Denial of Service

Uncontrolled memory allocation in Spring Integration's RFC6587SyslogDeserializer allows any network-reachable, low-privileged syslog sender to supply an arbitrarily large octet count, causing the TCP inbound adapter to allocate an unbounded byte array and potentially read across RFC 6587 message frame boundaries. Affected release lines span 5.5.x through 7.1.0. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low attack complexity and low privilege requirement make exploitation straightforward for any entity permitted to deliver syslog messages to the adapter.

Denial of Service in Spring Reactor Core affects any JVM service that uses the Flux.windowTimeout operator with the fairBackpressure option enabled, across three major release trains (3.4.x through 3.8.6). An unauthenticated network attacker can trigger resource exhaustion or stall the reactive pipeline, causing full availability loss for the affected service. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; the high attack complexity rating (AC:H) reflects the requirement for a specific, non-default operator configuration.

Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'Edit source' role to induce sustained CPU exhaustion by storing a catastrophically-backtracking pattern in a source string's quality-check flags. Both the RegexCheck and PlaceholderCheck mechanisms compile user-supplied expressions at validation time but execute them without any runtime timeout, so a single malicious flag edit can pin server CPU indefinitely by re-triggering evaluation across every linked translation unit in the same request. No public exploit code exists and the issue is not listed in CISA KEV, but the low complexity and clear role-based attack path make it a credible internal or supply-chain threat for multi-contributor Weblate deployments.

Denial-of-service and minor integrity impact in Oracle Java SE 7u511 allows unauthenticated remote attackers to crash or hang the JVM via the 2D graphics rendering component, exploitable across multiple network protocols with no authentication or user interaction required. The attack surface is broadened by the component's exposure through APIs consumed by web services, sandboxed Java Web Start applications, and sandboxed Java applets loading untrusted code. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the low exploitation complexity means automated scanning is feasible.

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Ignore IPC errors for pipeline state change if the firmware state is crashed or the IPC has timed out. If the firmware has crashed the kernel still needs to go through the state changes to reset its internal to be able to correctly work the next time the DSP is booted up. The case with IPC timeout is a bit more problematic, but it has been rootcaused to be the result of system scheduling blockage and the firmware did actually received and handled the message, but the reply handling got blocked by issues outside of the SOF stack. So far the best way to handle this is to continue with setting the state.

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthor_fw_load_section_entry() skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section->mem is left as NULL. Later reload and unplug paths iterate over all firmware sections and dereference section->mem, which can lead to a NULL pointer dereference. Zero-sized firmware sections are valid, so accept them as no-op entries but skip adding them to the section list.

In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows: sudo ./testptp -d /dev/ptp0 -f 0 [ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] [ 552.061946] Call Trace: [ 552.064487] <TASK> [ 552.066681] ptp_clock_adjtime+0x1c0/0x2c0 [ 552.070874] ? get_clock_desc+0x6b/0xb0 [ 552.074825] pc_clock_adjtime+0x78/0xc0 [ 552.078755] __do_sys_clock_adjtime+0x85/0x110 [ 552.083293] do_syscall_64+0xea/0x610

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before a stream is attached to it. BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu] Call Trace: drm_vblank_enable drm_vblank_get drm_crtc_get_sequence_ioctl drm_ioctl_kernel drm_ioctl Reproduced by running VKCTS with WSI tests enabled on RADV. Guard the enable path on acrtc_state->stream being non-NULL, matching the existing checks in this function. (cherry picked from commit 7b1b31bf6942e6f43509b48da23f8e27269aac39)

In the Linux kernel, the following vulnerability has been resolved: xfs: fix another iunlink infinite loop bug in online fsck xrep_iunlink_resolve_bucket is supposed to reconstruct as much of the incore prev and next unlinked list pointers based on what it finds on disk and in memory before we move on to relinking the truly lost inodes back into the unlinked list. However, it's still vulnerable to infinite loops that come in via the next_unlinked pointers. Fix this problem by remembering which inodes we've already seen and checking new agino pointers against that. If a bit is already set, either this is a loop or the inode has nonzero link count. We'll deal with the second case in a subsequent patch.

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipc_config_data buffer for copier widgets is built once during ipc_prepare (called from sof_pcm_setup_connected_widgets) and cached for reuse. For host copiers this buffer contains the copier_data with gtw_cfg.node_id (host DMA ID). For DAI copiers it additionally includes a dma_config_tlv trailer with stream_id and dma_channel_id for HDA link DMA. On suspend/resume, both host and link DMA streams are released and re-allocated with potentially different stream tags. The underlying copier_data and dma_config_tlv structures are correctly updated by host_config and sdw_hda_dai_hw_params respectively. However, since the widget list (spcm->stream[].list) persists across suspend, sof_pcm_hw_params skips sof_pcm_setup_connected_widgets and ipc_prepare never runs again to rebuild ipc_config_data. The stale cached payload is then sent to firmware with boot-time DMA channel assignments, causing DMA channel conflicts that lead to firmware errors and crashes. Fix this by refreshing copier_data and dma_config_tlv portions of ipc_config_data in sof_ipc4_widget_setup right before the IPC message is sent. This ensures the payload always reflects the current DMA state regardless of whether ipc_prepare ran. For DAI copiers, the gtw_cfg.config_length in copier_data is temporarily inflated to include the TLV size (matching the ipc_config_data layout) before copying, then restored, mirroring what sof_ipc4_prepare_copier_module does when first building the buffer.

