use-after-free during GSS security-context acceptance. Systems acting as NFS servers or clients with Kerberos authentication (sec=krb5/krb5i/krb5p) are in the affected code path; triggering the NULL deref via a failed allocation or malformed GSS response causes a kernel crash (denial-of-service). No public exploit code exists and EPSS sits at the 10th percentile, indicating low current exploitation probability.

Use-after-free in the Linux kernel NFS-over-RDMA server (svcrdma) allows an adjacent-network attacker to trigger kernel memory corruption when an RDMA_CM_EVENT_ADDR_CHANGE event coincides with a replacement listener cm_id allocation failure, leaving sc_cm_id pointing to a destroyed object. Subsequent kernel operations that dereference sc_cm_id - most immediately rdma_disconnect() in svc_rdma_detach() - read or write freed kernel memory, with potential impacts on confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.15% (5th percentile), consistent with the niche NFS-over-RDMA server attack surface.

NULL pointer dereference in the Linux kernel svcrdma subsystem (NFS over RDMA) allows unauthenticated remote clients to crash the kernel by sending a crafted RDMA Read list whose cumulative segment lengths overflow the rq_pages page array. The vulnerability bypasses per-segment length validation by exploiting an edge case where a single segment fills the page array exactly, causing the loop guard to exit prematurely; a subsequent segment then dereferences the NULL sentinel slot at rq_pages[rq_maxpages] during DMA mapping, triggering a kernel panic. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS is low at 0.21%, but the network-exposed crash vector warrants patching on any host running NFS-over-RDMA.

Race condition in Linux kernel's core scheduler pick_next_task() path allows a local low-privileged attacker to exploit a TOCTOU window when pick_task() releases the rq (run queue) lock mid-selection, potentially leaking information across SMT sibling threads, corrupting forceidle accounting, and destabilizing the scheduler. The vulnerability breaks the cookie-based SMT isolation guarantee of Core Scheduling: an uncookied task can be committed as the sibling of a cookied task during the lock-release window, violating the trust boundary the feature is designed to enforce. No public exploit exists (EPSS 0.19%), and fixes are available in Linux 7.2.4, 7.3-rc1, and 6.19.

Kernel panic via NULL pointer dereference in the Linux kernel qede Ethernet driver (used by QLogic/Marvell FastLinQ NICs) can be triggered under memory pressure conditions during TPA (Transparent Packet Aggregation) fragment processing. A regression introduced by commit 8a8633978b84 omitted the assignment of tpa_info->buffer.data in qede_tpa_start(), causing a 'ghost' buffer descriptor with a NULL data pointer to be reinserted into the active Rx ring upon SKB allocation failure. When hardware subsequently uses the poisoned ring slot, qede_fill_frag_skb() dereferences the NULL pointer, panicking the kernel. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile).

Memory management order mismatch in the Linux kernel ring-buffer tracing subsystem allows a local low-privileged user to corrupt kernel memory or crash the system by triggering a ring buffer resize concurrently with cached reader page discard. The root cause is that cpu_buffer::free_page stores only a page address without preserving the allocation order; after a resize changes cpu_buffer->subbuf_order, free_pages() is invoked with the new order rather than the original, corrupting the buddy allocator's state. Vendor-released patches exist in Linux 6.18.51, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists, and EPSS stands at 0.20%.

Kernel memory corruption in the Linux NVMe/TCP host driver (nvme-tcp) allows a malicious or compromised NVMe-over-TCP target to trigger a wild-memory-access write on the connecting host. The receive path gated C2HData PDUs on blk_rq_payload_bytes() alone; for a REQ_OP_WRITE_ZEROES command (no physical segments but non-zero byte count) the request iterator is never initialized, so an attacker-supplied C2HData is copied into whatever stale, driver-private iterator the previous command on that tag left behind. Fixed across stable trees; no public exploit identified at time of analysis and EPSS is low (0.20%).

Integer underflow in the Linux kernel's SCTP stream reconfiguration (RECONF) handler allows a remote SCTP peer to crash the kernel by sending duplicate RECONF response chunks. When a cached RECONF chunk contains an ADD_OUT request alongside other parameters, a duplicate response causes the kernel to roll back `stream->outcnt` twice - the second decrement underflows the unsigned counter and can trigger a kernel panic. EPSS exploitation probability is 0.20% (10th percentile), no public exploit exists, and no CISA KEV listing has been issued, indicating no known active exploitation at time of analysis.

