Denial of Service

Persistent denial-of-service in XenForo's BBCode parser allows any authenticated forum member to crash PHP-FPM workers for all visitors by submitting a single post with sufficiently deep BBCode nesting. The recursive parser exhausts PHP's call stack, generating fatal errors that terminate worker processes - and because the malicious post persists in the database, every subsequent render of the affected thread repeats the crash, sustaining the outage until the post is removed or the forum is patched. Fixed in XenForo 2.3.13; no public exploit code has been identified at time of analysis.

HTTP/2 thread-exhaustion denial-of-service in Eclipse Jetty allows unauthenticated remote clients to permanently block all server threads by exploiting a race condition in RST_STREAM and GOAWAY frame handling. The race incorrectly resets the `HTTP2Flusher.terminated` field from a non-null terminal state back to null, allowing new write-queue entries to be enqueued in a flusher that will never drain them; the write-blocked threads waiting on those entries hang indefinitely. Across five affected Jetty major branches (9.4, 10.0, 11.0, 12.0, 12.1), any internet-exposed HTTP/2 endpoint is reachable without authentication. No public exploit has been identified at time of analysis.

Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.

Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.

Stack exhaustion via uncontrolled recursion in Qt's QDomDocument XML serialization allows a remote attacker to crash any Qt application that processes untrusted XML input, resulting in a denial-of-service condition. Affected applications using the QtXml module parse attacker-supplied deeply nested XML documents, triggering recursive descent without a depth guard until the call stack is exhausted. No code execution is possible; impact is limited to application availability. No public exploit or CISA KEV listing has been identified at time of analysis.

Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.

The wpeddpcf_delete_feed AJAX handler in EDD Product Catalog Feed by PixelYourSite (WordPress plugin, all versions ≤1.0.2) omits a capability check, allowing any authenticated subscriber-level user to invoke the function and delete arbitrary entries from the WordPress options table. An attacker who deletes a critical option-such as active_plugins, siteurl, or the active theme-can render the entire WordPress installation non-functional, denying service to all legitimate users. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported and disclosed the vulnerability.

Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. In OT/ICS environments where Reyrolle 7SR5 relays perform electrical protection functions, a forced restart creates an operational availability gap that may have safety-critical consequences during fault events. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.

Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.

XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw.

Heap-based buffer overflow in the A2DP SBC audio decoder of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet, triggering a denial-of-service condition. The vulnerable component, a2dp_decoder_sbc.cpp, fails to validate input length before copying data onto the heap, resulting in memory corruption. No public exploit code has been confirmed beyond a source-code reference, and no active exploitation has been reported (CISA KEV absent), though the attack is rated automatable by CISA SSVC.

Denial of service in Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an unauthenticated attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet targeting the btm_acl_handle() function. The vulnerability stems from uncontrolled resource consumption (CWE-400) in the Bluetooth stack's ACL connection handler, causing the firmware to exhaust resources or reach an unhandled state upon receipt of malformed input. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.17%, indicating low current threat activity.

Unauthenticated adjacent-network exploitation of `l2cap_handle_data()` in Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a crafted L2CAP packet, causing a Denial of Service. The assigned CVSS vector reports C:H/I:H/A:H - substantially exceeding the described DoS-only impact - suggesting the underlying memory corruption may carry code execution potential not explicitly confirmed in the advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated resource exhaustion in ash_authentication_oauth2_server 0.3.0 enables any remote attacker to grow database storage and heap memory without bound when the Client ID Metadata Document (CIMD) feature is enabled. The /authorize endpoint's resolve_client/3 function fetches and permanently upserts one database row per distinct URL-shaped client_id, with no row cap, no TTL-based expiry, and no field-length limit; additionally, fetched documents enter CIMD.Cache before validation, meaning even rejected documents consume cache memory until their TTL expires. No public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13) allows a network attacker to crash the LDAP server by sending a crafted sequence of search requests that combine the paged results control with the USE_ONE_BACKEND control, triggering a NULL pointer dereference in `op_shared_search`. The crash terminates the directory service process, disrupting all LDAP-dependent services such as authentication, authorization, and group resolution until manually restarted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector makes automated, repeated disruption straightforward.

Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.

Uncontrolled resource consumption in MISP ≤2.5.45 allows unauthenticated remote attackers to exhaust persistent storage by flooding the password-reset and related pre-authentication endpoints, each of which performs durable database writes before validating or throttling the caller. The `/users/forgot` endpoint accepted arbitrarily long, unvalidated email values and generated two write operations per request - an audit log entry and a queued background job - with no rate limit, enabling storage and job-queue exhaustion at modest request rates. The upstream fix (commit d75d899be, reported by CIRCL) adds a 1024-byte email length cap, format validation, a Redis-backed per-source flood filter with HTTP 429 responses, and a 15-minute API-access request cooldown; no public exploit or CISA KEV listing has been identified at time of analysis.

Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. All library releases from 1.5.0 (May 2020) through 2.8.x are affected; no public exploit identified at time of analysis, but the amplification ratio is deterministic and trivially reproducible.

Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by submitting Markdown documents that force many headings onto the same base slug. UniqueSlugNormalizer::normalize() restarts its numeric-suffix search from 1 on every slug collision, producing O(K²) comparisons for K colliding slugs - enabling a small, crafted document to consume seconds of CPU time. No public exploit code has been confirmed, but the attack is trivially constructible from the GHSA advisory description alone, and no authentication is required against any endpoint that renders attacker-controlled Markdown.

Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote denial of service. AttributesListener::findTargetAndDirection() walks the entire sibling list for each attribute node when no left-side target exists, producing O(N²) parse time; a ~32 KB payload of repeated {#a} blocks (8,000 iterations) takes over 5 seconds to process. Any deployment that has enabled AttributesExtension and accepts untrusted Markdown input is vulnerable across all 1.x releases from 1.5.0 and all 2.x releases prior to 2.9.0. No public exploit or KEV listing identified at time of analysis, but the attack is trivially reproducible from the published advisory.

Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to exhaust server CPU by submitting crafted Markdown input. The fenced code block path exhibits quadratic complexity due to catastrophic regex backtracking in FencedCodeStartParser, a 320 KB single-line payload taking ~27 seconds to process without triggering PCRE's backtrack limit. The reference link label lookup path performs multiple full-string normalization passes per nested bracket pair, and the emphasis/delimiter path similarly degrades under long delimiter sequences - all three are reachable with a stock CommonMarkConverter and default configuration. No public exploit has been identified at time of analysis, but the GHSA advisory documents precise triggering payloads.

Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. Exploitation is conditional on the application explicitly registering either extension; all standard bundled converters are unaffected. Fixed in version 2.9.1, which also closes an incomplete AttributesExtension fix shipped in 2.9.0 for the related inline-variant issue GHSA-g2gp-3wwq-f4ph.

Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unauthenticated remote attackers to perform denial of service against PHP applications that explicitly register this extension. By submitting Markdown containing many distinctly-named attributes targeting a common block, an attacker triggers O(n²) attribute merging and filtering loops; a 256 KB payload consumes over 20 seconds of PHP CPU time per conversion request. No public exploit code has been identified at time of analysis, but the attack primitive is described in sufficient detail in the GitHub Security Advisory that construction is trivial, and developers who applied the partial 2.9.1 patch for the prior advisory GHSA-jjv6-8j6v-6j52 may incorrectly believe they are already protected.

Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible client to exhaust the JVM heap by sending a single WebSocket frame with an unknown opcode and an arbitrarily large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass the normal maximum frame size check, causing Jetty to attempt heap allocation for the declared payload size before the opcode is ever validated - a logic-ordering flaw classified under CWE-770. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects high impact and low attack barrier; no public exploit has been identified at time of analysis.

Denial of service via NULL-pointer dereference in strongSwan's x509 plugin affects versions 4.2.0 through 6.0.x, triggered during verification of X.509 attribute certificates. An unauthenticated remote attacker can crash the charon IKE daemon by presenting a crafted attribute certificate during VPN handshake negotiation, taking the gateway offline. Vendor-released fix is strongSwan 6.1.0, published September 7, 2026, as part of a coordinated batch of six CVE patches; no public exploit has been identified at time of analysis.

Denial of service via infinite loop in strongSwan's x509 plugin affects all deployments that process X.509 attribute certificates. An unauthenticated remote attacker can craft a malformed attribute certificate that triggers CWE-835 (infinite loop) during parsing, causing the IKE daemon to hang indefinitely and disrupting all VPN connectivity. The vendor fixed this in strongSwan 6.1.0 alongside six other vulnerabilities disclosed on 2026-09-07; no public exploit has been identified at time of analysis.

Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.

Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote attackers to hang the Node.js server process with a single HTTP request. The `setChunkedCookie()` and `deleteChunkedCookie()` functions trust an attacker-controlled chunk count parsed from the sentinel cookie value (`__chunked__N`) without any upper bound, causing an O(n²) cleanup loop where each of up to N iterations scans all existing set-cookie response headers. No public standalone exploit repository has been identified, but the GHSA advisory publishes a complete exploit chain including exact cookie payloads, significantly lowering the exploitation bar.