In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in ar_context_release During the error handling path of the driver's probe function, a NULL pointer dereference can occur in ar_context_release(). When pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping fails), the devres cleanup mechanism invokes release_ohci(). This function unconditionally calls ar_context_release() to clean up the asynchronous receive contexts. However, if ar_context_init() was not yet called, ctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by devres_alloc()). ar_context_release() immediately dereferences ctx->ohci to get the dev pointer before checking if the context was actually initialized, leading to a crash: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543 Call Trace: release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567 release_nodes drivers/base/devres.c:546 [inline] devres_release_all+0x1a8/0x260 drivers/base/devres.c:576 device_unbind_cleanup drivers/base/dd.c:597 [inline] really_probe+0x451/0xae0 drivers/base/dd.c:772 To fix this, move the assignment of the dev pointer after the !ctx->buffer check. If ctx->buffer is NULL, it indicates that the context was never successfully initialized and there is nothing to release, safely avoiding the dereference of the uninitialized ctx->ohci pointer.

GitLab Enterprise Edition's SCIM user provisioning feature allows an authenticated low-privileged user to trigger an unbounded loop via specially crafted input, causing denial of service on the affected instance. Versions spanning a wide range from 11.10 through 19.3.0 are affected, with vendor-released patches now available. A publicly available exploit is documented in HackerOne report #3292470; however, this vulnerability is not listed in CISA KEV, indicating active exploitation has not been confirmed at scale.

GitLab CE/EE allows any authenticated user to cause denial of service against background job processing due to missing object count limits, affecting all versions from 12.8 through pre-19.3.1. The CVSS vector (PR:L, AV:N, A:H) confirms low-privilege network-accessible exploitation with full availability impact on Sidekiq-backed async processing, including CI/CD pipelines and repository operations. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.

Stack-based denial of service in GIMP's Seattle FilmWorks (SFW) image plugin crashes the application when a crafted SFW file triggers an unbounded variable-length array allocation on the stack. The flaw affects all GIMP versions per the GNOME CPE string and is confirmed across Red Hat Enterprise Linux 6 through 9. An attacker who can deliver a malicious SFW file to a user can reliably crash the GIMP process with no code execution or data exposure; no public exploit has been identified at time of analysis.

TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child processes by deliberately shrinking the TCP receive window to near-zero after issuing a DNS query over TCP, triggering an integer underflow (CWE-191). By repeating this pattern continuously, the attacker can deny all TCP-based DNS service from the affected NSD instance. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects moderate availability impact with zero confidentiality or integrity exposure.

TCP connection teardown handling in the Vanderbilt/Acre Security SPC5300.000 Main Board firmware v.3.14.1 accepts spoofed TCP FIN packets without validating sequence or acknowledgment numbers, enabling an attacker in physical or network proximity to forcibly terminate active TCP sessions and cause a denial of service. The affected device is a physical access control security panel, meaning exploitation could disrupt building access control operations. No public exploit code has been identified at time of analysis, and EPSS remains at the 4th percentile, reflecting minimal observed exploitation activity.

Replay attack vulnerability in the Acre Security (formerly Vanderbilt Industries) SPC5300.000 access-control panel allows a physically proximate attacker to cause a denial of service by injecting replayed application-layer payloads into an active TCP session handled by SPC Connect Pro software. Affected firmware is version 3.14.1 of the SPC5300.000 Main Board. No public exploit code has been identified at time of analysis, and EPSS probability is extremely low at 0.14% (4th percentile), but the target is life-safety physical security infrastructure where availability impacts carry elevated real-world consequences.

Denial of service in the Vanderbilt Industries / Acre Security SPC5300.000 Main Board running firmware v.3.14.1 allows a physically proximate attacker to crash the device by sending spoofed SYN packets, exploiting the panel's failure to bound resource consumption from crafted TCP traffic. The NVD-assigned CVSS vector uses AV:N (network), but the CVE description explicitly qualifies the attacker as physically proximate - a material, unresolved discrepancy that defenders must clarify with the vendor before assessing remote exploitability. No public exploit code and no active KEV-listed exploitation have been identified; EPSS probability is negligible at 0.14%.

Denial of service in the openRISC OR1200 soft-core processor (commit 83ac6b) stems from inaccurate program counter updates when Special Purpose Registers are modified, causing the processor to enter an invalid execution state. The flaw, classified under CWE-691 (Insufficient Control Flow Management), was discovered through hardware synthesis fuzzing (SynFuzz) at George Mason University. No public exploit code or active exploitation has been identified, and EPSS places the exploitation probability at 0.14% (4th percentile), consistent with a niche research-grade hardware target.

Heap-based buffer overflow in Das U-Boot (the Denx universal embedded bootloader) before 2026.04 allows an attacker who controls an ext4 filesystem image to trigger an integer overflow in the ext4fs_get_bgdtable() block-group descriptor table size calculation, resulting in an undersized allocation that is later overrun by memcpy(). Successful exploitation can lead to arbitrary code execution in the highly privileged pre-OS boot context, denial of service, or memory corruption. No public exploit identified at time of analysis (a referenced GitHub gist may contain a proof-of-concept but is unverified), EPSS is low at 0.18% (7th percentile), and it is not listed in CISA KEV.

libjpeg-turbo 3.2.0's PNG loader triggers an integer division-by-zero crash when tj3LoadImage12() or tj3LoadImage16() processes a valid indexed-color PNG image bearing a non-gray palette under the default pixel format. The fault occurs inside alloc_sarray(), generating a SIGFPE that terminates any application relying on those APIs to handle externally supplied images. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the crash is reproducible with a standards-compliant PNG file, making any network-facing image-ingestion service a realistic denial-of-service target.