Two compounding flaws in the Linux kernel's Intel Speed Select Technology (ISST) ioctl handler allow a local low-privileged user to trigger out-of-bounds memory access or NULL pointer dereference in kernel space. The `isst_if_clos_assoc()` function applies an off-by-one validator (`>` instead of `>=`) against the `sst_inst[]` array boundary, permitting socket_id equal to `topology_max_packages()` to index one entry past the allocated array; a second path omits a NULL check for valid in-range socket IDs whose package has no bound TPMI SST instance, both dereferences reaching `map_partition_power_domain_id()`. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit has been identified at time of analysis and EPSS (0.20%, 10th percentile) reflects very low observed exploitation activity.

Use-after-free in the Linux kernel's interconnect subsystem allows local low-privileged attackers to corrupt kernel heap memory, potentially enabling privilege escalation to root. The flaw resides in `icc_get()` and `of_icc_get_by_index()`: when `kasprintf()` fails to allocate memory for `path->name`, the error handler calls `kfree(path)` directly while the path's request structures are already linked into interconnect-node hash lists via `hlist_add_head()`, leaving dangling pointers that subsequent interconnect operations dereference. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit or CISA KEV listing exists at time of analysis.

Stack memory disclosure and integer underflow in the Linux kernel's IPMI ipmb subsystem allow a local low-privileged attacker with write access to the IPMB device node to read uninitialized kernel stack bytes and trigger a buffer length underflow in `ipmb_write()`. The root cause is that `ipmb_write()` parses message fields prior to validating the length byte, so a zero-length or undersized write crosses into adjacent stack memory. CVSS rates confidentiality impact as High (stack leak) and availability impact as High (SMBus block-write length underflow), while EPSS at 0.17% reflects the niche attack surface. No public exploit or active exploitation has been identified.

Use-after-free in the Linux kernel's Open vSwitch (OVS) flow deletion path allows a local attacker with low privileges to crash the kernel or potentially escalate privileges. The bug exists in ovs_flow_cmd_del(): when a CMD_DEL netlink command removes a flow from the OVS table, flow->mask is scheduled for RCU-deferred free, but ovs_flow_cmd_fill_info() subsequently reads that pointer after the RCU grace period may have already freed it-a narrow but real race window confirmed by KASAN traces. Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042; no public exploit or active exploitation is confirmed at time of analysis.

NULL and error pointer dereference in the Linux kernel's ravb (Renesas Ethernet AVB) driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges by querying PTP hardware clock state during an invalid lifecycle window. The flaw affects the ravb driver from Linux 4.2 onward, where priv->ptp.clock is either NULL before the first interface open or left holding an error pointer after a failed PTP clock registration. Fixes are confirmed across stable branches in kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists.

Out-of-bounds read in the Linux kernel dm-pcache subsystem allows a local low-privileged user to read past segment data boundaries into adjacent control areas, exposing sensitive kernel memory and potentially crashing the kernel. Specifically, cache_replay(), the writeback worker, and the GC worker all miscalculate the tail-kset read length using PCACHE_SEG_SIZE minus the segment offset rather than the actual data-region remainder via cache_seg_remain(). This affects Linux 6.18.x (before 6.18.50), 7.2.x (before 7.2.4), and pre-release 7.3-rc1. No public exploit or active exploitation has been identified; EPSS is 0.17% (6th percentile).

Use-after-free in the Renesas I3C driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges on systems equipped with Renesas I3C hardware. The flaw stems from a race between a timed-out transfer cleanup path, which frees the transfer struct, and a late-arriving interrupt whose handler dereferences that now-freed memory. No public exploit has been identified, and exploitation requires specific hardware, but the UAF primitive theoretically supports memory corruption beyond a simple crash.

Denial of service in Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 lets a remote unauthenticated attacker pin CPU or crash a worker thread by feeding crafted text to either of the two built-in RegexNameFinder patterns (EMAIL and URL) obtained via RegexNameFinderFactory.getDefaultRegexNameFinders(). The EMAIL pattern's ambiguous nested quantifiers cause quadratic catastrophic backtracking (~32 KB of local-part characters burns seconds of CPU per find() call), while the URL pattern's nested capturing repetition recurses once per query token, exhausting the thread stack and throwing StackOverflowError (~4 KB, or ~1 KB on -Xss512k worker threads). No public exploit was identified at time of analysis; this is availability-only with no code execution or data exposure.