SSRF, XXE and denial of service exposure arise in libxml2 before 2.15.4 because xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate the document's parseFlags down to the parser contexts they create for XInclude resolution. When parseFlags are dropped, protective options such as XML_PARSE_NONET stop being enforced, so an attacker-supplied document containing an external xi:include href can force outbound network fetches through the application's resource loader — enabling server-side request forgery, external entity injection, or a hang driven by an intentionally slow remote resource. Exploitation requires an application that enables XInclude and relies on XML_PARSE_NONET (typically with a custom resource loader); no public exploit code has been identified and EPSS is very low at 0.16% (6th percentile), with no CISA KEV listing.

Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. In airborne or safety-critical deployments, a process crash during flight could have consequences beyond mere software unavailability. No public exploit code identified at time of analysis; the fix is confirmed in upstream PR #28475.

Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.

Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.

Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.

Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.

Process-terminating denial of service in undici's WebSocket implementation allows remote unauthenticated attackers to crash any Node.js application that connects to an attacker-controlled or machine-in-the-middle-intercepted WebSocket endpoint. During the opening handshake, if a server returns a Sec-WebSocket-Protocol header that the client never offered, undici dereferences a null value and throws an uncaught TypeError inside a Promise microtask, bypassing all application-level error handlers and killing the entire Node.js process. Affected are undici 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1; no public exploit identified at time of analysis.

Remote denial of service and data integrity compromise in IBM i (formerly OS/400) releases 7.3, 7.4, 7.5, and 7.6 stems from a critical function that ships without an authentication check (CWE-306), letting a network attacker invoke it without credentials. IBM has released a fix, and no public exploit has been identified at time of analysis; EPSS is low at 0.36% (29th percentile), indicating no observed exploitation pressure yet.

Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.

Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.

Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.

Abrupt TCP disconnections against undici's experimental WebSocketStream client crash the entire Node.js process: undici's internal socket-close handler unconditionally calls abort() on a writable stream that the application has locked with a writer, and discards the returned promise, so the resulting TypeError rejection is never observed and Node's default unhandled-rejection behavior terminates the process. Affected deployments are those running undici 7.0.0 through 7.29.0 or 8.0.0 through 8.10.1 and using the experimental WebSocketStream API to connect to a server an attacker controls or can MITM; the trigger is a single abrupt disconnect with no WebSocket close handshake, requiring no authentication and no user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit code identified at time of analysis, EPSS is 0.35% (28th percentile), and no CISA KEV listing exists; the impact is bounded to availability loss in the subset of services that actually use WebSocketStream against untrusted endpoints.

Infinite-loop denial-of-service in smol-toml (npm, squirrelchat) before version 1.7.1 allows remote unauthenticated attackers to permanently hang any Node.js service that parses attacker-controlled TOML. The trigger is a crafted value inside a TOML array or inline table followed by a comment character with no trailing newline - when this input reaches the parser, skipUntil() in src/util.ts receives -1 from indexOfNewline() and resets the cursor to position zero instead of terminating, spinning indefinitely and consuming all processing capacity. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.2 and the trivially constructible trigger make this straightforward to weaponize against any exposed TOML-parsing endpoint.

Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network attackers to crash or hang the integration runtime by triggering an infinite loop (CWE-835). Affected are ACE versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. Impact is confined to availability - no data exposure or integrity loss - but a hung integration broker can disrupt critical business processes in environments relying on IBM middleware for message routing and API mediation. No public exploit or CISA KEV listing exists at time of analysis.

Out-of-bounds write in Hugging Face tokenizers v0.23.1 allows any actor who can supply a crafted tokenizer.json file to abort the loading process immediately, causing denial of service in Rust applications and FFI embeddings before any inference occurs. The defect in BpeBuilder::build (tokenizers/src/models/bpe/model.rs) allocates a scratch buffer sized to the longest vocabulary key, then writes concatenated BPE merge pairs into it without bounding the write to the buffer size; a merge whose result exceeds that length triggers a Rust panic and process abort (CWE-787). A secondary usize underflow at the same code site, activated when continuing_subword_prefix is set and a merge token is shorter than the prefix, produces a panic in debug builds and potential memory corruption in release builds, elevating the secondary impact beyond availability alone. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix appears in the v0.23.2 source.

Memory exhaustion in Chroma 1.5.9 allows unauthenticated remote attackers to crash the vector database server by supplying arbitrarily large HNSW index parameter values (max_neighbors, ef_construction, ef_search) in collection-create requests. Because no upper-bound validation exists in the Rust-based HNSW configuration layer, the server allocates memory proportional to attacker-supplied values during index compaction, causing denial of service. No public exploit code or active exploitation has been identified at time of analysis, but the zero-complexity unauthenticated network path makes this a straightforward availability risk for any internet-facing Chroma deployment.

Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a remote HTTP server to exhaust client-side memory and crash the entire BEAM VM node. Two HTTP/1 parser states - the status-line decoder and the chunk-extension-line decoder - append successive socket data into `conn.buffer` with no size cap because the existing `:max_header_list_size` guard was wired only to header and trailer parsing, not to these two states. A malicious or attacker-redirected server that withholds CRLF terminators can grow the buffer indefinitely until the OS OOM-killer terminates the node, collaterally killing all other processes sharing it. No public exploit has been identified, but the technique requires only a straightforward streaming server.

Unbounded memory consumption in SiYuan's request-concurrency middleware allows unauthenticated remote attackers to permanently exhaust process memory by flooding the application with unique request paths. The root cause is a mutex-entry map that grows without bound - each distinct URL path creates a new mutex entry that is never evicted, causing memory and synchronization overhead to accumulate indefinitely. All SiYuan deployments prior to v3.8.2 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.

Memory exhaustion denial-of-service in SiYuan's publish-service Basic Auth throttle allows unauthenticated remote attackers to crash or degrade the service by submitting authentication requests with an unbounded number of unique invalid usernames. Because the throttle tracks per-username failure state in memory with no capacity limit or eviction policy, the in-memory tracking structure grows without bound until the process exhausts available heap. All SiYuan versions prior to v3.8.2 are affected; no active exploitation has been identified at time of analysis.

Memory exhaustion in SiYuan's publish-service Basic Auth handler allows authenticated users to repeatedly submit valid credentials, generating persistent session entries that accumulate without expiry or capacity limits, eventually crashing the process. All SiYuan versions before v3.8.2 are affected, as confirmed by vendor security advisory GHSA-f4vj-ppp2-5hg4. No active exploitation has been recorded in CISA KEV and no public proof-of-concept code is known, but the low barrier - only valid credentials required - means any account holder can trigger denial of service on demand.

Unauthenticated remote memory exhaustion in SiYuan before v3.8.2 allows any network-reachable attacker to degrade or crash the service by flooding the /api/system/uiproc endpoint with unique process identifiers. The endpoint retains each submitted identifier in memory without size bounds, rate limiting, or authentication checks, making the attack trivially automatable. No public exploit code or KEV status is confirmed at time of analysis, but the simplicity of exploitation via repeated HTTP requests requires no special tooling.

Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.

Denial of service in the Free5GC go-upf user plane function (UPF) allows a remote, unauthenticated attacker to crash the UPF process by sending crafted PFCP signaling messages that trigger a null pointer dereference during session lookup and session-report handling. The flaw affects Free5GC v4.2.2 and manifests as a Go runtime panic in internal/pfcp, taking down user-plane packet forwarding for all subscribers served by that UPF. No public exploit is confirmed in the wild and CISA KEV does not list it, but an upstream fix (go-upf PR #97) exists and researcher-published analysis (5GCVulDB gist repository) is publicly linked; EPSS is low at 0.25%, consistent with the narrow exposure of PFCP/N4 interfaces rather than low technical severity.

Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The `ogs_sbi_time_from_string()` function in `lib/sbi/conv.c` copies characters into a fixed-size buffer using loop counters `j` and `k` without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. Public proof-of-concept exploit code is available via the hackeryounow/5GCVulDB repository; no active exploitation is confirmed in CISA KEV.

Resource exhaustion in the MOOSDB HTTP server component of MOOS core-moos through 10.4.0 allows unauthenticated remote attackers to render MOOSDB unavailable by opening many simultaneous connections and sending unbounded HTTP header data. Source code analysis confirms the pre-patch implementation in CMOOSDBHTTPServer and CHTTPConnection imposed no limits on concurrent connections, header line count, per-line byte size, or per-connection read timeouts - all four controls were absent. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires no authentication or special tooling and is trivially automatable.

Unbounded memory consumption in MOOS-IvP pMarineViewer through version 24.8.1 allows unauthenticated network attackers to exhaust the operator display process by flooding it with NODE_REPORT messages carrying arbitrary distinct node names. The ContactLedger class allocates a new tracking entry for every unique vessel name it encounters without enforcing any cap, making the ledger - and everything that iterates it - grow without limit. The result is a stalled or crashed operator situational-awareness display, which is operationally significant in autonomous maritime missions. No public exploit has been identified at time of analysis; an upstream fix capping contacts at 200 has been merged but a tagged release version has not been independently confirmed.