Type confusion in BlueZ's SDP XML parser (sdp-xml.c) allows a low-privileged local caller to crash the bluetoothd daemon by submitting a crafted nested ServiceRecord via the RegisterProfile() D-Bus API. The parser stack is corrupted so scalar union data is misread as a sequence pointer, causing an invalid dereference and process termination - a local denial-of-service with no confidentiality or integrity impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Denial-of-service via heap buffer overflow in SQLite's optional SQLAR extension affects any application that compiles or loads ext/misc/sqlar.c and processes attacker-controlled archive entries. The root cause is an integer-width mismatch in sqlarUncompressFunc(): a 64-bit decompressed-size argument is silently truncated to 32 bits by sqlite3_value_int(), causing sqlite3_malloc() to allocate an undersized heap buffer before zlib's uncompress() writes the full payload into it (CWE-122). The vulnerability is absent from CISA KEV, EPSS stands at 0.28% (20th percentile), the upstream fix is confirmed at Git commit 169f68ed, and a third-party GitHub repository referencing the CVE suggests proof-of-concept code is publicly accessible.

Heap out-of-bounds read in GIMP's file-xwd plugin allows a crafted XWD image file to trigger an application crash or leak partial heap memory contents into the rendered image output. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when they open a malicious XWD file; the plugin fails to cross-validate image width and bytes-per-line parameters against the allocated buffer size, permitting an out-of-bounds read. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world urgency in the low-to-moderate range.

Unbounded recursive referrer traversal in ORAS CLI versions through 1.3.2 allows a malicious OCI registry to trigger client-side denial of service by returning a cyclic referrer graph. Because neither `fetchAllReferrers` in the discover path nor `RecursiveFindReferrers` in the backup/restore graph logic tracked visited descriptors, a minimal two-node cycle (A→B→A) is sufficient to exhaust heap memory and CPU on the connecting client. No public exploit has been identified at time of analysis, though the fix commit and its accompanying regression tests make the attack pattern trivially reproducible. A patched release, version 1.3.3, is available.

Null pointer dereference in iOS and iPadOS allows a locally installed app to trigger unexpected system termination (device crash/reboot) by supplying crafted input that bypasses input validation. Affected versions span the legacy 18.x branch (prior to 18.7.9) and the current 26.x branch (prior to 26.5), covering a broad swath of Apple mobile devices. No active exploitation has been identified - CISA KEV status is absent, SSVC rates exploitation as none, and EPSS sits at the 1st percentile - placing this squarely as a patch-cycle priority rather than an emergency response item.

Denial of service in GOVCERT-LU's eml_parser Python library (versions prior to 3.0.2) allows a network-reachable attacker to abort SOC pipeline email parsing by submitting a crafted EML file containing deeply nested CFWS (Comment/Folding White Space) constructs in address-bearing headers such as To, From, Cc, or Bcc. The RecursionError raised internally by Python's email.utils.getaddresses() propagates uncaught through eml_parser, halting analysis of the entire message rather than just the offending header. No public exploit or active exploitation has been identified at time of analysis; the vendor notes partial mitigation because callers already need to handle exceptions from other pathological EML inputs.

Heap out-of-bounds read in OpenEXR's RLE decompression path crashes the decoding process on ILP32 (32-bit) builds across versions 3.2.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. A crafted .exr file with a malicious RLE-compressed payload causes the 64-bit unpacked size to truncate before buffer allocation in OpenEXRCore decoding.c, after which unpack_32bit() reads past the allocated buffer boundary, resulting in denial of service. Exploitation requires a victim or automated pipeline to open the malicious file; no public exploit identified at time of analysis, and the vulnerability is constrained to ILP32 build environments.

Out-of-bounds write in OpenEXR's B44 decompression path on ILP32 (32-bit) builds allows an attacker to corrupt heap memory and crash any application that opens a crafted EXR file, affecting the C++ libraries, CLI tools, and PyOpenEXR bindings across versions 3.1.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. When a malformed B44-compressed scanline image triggers integer truncation in the scratch buffer size calculation before allocation, uncompress_b44_impl() subsequently writes using the full attacker-controlled channel width into the undersized buffer, producing a heap out-of-bounds write. Patches are confirmed available in 3.2.11, 3.3.13, and 3.4.14; no public exploit is identified at time of analysis.

Out-of-bounds read in OpenEXR's ILP32 builds enables denial of service via crafted uncompressed deep-tile EXR files across three active release branches (before 3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13). The root cause is a 32-bit integer overflow in OpenEXRCore's sample-count table size calculation that causes unpack_sample_table() to iterate beyond an undersized allocation. No public exploit or active exploitation has been identified; vendor-released patches are available for all three affected branches.

Substance3D - Designer crashes on availability when a victim opens a specially crafted malicious file, triggering a NULL Pointer Dereference that terminates the application. Adobe Substance 3D Designer users across all tracked versions (CPE wildcard) are affected, with impact limited to application-level denial of service - no code execution, data disclosure, or integrity compromise is possible. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, consistent with its low exploitability ceiling (requires local victim interaction).

Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.

Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.

Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.

NULL pointer dereference in the Zephyr RTOS OCPP 1.6 client allows a malicious or compromised OCPP central system - or a man-in-the-middle on an unencrypted ws:// connection - to remotely crash the OCPP reader thread of an EV charge point by returning a malformed CALLRESULT uid field. Impact is availability-only and platform-conditional: on MMU/MPU-equipped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION-enabled Zephyr targets, the fault invokes the fatal handler and produces a remote denial of service; on bare-metal targets where address 0 is readable, the call returns 0 and is benign. No public exploit is identified at time of analysis, and the vendor-supplied patch at the referenced commits is known to be incomplete - a second unguarded strtok_r/atoi pair in the same function path remains exploitable via a uid containing one token but no second hyphen-delimited segment.