SymSpellModelSerializer in Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 crashes the host JVM with an OutOfMemoryError when deserializing a crafted SymSpell binary model file whose unigramCount or bigramCount field is set to Integer.MAX_VALUE, forcing a 4-8 GB heap allocation attempt. The root cause (CWE-789: Uncontrolled Memory Allocation) is that these two 32-bit count fields are validated only for non-negativity - no upper bound prevents attacker-controlled pre-sizing of a LinkedHashMap before any dictionary entries are consumed. The attack payload is described by the advisory as under 100 bytes, requires no prior authentication if the target application accepts externally supplied model bytes, and is effective against every deserialization code path in the opennlp-spellcheck extension. No public exploit has been identified at time of analysis, and exposure is substantially limited to the small population running pre-release milestone builds.

Process termination via unrecovered panic in AWS SDK for Go v2's EventStream header decoder allows a remote actor to crash any Go application consuming AWS streaming service responses. Sending a crafted EventStream response frame containing a header value type byte outside the valid range triggers an unhandled Go panic that propagates to terminate the host process. The affected surface includes Bedrock inference and agent runtime packages, making AI/ML workloads on AWS a particularly relevant target; no public exploit or active exploitation has been confirmed.

Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.

Uncontrolled resource consumption in jackson-databind's CoreXMLDeserializers allows unauthenticated remote attackers to trigger multi-minute CPU saturation via a single oversized HTTP request. When jackson-databind deserializes a JSON string into a javax.xml.datatype.Duration or XMLGregorianCalendar field, it passes the raw string directly to JDK's DatatypeFactory, which internally calls BigInteger(String) and BigDecimal(String) constructors that exhibit O(n²) time complexity relative to digit count. Because the malicious digits are embedded in a JSON string token rather than a JSON number token, jackson-core's existing StreamReadConstraints.maxNumberLength guard is bypassed entirely. A few megabytes of input containing millions of digits can consume tens of seconds to minutes of CPU, and a handful of concurrent such requests can exhaust a server's worker thread pool. No public exploit or CISA KEV listing has been identified at time of analysis.

Memory exhaustion DoS in the expressjs/compression Node.js middleware (versions before 1.8.2) allows remote unauthenticated attackers to crash any Express server using the package. When a client aborts an HTTP connection while a compressed response is in flight, the zlib transform stream allocated for that response is never destroyed, permanently leaking its native heap memory. An attacker can automate rapid request-then-abort cycles to exhaust all available server memory, causing process termination. The issue is fixed in 1.8.2 per the OpenJS Foundation advisory; no public exploit code or KEV listing has been identified at time of analysis.

Unauthenticated remote denial of service in Net-SNMP through 5.9.5.2 allows any network-reachable attacker to permanently suspend all SNMP processing by connecting to the SMUX listener and withholding data. The root cause is smux_accept() issuing a blocking recv() call with no timeout on every newly accepted SMUX connection, stalling snmpd's single-threaded main loop indefinitely. Because the block is permanent and snmpd performs all SNMP agent work in that same thread, the entire agent - monitoring, traps, polling - ceases until the process is manually restarted. No public exploit identified at time of analysis, though a researcher gist documenting the behavior is publicly linked in the advisory.

Unauthenticated remote denial-of-service in HPE IceWall Federation Agent and Proxy allows a network attacker to crash or render unavailable the identity federation and authentication proxy service. The root cause is improper handling of incorrect data types (CWE-241), meaning the software fails to gracefully reject or process malformed input, triggering an availability failure. No active exploitation or public exploit code has been identified at time of analysis.

Memory exhaustion in multiparty Node.js library (versions 2.1.0 through <4.3.1) allows any unauthenticated network attacker to crash the host process with a single crafted HTTP request. The parser accumulates multipart part headers into an unbounded in-memory buffer with no size cap, consuming available process memory until the Node.js server is killed. The vulnerability carries no confidentiality or integrity impact - this is a pure availability issue addressed in multiparty 4.3.1, which enforces a maximum on the bytes buffered per part header block.

A denial-of-service condition in ZJU-FAST-Lab EGO-Planner-v2 (all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42) is triggered by the interaction between the traj_server and poscmd_2_odom nodes and the EGOReplanFSM emergency recovery logic, causing the planner to become unresponsive. The affected software is an open-source trajectory planner for autonomous quadrotors, so a successful denial of service can translate from a crashed planning process directly into loss of autonomous flight control. There is no confirmed evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.15% (5th percentile), indicating low predicted exploitation activity.

Heap-based buffer overflow in the Sofia IPC daemon's WS-Addressing Action transformation function allows remote unauthenticated attackers to crash Xiongmai XM530 IP cameras or potentially achieve arbitrary code execution by sending a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes. Affected firmware is HMT.CM2005-v220608.1837 and all earlier versions. A public vulnerability research repository exists for this CVE, suggesting exploit code or detailed PoC is available. No public exploit identified as confirmed actively exploited at time of analysis.

Denial of service in the RACER swarm-exploration framework (Robotics-STAR-Lab / SYSU STAR Group) lets an attacker who can reach the exploration manager's ROS communication graph drive FastExplorationFSM::optTimerCallback() into an uncontrolled resource-consumption state, stalling or crashing the node and halting multi-robot exploration. The flaw is classified CWE-400 with a CVSS 3.1 base of 7.5 (full availability impact, no confidentiality or integrity impact). No public exploit code or CISA KEV entry was identified in the supplied intelligence, and EPSS is only 0.15% (5th percentile), consistent with the niche academic-robotics deployment of this codebase.

Lua sandbox bypass in Suricata 8.0.0-8.0.4 allows a crafted Lua detection rule that registers an excessive number of flow variables to corrupt Suricata's internal Lua detection state and escape the restricted Lua execution sandbox. Deployments with `security.lua.allow-rules` enabled face both integrity loss - attacker-controlled Lua rules can subvert detection logic - and availability risk, as the same corruption pathway can crash the Suricata process entirely. No public exploit has been identified at time of analysis; vendor-released patch version 8.0.5 is available.

Uncontrolled memory growth in Suricata's IKEv2 application-layer parser allows remote unauthenticated attackers to exhaust system memory by sending repeated crafted UDP packets, potentially disabling the IDS/IPS/NSM engine entirely. All Suricata releases prior to 7.0.16 and 8.0.5 are affected; the parser accumulates client transform state without any upper bound, making it trivially exploitable from the network. No public exploit code has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a credible denial-of-service risk in any deployment where IKE parsing is active.

Uncontrolled memory growth in Suricata's LDAP application-layer parser allows unauthenticated remote attackers to exhaust host memory by sending crafted LDAP traffic over UDP, resulting in denial of service. Affected versions are 8.0.0 through 8.0.4; the flaw does not extend to the 7.x release line based on the stated version range. The practical consequence is that a successful attack disables Suricata's IDS/IPS inspection capability, creating a monitoring blind spot on the protected network segment. No public exploit code or active exploitation has been identified; a vendor-released patch (8.0.5) is available.

Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows remote authenticated low-privilege users to delete arbitrary RabbitMQ queues or exchanges, causing a denial of service across the platform's messaging infrastructure. The CVSS scope-changed metric (S:C) confirms the impact radiates beyond DataStage itself into the underlying RabbitMQ broker relied upon by dependent platform services, elevating the effective blast radius. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.

Memory exhaustion in Suricata's NFS application-layer parser allows remote unauthenticated attackers to crash or severely degrade the IDS/IPS/NSM engine by sending crafted NFS traffic. Affected versions span all releases prior to 7.0.16 and 8.0.5, covering both the stable and current release branches maintained by OISF. No active exploitation has been confirmed, but the zero-prerequisite network attack path and the security-critical role of Suricata in detection pipelines make this operationally significant.

Uncontrolled memory consumption in Suricata's DNP3 reassembly engine allows a remote unauthenticated attacker to exhaust host memory by sending crafted DNP3 traffic, causing denial of service. Versions prior to 7.0.16 and 8.0.5 fail to enforce sufficient parser-level bounds during DNP3 stream reassembly, meaning unbounded buffering is possible. The attack surface is significantly constrained because DNP3 parsing is not enabled by default, limiting realistic exposure to Suricata deployments actively monitoring OT/ICS network segments. No public exploit identified at time of analysis.

Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows a low-privileged authenticated network user to disable specific server functionality under certain conditions, producing both availability and integrity impact. The root cause is CWE-269 (Improper Privilege Management): the server fails to enforce correct privilege boundaries around a particular Db2 operation, allowing a user whose authorization should not extend to that action to invoke it. No public exploit has been identified at time of analysis; IBM has released a patch and the vendor advisory is the sole remediation reference.

Denial of service in Suricata IDS/IPS/NSM engine (versions prior to 7.0.16 and 8.0.5) allows an unauthenticated remote attacker to exhaust CPU resources by sending HTTP responses containing crafted oversized `Content-Disposition` headers, causing the inspection engine to perform repeated expensive parsing iterations without bounds. The attack requires no privileges and exploits the security tooling itself - disabling Suricata's inspection capability - which can serve as a precursor to attacks that would otherwise be detected. No public exploit code and no CISA KEV listing have been identified, but the OISF has released patched versions and a rule-based workaround.

Denial of service in Suricata IDS/IPS/NSM engine (OISF) affects all versions prior to 7.0.16 and 8.0.5, where a protocol change during HTTP/2 traffic processing triggers a type confusion (CWE-843). Crafted network traffic can crash the Suricata process, disabling network intrusion detection/prevention. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; the fix ships in 7.0.16 and 8.0.5.

Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.

Improper privilege management in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated user who holds a low-privilege administrative role modify security configuration, resulting in information disclosure or denial of service. The flaw is remotely reachable with low complexity (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N) but requires valid administrative credentials, so it is an insider/privileged-abuse issue rather than an unauthenticated attack path. EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis; IBM has published a fix.

Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corrupt application heap memory during OCR engine initialization, potentially leading to a crash or controlled code execution. The root cause is that UNICHARSET::load_via_fgets treats the declared character count as a trusted loop bound and uses the incrementing id variable as a direct unichars vector index, while unichar_insert_backwards_compatible silently performs no-op insertions for duplicate or empty representations - causing id to exceed unichars.size() and subsequent set_* writes to access memory beyond the vector. No patched release is available as of this review; only an upstream source commit fix exists.

Integer overflow in Amazon Deep Java Library's tensor buffer validation component (versions 0.13.0 through 0.36.0) enables remote unauthenticated attackers to read from adjacent process memory or crash the serving process by submitting a crafted tensor payload. The CVSS 4.0 score of 8.8 reflects a straightforward network-exploitable path requiring no authentication and no preconditions (AV:N/AC:L/PR:N/UI:N), with dual confidentiality and availability impact. Vendor-released patch 0.37.0 is available; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow in Tesseract OCR 5.5.3 and earlier corrupts the stack during legacy engine initialization, enabling denial of service and potential control-flow hijacking when a crafted `.traineddata` file is processed. The flaw originates in `Classify::ReadNormProtos` (normmatch.cpp), where unbounded `std::istream::operator>>(char*)` extraction into a fixed 61-byte stack buffer allows a 99-character NORMPROTO token to overwrite up to 39 bytes beyond the buffer boundary during `TessBaseAPI::Init`. No fixed release is available at time of analysis; an upstream fix commit exists but has not been tagged as a release, and no public exploit has been identified at time of analysis.

Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or host memory and permanently block request handlers by sending UploadPart requests that declare a large Content-Length but deliver no body bytes. The handler in cmd/serve/s3/multipart.go pre-allocates lib/pool pages sized to the attacker-controlled Content-Length header before any body bytes arrive, and the waitForTurn scheduling mechanism admits one additional oversized part even when --multipart-streaming-buffer-limit is active, partially bypassing the intended cap. The issue is fixed in rclone v1.75.1; no public exploit or CISA KEV listing has been identified.

NULL pointer dereference in Suricata's Lua TLS certificate scripting interface (prior to version 7.0.16) allows an unauthenticated remote attacker to crash the Suricata engine by routing crafted TLS traffic - with intentionally absent certificate fields - through a monitored network segment. Exploitation is gated on the deployment using Lua scripts that invoke `TlsGetCertInfo` or equivalent TLS certificate helpers; default rule-only deployments without Lua scripting are unaffected. No public exploit identified at time of analysis, but the trigger condition is mechanically simple and the availability impact is total for the affected process, with particular risk in inline IPS deployments where a crash can result in fail-open behavior.