Rclone before v1.75.0 panics in the WebDAV TUS creation handler when a transport failure returns a nil HTTP response, because `getTusLocationOrRetry` dereferences `resp.StatusCode` before checking the accompanying error - crashing the process if it runs as a long-lived VFS mount or multi-workload goroutine without a recovery boundary. An attacker who controls or compromises the configured WebDAV endpoint can trigger the crash by resetting the TCP connection before an HTTP response is returned, halting all unrelated work in the process. No public exploit code and no confirmed active exploitation have been identified at time of analysis.

Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against long-running Ruby applications that pass attacker-controlled input to `Nokogiri::XSLT::Stylesheet#transform` parameters containing null bytes. Each null-byte-bearing call leaks approximately 24-32 bytes of heap memory; meaningful service degradation requires sustained, high-rate malicious traffic against the specific code path. No public exploit has been identified at time of analysis, and the vulnerability is absent from CISA KEV. Notably, the VulnCheck-reported CVSS 4.0 score of 6.9 is higher than the Nokogiri maintainers' own assessment of CVSS 5.3 Moderate, reflecting scoring convention differences rather than disagreement on impact.

Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bundles a vulnerable libxml2. The flaw combines a stack buffer overflow when libxml2 reports DTD validation errors involving long (~3kb) QName prefixes (CVE-2025-24928) and a use-after-free during validation against untrusted XML Schemas using xsd:keyref with recursively defined types (CVE-2024-56171). Any Ruby/Rails application that validates attacker-supplied DTD or XSD content is exposed; no public exploit identified at time of analysis, and the issue is not in CISA KEV.

Unbounded memory allocation in CPython's zipfile module allows a crafted archive to exhaust process memory during decompression of bzip2, LZMA, or Zstandard members. The ZipExtFile._read1() method lacked the max_length output bound that the DEFLATE code path already enforced, permitting a small compressed member with an attacker-controlled declared size to expand into unlimited memory per read call. No public exploit is identified at time of analysis; exploitation requires user interaction (opening the archive), and the CVSS 4.0 base score of 2.1 reflects the low, availability-only impact.

Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding namespace management permissions to redirect a background worker process into probing arbitrary internal network addresses, including loopback interfaces and cloud instance metadata endpoints (e.g., 169.254.169.254). The dual-impact vulnerability enables both internal network reconnaissance (enumerating reachable IPs and reading service responses) and a denial-of-service condition against background workers due to the absence of an HTTP client timeout. No public exploit has been identified at time of analysis, and no confirmed KEV listing exists; however, the scope-changing CVSS vector (S:C) reflects that impact crosses trust boundaries from the application into adjacent internal infrastructure.

Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by flooding the initialize endpoint with requests. Each initialize call unconditionally appends a new dictionary to self._sessions with no eviction: the cleanup routine _cleanup_sessions is defined but has zero call sites in versions prior to 4.6.58, and the configured TTL is stored but never enforced. No public exploit is identified at time of analysis, but the attack requires only standard HTTP tooling against default deployments where no API key is configured.

Denial of service in GNU wget's FTP OPIE/S-KEY authentication handler allows a malicious or intercepted FTP server to cause wget to perform approximately 2.1 billion MD5 computations by supplying a crafted sequence number near INT_MAX in the OPIE challenge line. All versions of GNU wget with OPIE/S-KEY FTP authentication support are affected per CPE cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*. The --timeout option provides no mitigation because it governs network I/O exclusively, not CPU-bound computation. No public exploit identified at time of analysis; a fix is confirmed via upstream GitLab commit.

Unbounded memory growth in OpenSSL's Certificate Management Protocol (CMP) implementation enables unauthenticated remote attackers to exhaust server memory by repeatedly sending rejected CMP messages containing large extraCerts lists. Affected are OpenSSL 3.0.x before 3.0.22, 3.4.x before 3.4.7, 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2 - but only when the CMP server shares a single long-lived OSSL_CMP_CTX across requests. Vendor patches are available; SSVC classifies exploitation as 'none' and no public exploit code has been identified at time of analysis.

Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.6 by issuing repeated PUT /api/echo/like/:id requests with no authentication, rate limiting, or deduplication. Each request triggers a database write and four-key cache invalidation, enabling both persistent metric corruption and amplified load against the database and cache layers. A proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing exists at time of analysis.

Remote denial-of-service in vLLM before 0.27.0 allows unauthenticated network attackers to activate the DeepStream GPU video-decode backend per-request, initialize the process-wide GPU decode pool, and submit video content that bypasses pixel-limit enforcement, causing partial availability loss for concurrent inference requests. The root cause is vLLM's failure to classify DeepStream as a GPU backend subject to resource controls combined with an omitted pixel-limit check in the DeepStream decode path (CWE-400). No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker to stall connections and deny LDAP service to legitimate users. Affected deployments span Red Hat Directory Server 11, 12, and 13, plus 389-ds-base as packaged across RHEL 6 through 10. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 6.5 rating (AV:N/AC:L/PR:L) indicates low-complexity network exploitation requiring only a low-privilege LDAP bind - a realistic bar in any environment with shared directory users.

Stack buffer overflow in file-roller's archive extraction path causes denial of service when a victim opens or extracts a crafted 7z or RAR archive containing an excessively long file path entry. The unbounded string copy in the progress-line parsing routine overwrites a fixed-size stack buffer, crashing the application with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is gated entirely on user interaction with a malicious archive.

Out-of-bounds write in Zephyr RTOS's ext2 filesystem driver enables supervisor-mode memory corruption when a device mounts a crafted ext2 image from a physical storage medium such as an SD card. The driver's superblock validation function omits bounds-checking the s_log_block_size field, allowing an attacker-controlled value to produce an inflated block size that silently misconfigures the kernel memory slab allocator beyond its static backing buffer, with impact ranging from denial of service to potential code execution in kernel mode. No confirmed active exploitation or public POC is identified at time of analysis; a vendor patch is available as upstream commit f270f4bd0e59585da31e1fbaa79c5abf73f1364b.

Integer overflow in OpenEXR's deep tiled image decoder crashes any application that opens a crafted EXR file, affecting versions 3.1.0 through 3.4.13 across all three maintained release branches. The overflow occurs in OpenEXRCore's unpack_sample_table() function during the standard exr_decoding_run path, meaning no non-default configuration is required - only that the file uses the deep tiled variant of the format. Impact is denial of service via crash (no code execution demonstrated); no public exploit code exists and this vulnerability is not listed in CISA KEV.

NULL pointer dereference in OpenEXR 3.4.0-3.4.12 causes a deterministic crash in the OpenEXRCore C API function `exr_attr_set_bytes()` when a caller passes a positive `hint_length` alongside a NULL `type_hint` pointer, enabling reliable denial of service against any application that processes EXR content via this API. The flaw is confined to availability impact with no confidentiality or integrity exposure, and the CVSS 4.0 local attack vector limits remote exploitation to indirect paths such as network-facing EXR parsing pipelines. No public exploit code or active exploitation has been identified; a vendor-released patch is available in version 3.4.13.

Denial of service in OpenEXR 3.4.0 through 3.4.12 allows any application calling exr_start_read() on untrusted input to be unconditionally aborted by a crafted HTJ2K-compressed EXR file containing a QCD marker with lower five bits set to zero. The flaw chains two weaknesses: OpenJPH's vendored assertion-based validation calls abort() instead of returning a recoverable error, and OpenEXR's error handling wraps only its internal HT header parser, leaving downstream codestream construction calls entirely unprotected. No public exploit or active exploitation (CISA KEV) has been identified, but the trivial triggering condition and prevalence of OpenEXR in automated rendering pipelines make this a meaningful denial-of-service risk for media production infrastructure.

Stack-based out-of-bounds write in OpenEXR's HTJ2K decode path allows remote attackers to crash applications that process crafted EXR image files. Affected are OpenEXR versions 3.4.0 through 3.4.13, where the vendored OpenJPH AVX2 decoder fails to reject JPEG 2000 SIZ marker geometries in which the first tile does not intersect the visible image, leading to invalid codeblock computation and a stack memory corruption that terminates the process. No public exploit identified at time of analysis; a vendor-released patch is available in version 3.4.14.

CRI-O's container-creation code path crashes the daemon with an unrecovered Go runtime panic when processing an OCI image whose config.Env contains a malformed entry lacking an '=' character, under the specific condition that the CreateContainer request supplies a nil CRI Envs field. The crash terminates the crio daemon process, disrupting all container workloads on the affected node until the service is manually restarted - a node-wide denial of service. Affecting Red Hat OpenShift Container Platform 4, this requires high privileges (PR:H) to exploit; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stack exhaustion and a bounded memory over-read in GIMP's file-pix (ESM) plugin allow a crafted PIX image to crash the application and leak 21 bytes of stack memory into an intermediate file. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when opening untrusted PIX format images. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the DoS impact is reliable and the delivery vector - a malicious image file - is realistic for desktop users.

Zephyr RTOS's Hearing Access Service (HAS) GATT peripheral crashes when a previously bonded Bluetooth peer reconnects during a boot-time race window before bt_has_register() completes service initialization. The security_changed() callback - registered unconditionally via BT_CONN_CB_DEFINE - fires against NULL attribute pointers, triggering either a kernel assertion or a NULL dereference in bt_gatt_is_subscribed(). With CVSS AV:A/AC:H and confirmed DoS-only impact, this represents a medium-severity availability risk against embedded hearing-aid devices running Zephyr 3.6.0 through 4.4.1; no public exploit code has been identified, and a vendor patch is confirmed at 4.4.2.

Null pointer dereference in DrayTek VigorSwitch's formlogout web management function allows authenticated remote administrators to crash the management service, causing a denial of service across 28+ switch models spanning the G, P, Q, FX, and PX product lines. The flaw stems from absent validation of an empty or missing Cookie header before string handling in the formlogout handler, and is patched in firmware versions released under DrayTek's August 2026 security advisory. No public exploit code or CISA KEV listing is referenced in the available data.

Denial of service in OpenThread, the open-source Thread networking stack embedded in Google Nest devices (identified as Nest 3.78.518349), lets an attacker who has already joined the same Thread mesh send crafted Mesh Link Establishment (MLE) packets that trigger reachable assertion failures and a stack-based buffer overflow, crashing affected nodes. The flaw carries a vendor CVSS 4.0 score of 10.0, though the description scopes real-world impact to denial of service rather than the code execution the score's high confidentiality/integrity metrics would imply. There is no public exploit identified at time of analysis and it is not on CISA KEV.