Memory exhaustion via decompression bomb in Suricata prior to 7.0.16 and 8.0.5 allows a remote unauthenticated attacker to crash or degrade the IDS/IPS engine by transmitting crafted HTTP/2 DATA frames with extreme compression ratios. The HTTP/2 response-body decompression path (supporting gzip, deflate, and brotli) lacked an effective upper bound on allocated buffer size, enabling a data-amplification (zip-bomb) attack against monitored network segments. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and critical position of Suricata in network defenses elevate practical risk.

Denial of service in NASA-JPL ION-DTN before 4.2.1-a.1 allows unauthenticated remote attackers to crash the ION process by sending a single crafted BPv7 bundle with a zero-length payload block. The `canonicalizePayloadBlock()` function in `bpsec_util.c` forwards `bundle->payload.length` directly to `zco_clone()` without a zero-value guard; when that value is zero, the CHKZERO assertion fails, `sm_Abort()` is invoked, and the process terminates via SIGABRT. Critically, the crash occurs before any HMAC verification, so no credential, key, or prior session state is needed to trigger it.

Unvalidated deserialization input in t-digest 3.1-3.3 exposes any service calling MergingDigest.fromBytes on attacker-controlled data to denial of service - the method reads length and capacity fields from the serialized header and uses them directly to allocate and index arrays without bounds checking, triggering ArrayIndexOutOfBoundsException or NegativeArraySizeException and aborting the parsing thread. Any analytics pipeline or API endpoint that accepts serialized t-digest state from external callers is vulnerable to remote, unauthenticated thread termination. No public exploit code has been identified at time of analysis, and this CVE is not in the CISA KEV catalog.

Heap-based buffer overflow in Bosch Sensortec COINES_SDK versions 2.10 through 2.12.2 allows a malicious or compromised USB or BLE peripheral to corrupt host heap memory, leading to process crash or potential arbitrary code execution on the developer's machine. The root cause is that the PC bridge protocol decoder in bridge_decoder.c unconditionally trusts the packet length field supplied by the connected peripheral, passing it directly to mqueue_add_data without validating it against the fixed 255-byte queue slot - enabling a payload of up to ~3 KB to overwrite adjacent heap metadata via memcpy. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for physical or BLE proximity and user-initiated device pairing.

Stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI C library allows a malicious or compromised sensor or bus participant to corrupt host firmware stack memory, leading to denial of service or arbitrary code execution. The flaw resides in bhi385_parse_debug_message() (bhi385_parse.c), which reads an 8-bit message length directly from the attacker-controlled FIFO event payload and passes it unchecked to memcpy targeting a fixed 17-byte stack buffer - any length byte above 16 overwrites adjacent stack data. No public exploit or CISA KEV listing has been identified at time of analysis, but the vendor has published an advisory under BOSCH-SA-223618.

Unchecked memcpy in the Bosch Sensortec BHI360 SensorAPI C-Library's debug FIFO parser allows a physically-positioned attacker to overflow a 17-byte stack buffer in `bhi360_parse_debug_message()`, corrupting the host microcontroller's saved return address and enabling arbitrary code execution. A compounding format-string flaw - the overflowed buffer is subsequently passed to a printf-style logging sink - provides an additional write-anywhere primitive for `%n`-style exploitation. No public exploit code has been identified and exploitation is constrained to physical or bus-adjacent positions (CVSS AV:P), but the double-primitive nature makes this highly reliable on bare-metal targets lacking stack canaries.

Remote, unauthenticated resource exhaustion in GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.14 (build 20260903) allows an attacker to disable the device by abusing the VLSVR streaming protocol. By declaring arbitrarily large frame lengths and then stalling the blocking receive indefinitely, an attacker can lock up memory buffers, exhaust connection slots, and starve worker threads until the license plate recognition service becomes entirely unresponsive. No active exploitation or public proof-of-concept has been identified at time of analysis.

Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs.

PTZ connection starvation in GeoVision GV-LPC2011/GV-LPC2211 firmware V1.13 allows an unauthenticated remote attacker to monopolize the device's PTZ accept loop by establishing and retaining a session without releasing connection state, permanently blocking all subsequent PTZ control connections until the device is rebooted. The root cause is improper connection lifecycle management (CWE-400: Uncontrolled Resource Consumption) - the firmware imposes no idle timeout, connection limit, or non-blocking safeguard on the PTZ listener. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects trivially automatable, unauthenticated network exploitability.