Kernel memory disclosure and denial-of-service in Zephyr RTOS's mbox_send() syscall verifier stem from a time-of-check/time-of-use (TOCTOU) race in z_vrfy_mbox_send() (drivers/mbox/mbox_handlers.c), present in versions 3.0.0 through 4.4.2 on CONFIG_USERSPACE builds. An unprivileged userspace thread can race a second thread in the same address space to replace the validated msg->data pointer with a supervisor-mode address after the bounds check completes, causing the underlying driver to perform a supervisor-context read from an attacker-chosen kernel address. The upstream fix (commit ab35eacc) is confirmed available; no public exploit is identified at time of analysis.

HCL Hive 1.0 exposes its authentication endpoint without rate limiting, enabling unauthenticated remote attackers to conduct brute-force or credential stuffing attacks that can lead to unauthorized account access, or to flood the endpoint causing a denial of service. Classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), the flaw requires no privileges or user interaction and is network-accessible against default deployments. No public exploit code or active exploitation has been identified at time of analysis, but the attack class is trivially automated with widely available tooling.

Infinite loop denial-of-service in bytebot 0.0.1's Agent Execution Workflow can be triggered remotely by a low-privileged attacker, exhausting server resources and disrupting service availability. The product is end-of-life and no longer maintained by bytebot-ai, meaning no official patch will be released. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation despite the moderate CVSS 4.0 score of 5.3.

Heap exhaustion via unbounded memory leak in micrometer-core affects Java applications using Apache HttpAsyncClient (4.x or 5.x) instrumented with MicrometerHttpClientInterceptor. When asynchronous HTTP requests fail before receiving any server response - due to connection resets, network timeouts, or unreachable endpoints - the per-request tracking state allocated by the interceptor is never released, accumulating indefinitely on the JVM heap. Sustained failure conditions (such as a misbehaving or attacker-controlled upstream server) can drive heap exhaustion to OutOfMemoryError, crashing the instrumented application. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Connection pool exhaustion in the HTTP media server embedded across sixteen DJI consumer and prosumer drone models allows any attacker on the drone's adjacent Wi-Fi network to render QuickTransfer file retrieval inoperable. The server (CWE-770) accepts incoming HTTP connections without rate limiting or concurrent-connection caps, enabling a flood of media requests to saturate the pool and deny service to the legitimate DJI Fly application. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; real-world impact is bounded by the requirement for physical Wi-Fi proximity to the target drone.

Remote denial-of-service in Open5GS HSS up to version 2.8.0 allows a low-privilege Diameter Cx peer to crash the Home Subscriber Server process by sending a UAR, MAR, SAR, or LIR request containing an empty User-Name or Public-Identity AVP, triggering a reachable assertion (CWE-617) in src/hss/hss-cx-path.c. A proof-of-concept is publicly available via GitHub issue #4675, and the upstream fix exists as commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4; no formally tagged patched release version has been independently confirmed. No CISA KEV listing is present, constraining the assessed threat primarily to actors with internal Diameter network access.

Out-of-bounds memory corruption in SpaceDot AcubeSAT On-Board Computer software's CAN message parsing crashes the system when processing malformed ECSS telecommand packet headers. The vulnerable component MessageParser::parseECSSTCHeader at commit eaf90ec performs insufficient bounds checking, enabling denial-of-service against the spacecraft's onboard computer via a crafted CAN message. No active exploitation has been confirmed; an EPSS of 0.15% (4th percentile) is consistent with the highly specialized and niche deployment context of this aerospace platform.

Divide-by-zero in Aria2's BitTorrent helper module (src/bittorrent_helper.cc) crashes the download utility when processing malformed BitTorrent data, resulting in denial of service. Aria2 1.37.0 and all prior versions are affected. No public exploit code and no CISA KEV listing have been identified; EPSS places exploitation probability at the 4th percentile, indicating negligible real-world exploitation pressure at time of analysis.

Null pointer dereference in llama.cpp's ggml-RPC server (commit bec4772f6) allows remote unauthenticated denial of service against any deployment exposing the RPC port to the network. The flaw resides in rpc_server::graph_compute, where a graph node with id=0 bypasses a conditional null check, enabling a single crafted TCP packet to crash the server process. No standalone exploit code is publicly available at time of analysis, though the upstream fix PR includes a Python test script that reproducibly triggers the crash in under one second.

Permanent Wi-Fi denial-of-service in the Infineon AIROC driver shipped with Zephyr RTOS 3.6.0 through 4.4.1 allows a Wi-Fi-adjacent attacker to exhaust a fixed 20-buffer transmit/receive pool by inducing repeated synchronous WHD send failures, each of which leaks one buffer from airoc_pool without releasing it. Once the pool is fully exhausted, both transmit and WHD-driven receive paths fail, severing all Wi-Fi connectivity until the device is physically rebooted. No active exploitation is recorded in CISA KEV and no public exploit code has been identified, but the defect can also manifest organically over a device's operational lifetime through ordinary transient failures.

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110_set_avmute Some older DCE timing generators do not implement is_tg_enabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference on Southern Islands dGPUs when turning the display off over HDMI. Check that tg and the required ops exist before waiting for frames. (cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5)

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL b_addr in xfs_buf_free When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with bp->b_addr still NULL. The code falls through to the folio_put path which calls virt_to_folio(NULL), dereferencing an invalid address and causing a kernel crash. Call Trace: xfs_buf_free+0x25f/0x510 xfs_buf_alloc+0xc98/0x19b0 xfs_buf_find_insert+0x55/0x14d0 xfs_buf_get_map+0x122b/0x17c0 xfbtree_init_leaf_block+0x11c/0x4a0 xfbtree_init+0x1bb/0x460 xrep_rmap_setup_scan+0x100/0x1f0 xrep_rmapbt+0x41/0xc0 Fix this by skipping folio_put() when bp->b_addr is NULL.

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls madvise(MADV_DONTNEED), the PTEs will be successfully cleared because VM_MIXEDMAP allows this (unlike VM_PFNMAP). When userspace subsequently accesses the memory, drm_gem_shmem_fault() handles the page fault and attempts to map the backing shmem page via vmf_insert_pfn() which calls vmf_insert_pfn_prot(). Because the backing shmem page is normal system memory (pfn_valid(pfn) is true) and the VMA now has VM_MIXEDMAP set, won't this predictably trigger the explicit assertion BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn)) Fix by removing the vm_flags_mod() call and replacing the vm_insert_pages() pre-population with the handle_mm_fault() loop that was already used for the import (dma-buf) path.

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release(). The release callback unconditionally dereferences aux_priv->auxr_dev->pdev to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated on this failure path, the dereference results in a NULL pointer exception Retrieve the parent bnge_dev from the auxiliary device's parent instead of auxr_dev, and free auxr_dev only when it was successfully allocated. This allows the release callback to correctly clean up partially initialized auxiliary devices.

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL event_mod->match when foo has not been loaded. If a later write tries to remove a specific match from the same module, remove_cache_mod() passes the NULL cached match to strcmp(), causing a NULL pointer dereference. The issue can be reproduced from userspace: echo ':mod:trace_events_kunit_missing' > /sys/kernel/tracing/set_event echo '!foo_bar:mod:trace_events_kunit_missing' >> /sys/kernel/tracing/set_event The second write must be a concatenation (">>") to not include O_TRUNC as that would cause ftrace_clear_events() to clear the cached modules lines. The crash was reproduced on x86_64 QEMU while KUnit workers contended on the event tracing path: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode RIP: 0010:strcmp+0x10/0x30 Call Trace: __ftrace_set_clr_event_nolock+0x373/0x4a0 ftrace_set_clr_event+0xf0/0x180 ftrace_event_write+0xdf/0x110 vfs_write+0xf6/0x440 ksys_write+0x68/0xe0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f Check event_mod->match before comparing it, consistent with the existing NULL checks for the cached system and event fields. The mismatched removal continues to return -EINVAL; a broad cached module filter is removed with "!:mod:<module>".

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against page table freeing using init_mm Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on init_mm is held, which fixes races between ptdump and kernel page table freeing over init_mm. However, x86 and arm64 can perform a ptdump over an mm other than init_mm via ptdump_walk_pgd() and since kernel memory ranges are shared across non-kernel mm's, this means that the race still exists for these cases. Fix this by acquiring a nested mmap write lock for init_mm in ptdump_walk_pgd(). This is safe as we take this after mmap write locking the mm, and nothing acquires the init_mm lock first before locking an arbitrary mm, so no deadlock is possible. Also update walk_page_range_debug() to assert that init_mm is write locked, add a comment explaining why and remove some redundant code, and eliminate the unnecessary and confusing invocation of walk_kernel_page_table_range(). We can safely remove the non-NULL check for walk.mm, as the mmap lock asserts would NULL pointer deref if it was (and of course no callers do this). The first point at which ptdump can race kernel page table freeing is commit b6bdb7517c3d ("mm/vmalloc: add interfaces to free unmapped page table"), so we target this in the Fixes tag.

Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. No public exploit has been identified and no CISA KEV listing exists; CVSS 5.5 reflects a local, user-interaction-dependent denial-of-service with no code execution potential.

ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenticated admin or superadmin to freeze the entire Node.js application for all users by supplying a malicious regular expression in an HTTP monitor's expectedValue field. The vulnerable code in AdvancedMatcher.ts evaluates the regex synchronously on the Node.js main event loop against an attacker-supplied HTTP response body with no timeout or worker isolation, causing complete availability loss. Fixed in v3.9.2 by replacing JavaScript's native RegExp with the RE2 library, which guarantees linear-time complexity. No public exploit or CISA KEV listing identified at time of analysis.

Resource exhaustion in Apache CloudStack's scoped global configuration subsystem-spanning versions 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0-allows authenticated low-privilege users to gradually trigger a denial-of-service condition against the management server. The vulnerability (CWE-772) affects multiple plugins including Quota and Host-HA, which allocate resources during configuration operations but fail to release them after their effective lifetime. No public exploit or active exploitation has been identified; vendor-released fixes are available in 4.20.3.1 and 4.22.1.1.

Denial of service in Micrometer Tracing's Brave bridge allows remote unauthenticated attackers to crash Spring Boot 3.x+ applications by sending HTTP requests with artificially inflated W3C baggage headers. The parser allocates one BaggageField object per baggage key-value pair without enforcing any limit, violating the W3C Baggage specification's own security guidance, leading to garbage collection saturation, CPU spike, and eventual OutOfMemoryError. No public exploit code has been identified at time of analysis, but the attack is trivially constructible given the documented mechanism.

Ghidra's PDB parser (all versions before 12.1.3) crashes when processing a crafted PDB file containing an oversized parameters section, enabling denial-of-service against security analysts. The AbstractPdb deserialization routine accumulates all parameters from the PDB stream into an unbounded heap list without size validation; the resulting OutOfMemoryError is a JVM Error subclass that bypasses standard exception handling, causing uncontrolled process termination. No public exploit code exists and no CISA KEV listing is present; exploitation requires a victim analyst to open a malicious file, limiting real-world impact to targeted disruption of reverse-engineering workflows.