Buffer overflow in the XML processing stack of Palo Alto Networks PAN-OS enables unauthenticated remote attackers to cause denial of service on VM-Series virtual firewalls or execute arbitrary code with root privileges on PA-Series physical appliances. The vulnerability is reachable via the management web interface or dataplane interface, and Panorama management platforms are also confirmed in scope. No public exploit has been identified at time of analysis; the CVSS 4.0 supplemental metric E:U corroborates no known active exploitation.

Unauthenticated remote attackers can create arbitrary durable queues on Apache Artemis and Apache ActiveMQ Artemis brokers via the native CORE protocol due to missing authentication enforcement in the protocol handler. The vulnerability spans the entire Apache ActiveMQ Artemis release history (1.0.0 through 2.44.0) and the recently rebranded Apache Artemis fork (2.50.0 through 2.56.0), making the unpatched population potentially very large. Exploitation enables persistent unauthorized broker state manipulation and denial-of-service through storage and memory exhaustion, with no credentials or user interaction required; no public exploit code has been identified at time of analysis.

Denial of service in ZJU-FAST-Lab EGO-Planner-v2 (all versions through commit 5c99a958) lets an attacker stall or crash the planner by driving the EGOReplanFSM component into uncontrolled resource consumption (CWE-400). The vulnerable component is the finite state machine that orchestrates local trajectory replanning for autonomous quadrotors, so a successful attack removes fresh trajectory generation from the flight stack. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only), EPSS 0.17% (6th percentile) and no CISA KEV listing; no public exploit code is confirmed in the supplied metadata, although the report references a public GitHub issue and a gist that may contain reproduction detail.

Denial of service in the Robotics-STAR-Lab (SYSU STAR Group) RACER autonomous exploration framework allows an unauthenticated remote attacker who can reach the exploration stack to disrupt its exploration state machine, halting or crashing mission execution on an affected robot. The flaw is an improper check or handling of exceptional conditions (CWE-703) that is remotely reachable with low complexity and no privileges or user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only high impact). No public exploit code was identified in the supplied metadata and exploitation likelihood is very low (EPSS 0.17%, 6th percentile), consistent with RACER being a niche academic robotics project rather than widely deployed production software.

Denial-of-service in EGO-Planner-v2, ZJU-FAST-Lab's open-source drone trajectory replanning framework, allows unauthenticated remote attackers to crash the planning process by triggering uncontrolled resource consumption in three FSM callback functions. All repository commits up to 5c99a95880401e2599638d567abc0e240396cb42 are affected, with no vendor-released patch identified at time of analysis. A public gist documenting the issue exists, though no confirmed active exploitation has been observed, and EPSS is extremely low at 0.17%.

Path traversal in the Pandora malware-analysis platform (pandora-analysis, versions ≤1.12.7) lets an attacker who submits a crafted archive or disk image write extracted files outside the intended extraction directory. Because the extractor worker (ISO, BZ2, CAB, GZ, LZMA handlers) wrote decompressed content to attacker-influenced paths without confirming the destination stayed inside the target directory, a malicious sample can overwrite files accessible to the worker process, enabling file tampering, denial of service, and potential further compromise. No public exploit identified at time of analysis; the fix is present in the referenced upstream commit.

Unauthenticated remote denial-of-service in HPE Aruba ClearPass Policy Manager (CPPM) allows a network attacker to crash or degrade the web-based management interface without any credentials. Exploitation causes instability and sustained performance degradation on the CPPM server, potentially disrupting network access control policy enforcement across the environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

A double-free in the CalDAV calendar worker of Cyrus IMAP before 3.12.4 lets an authenticated calendar user crash that worker by sending a WebDAV PATCH request carrying PATCH-ACTION="BYPARAM@..." against a calendar resource that holds two or more properties of the matched kind. The vulnerability is reachable only with valid credentials and with the CalDAV/calendar component enabled (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, CWE-415), and the assessed outcome is a worker crash/restart rather than data disclosure or code execution. No public exploit code has been identified and EPSS is low at 0.22% (12th percentile); CISA SSVC rates exploitation as 'none' and the issue as not automatable, so this is a bounded availability bug rather than a critical-priority one.

Uncontrolled stack consumption in eprosima Fast DDS allows any unauthenticated participant in the same DDS domain to remotely crash target Fast DDS processes with a single crafted network message. The DDSSQLFilter component recursively parses the filterExpression field of SEDP DATA submessages during endpoint discovery; a sufficiently deeply nested expression drives unbounded recursion that exhausts the stack and terminates the target process. Vendor-released patches are available across all maintained branches; no public exploit code or active exploitation has been identified at time of analysis.

Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and setRefMultipleDDicts on already-closed stream objects, writing through freed native (JNI) pointers into arbitrary JVM memory. The root cause is missing closed-state validation in stream classes such as BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer, meaning the JNI layer operates on native context structures that have already been released. Exploitation can corrupt unrelated heap objects or terminate the JVM process entirely. No public exploit code or CISA KEV listing is identified at time of analysis.

Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM crashes by closing a Zstandard dictionary after it has been associated with a stream or context. The library's locking design released the dictionary's shared lock immediately after the load call, leaving the stream holding a native pointer to freed memory; subsequent read or write operations on that stream then access freed native heap, producing undefined behavior at the JVM/native boundary. No public exploit has been identified at time of analysis, and a patched release (v1.5.7-14) is available with two upstream commits.

Out-of-bounds memory access in zstd-jni versions 1.3.3-1 through 1.5.7-13 enables unauthenticated network-accessible attackers to crash the JVM by supplying crafted sample-size arrays to the Zstd.trainFromBufferDirect dictionary-training API. The native C implementation (jni_zdict.c) failed to sum caller-supplied sample lengths against the DirectBuffer's actual capacity before iterating, allowing the native code to walk past the buffer allocation boundary and trigger a hard JVM termination. A patched release (v1.5.7-14) is available; no public exploit has been identified at time of analysis.

Deserialization in t-digest 3.1 through 3.3 allows remote attackers to inject IEEE 754 NaN values as centroid means via crafted byte streams passed to MergingDigest.fromBytes(), bypassing absent validation checks. The injected NaN values corrupt the internal total-ordering invariant of the centroid list, causing sort comparisons to return inconsistent results and degrading subsequent merge operations from O(n log n) to O(n²) algorithmic complexity. The result is severe CPU exhaustion and service delays for any application that deserializes attacker-controlled t-digest payloads; no public exploit code or CISA KEV listing exists at time of analysis.

Memory and CPU exhaustion in PocketMine-MP before 5.39.2 allows any authenticated in-game player to render the game server unresponsive by sending a ModalFormResponsePacket with an arbitrarily large JSON payload. The server processes incoming form response data without enforcing any size limit, enabling an attacker to exhaust server memory and CPU with JSON arrays containing millions of elements. A public proof-of-concept Node.js script is confirmed in vendor advisory GHSA-788v-5pfp-93ff; no public exploit identified at time of analysis in CISA KEV.

Unauthenticated remote denial-of-service in PocketMine-MP before 5.41.1 allows any actor who can reach the server's Minecraft Bedrock port to crash the process with a single crafted LoginPacket. The server's JsonMapper is configured to log unexpected clientData JWT properties using PHP's `var_export()` without any size or depth bounds; an attacker embeds a deeply nested or massive object structure in an unknown property, causing the PHP process to exhaust all available memory during serialization. A proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing at time of analysis, but the zero-authentication, pre-auth attack vector and public PoC make this a high-priority patch for any publicly reachable PocketMine-MP instance.

Unauthenticated remote denial-of-service in PocketMine-MP before 5.43.1 allows any network client to crash the Minecraft Bedrock server by sending a malformed Certificate field during offline login. The LoginPacketHandler fails to validate the Certificate JSON structure before mapping it to an internal auth chain object, leaving PHP class properties uninitialized and triggering a fatal error that terminates the server process. A publicly available proof-of-concept is referenced in the vendor's GitHub Security Advisory (GHSA-g2fj-p69p-9chp); no CISA KEV listing is confirmed at time of analysis.

Memory exhaustion denial of service in PocketMine-MP before 5.32.1 allows any authenticated Bedrock client to crash the server by sending a single crafted ResourcePackClientResponsePacket. The server iterates the client-supplied packIds array without deduplicating UUIDs, so a custom client supplying hundreds of copies of a valid pack UUID causes the server to transmit ResourcePackDataInfoPacket repeatedly, rapidly exhausting PHP process memory. No public KEV listing, but exploit details are publicly available via GHSA-fqqv-56h5-f57g.

Denial-of-service via compression bomb in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to exhaust server resources by sending highly compressed payloads that expand dramatically upon decompression. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.