Uncontrolled resource consumption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local high-privileged attacker to cause a denial of service by supplying crafted directory records to the vulnerable parsing component. The CVSS vector (AV:L/PR:H) confirms that exploitation is constrained to authenticated local actors with elevated privileges, limiting the realistic threat pool considerably. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.

Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local, low-privileged attacker to crash the affected system, resulting in a denial of service. The CVSS scope-change metric (S:C) is particularly significant in the PowerVM context: a crash of the VIOS host can simultaneously disrupt I/O services for all co-hosted guest logical partitions (LPARs) sharing that VIOS, amplifying the blast radius well beyond the directly exploited node. No public exploit code and no confirmed active exploitation have been identified at time of analysis.

NULL pointer dereference in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to crash the system, causing a denial of service. Exploitation requires high attack complexity, suggesting a race condition or specific system state must be induced. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; a vendor patch is available via IBM support.

Symlink following vulnerability in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to cause a denial of service - and potentially file corruption - through improper symbolic link validation (CWE-59). The CVSS vector (AV:L/AC:H/PR:L/I:H/A:H) indicates exploitation requires local access, a race-condition timing window, and results in both high integrity and availability impact despite the DoS classification. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; IBM has released a patch.

Uncontrolled resource consumption in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, enables a local low-privileged attacker to exhaust system resources and trigger a denial of service condition. The vulnerability is classified under CWE-400 and carries a CVSS 3.1 base score of 5.5 with a local attack vector requiring low privileges. IBM has released a patch via advisory 7283858; no active exploitation or public proof-of-concept code has been identified at time of analysis.

Integer overflow to heap over-read in libvips prior to 8.18.3 crashes the image processing process when a crafted multi-page TIFF is loaded through the ImageMagick fallback path. The unchecked multiplication `out->Ysize *= magick->n_frames` in `vips_foreign_load_magick_parse()` wraps on attacker-controlled input, producing an underflowed buffer dimension that drives a subsequent heap over-read and process crash. This flaw is limited to the uncommon build configuration where libtiff support is absent and ImageMagick support is present; no public exploit identified at time of analysis.

Uncontrolled resource consumption in Mailpit's thumbnail generation endpoint allows unauthenticated network clients to exhaust server memory and CPU by submitting email attachments containing image decompression bombs. The affected code path in server/apiv1/thumbnails.go calls imaging.Decode() with AutoOrientation before performing any dimension, pixel-count, or memory validation, meaning a compact on-disk image declaring enormous pixel dimensions triggers full raster allocation prior to the 180×120 scaling step. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the vendor-confirmed fix is Mailpit 1.30.4.

Uncontrolled memory allocation in Mailpit's SMTP command reader allows unauthenticated remote clients to exhaust server memory by sending oversized pre-DATA command lines. Versions prior to 1.30.4 use Go's unbounded `bufio.Reader.ReadString` in `internal/smtpd/smtpd.go`, which allocates the full attacker-controlled input before any syntax rejection or RFC 5321 line-length enforcement occurs. The same vulnerable code path handles AUTH continuation lines (LOGIN, PLAIN, CRAM-MD5), so concurrent oversized inputs compound memory pressure and can reduce service availability. No public exploit identified at time of analysis; a vendor-released patch is available in v1.30.4.

Memory exhaustion in Mailpit's SMTP server (versions 1.30.0 through 1.30.4) allows unauthenticated remote SMTP clients to force heap allocation beyond the configured MaxMessageSize limit by transmitting a single DATA line exceeding the cap - because `bufio.Reader.ReadBytes('\n')` buffers the entire line into memory before the size check is applied. This is a post-fix incomplete remediation of an earlier SMTP body-size advisory: multi-line DATA accumulation was bounded, but single-line pre-read was not, leaving a residual gap in versions 1.30.0-1.30.4. A proof-of-concept demonstrating a 64 MiB single-line RSS spike is included in the GitHub security advisory; no active exploitation has been confirmed (not listed in CISA KEV).

Infinite loop denial-of-service in Tor before 0.4.9.9 allows a remote, unauthenticated attacker to cause sustained CPU exhaustion on a vulnerable node by delivering a crafted truncated zlib/gzip compressed stream. The root cause is in buf_add_compress(), which misinterpreted zlib's Z_BUF_ERROR return (no remaining input) as a full output buffer requiring retry, looping forever without progress. No public exploit has been identified at time of analysis, and the CVSS score of 3.7 with high attack complexity (AC:H) limits practical exploitation to adversaries capable of precisely crafting malformed compressed payloads reachable by a Tor node.

NIOWebSocket in swift-nio (all versions before 2.101.0) crashes the hosting process when any unauthenticated remote peer sends a single crafted 11-byte WebSocket frame following a completed handshake, terminating all active connections until the service restarts. Frameworks built on swift-nio - including Vapor and Hummingbird - inherit this exposure whenever they accept WebSocket connections. No public exploit code has been identified, but SSVC classifies the attack as automatable, lowering the bar for repeated or scripted denial-of-service.

Binary HTTP parser in Netty's `netty-incubator-codec-bhttp` (all versions through 0.0.22.Final) crashes with an unchecked `ArrayIndexOutOfBoundsException` when processing a 15-byte crafted payload, enabling remote unauthenticated denial of service. The parser accumulates attacker-controlled varint field lengths - read correctly as `long` - into `int` offset counters; a value of 2^31 silently wraps the accumulator negative via Java's compound-assignment narrowing, bypassing the readable-bytes guard and reaching unchecked buffer index arithmetic. Publicly available exploit code exists per the GitHub advisory GHSA-pgrf-4654-3gq8; no active exploitation is confirmed in CISA KEV.