Unbounded resource allocation in MOOS-IvP uFldShoreBroker through 24.8.1 allows a remote unauthenticated attacker to exhaust the shore broker process's memory and degrade per-iteration CPU performance by sending NODE_BROKER_PING messages with an unlimited number of distinct community names. Each unique community name causes entries to be appended across six parallel in-memory vectors with no eviction policy and no enrollment ceiling, creating unbounded O(n) per-pass overhead. Sustained delivery crashes or disables the shore broker, severing coordination between shore-side operators and autonomous marine vehicles. No public exploit has been identified at time of analysis.

Unauthenticated remote resource exhaustion in MOOS-IvP pRealm through version 24.8.1 allows any network-reachable attacker to register unlimited long-lived REALMCAST_REQ subscriptions with arbitrarily large variable lists, causing the pRealm process to serialize and publish excessive output on every scheduling interval until system resources are exhausted. The vulnerability stems from three absent input limits: no cap on subscription duration, no cap on variable count per subscription, and no ceiling on concurrent pipeway registrations. The fix, confirmed by PR #132 and commit 8a4bb9d9, introduces hard limits of 3600 seconds duration, 64 variables per request, and 64 total concurrent pipeways. No public exploit or KEV listing has been identified at time of analysis.

Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system memory by sending crafted mux packets with arbitrarily large declared packet counts to the Demuxer::addMuxPacket() function. The demultiplexer trusts the integer value in the mux header without a ceiling, causing the process to reserve memory for each declared packet slot. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed by CISA KEV.

Denial-of-service in MOOS core-moos through 10.4.0 allows any unauthenticated network peer to permanently freeze the MOOSDB accept thread by opening a TCP connection to the MOOSDB port and sending no data during the wire-protocol handshake. Because the accept thread executes a blocking receive without any timeout while holding the socket-list lock, a single stalled connection prevents all subsequent MOOS clients from registering, effectively rendering the publish-subscribe middleware inoperable. No public exploit code or active exploitation has been identified; however, the attack requires only a single TCP connection and no credentials, making it trivially automatable against any exposed MOOSDB instance.

Uncontrolled memory allocation in MOOS core-moos through 10.4.0 exposes MOOSDB servers to pre-authentication denial of service. The CMOOSCommPkt::OnBytesWritten() function reads the packet length field directly from untrusted wire data and passes it without any upper-bound check to new unsigned char[], allowing unbounded heap allocation before any client authentication handshake occurs. An unauthenticated network attacker can craft packets with arbitrarily large declared lengths to exhaust server memory and crash the MOOSDB process; no public exploit has been identified at time of analysis, and an upstream patch is available via GitHub commit e7ea624.

Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge process by sending a single crafted UDP datagram containing a negative declared packet length. The root cause is a signed-to-unsigned type confusion in CMOOSUDPLink::ReadPktFromArray(): a negative nRqd value passes a signed bounds check unchanged, then is silently cast to a near-SIZE_MAX size_t when passed to memcpy, writing far beyond the destination heap buffer. No public exploit has been identified at time of analysis, but the attack primitive requires only network access to the UDP listen port and a small crafted payload; the upstream fix is available as a GitHub patch commit.

Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.

Use-after-free in Skia, Chrome's 2D graphics rendering engine, allows remote attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.82 across desktop platforms. The sandbox confinement means this vulnerability alone does not yield full system compromise - a chained sandbox escape would be required for that - but the renderer-process code execution is rated high impact by Chromium's internal severity team. No public exploit or CISA KEV listing is present at time of analysis; SSVC labels exploitation as none and the attack as non-automatable due to the required user interaction.

Remote code execution in Google Chrome's DevTools component before 152.0.7977.82 lets a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and carries a CVSS 9.6 with scope change, reflecting sandbox escape. Google has shipped a fix; per CISA's SSVC assessment there is no evidence of active exploitation and no public exploit identified at time of analysis.

Use-after-free in Chrome's Compositing component (versions prior to 152.0.7977.82) enables a sandbox escape when chained with a renderer-process compromise - an attacker who has already gained control of the renderer can corrupt memory in the Compositing layer and execute arbitrary code outside Chrome's sandbox boundary on the host operating system. The CVSS S:C (scope changed) metric confirms this is a privilege-escalation-across-boundary primitive, delivering full C:H/I:H/A:H impact against the underlying OS. A vendor patch is available in Chrome 152.0.7977.82, and no public exploit has been identified at time of analysis.

Uncontrolled resource consumption in the Migrate Guru - Site Migration & Cloning WordPress plugin (versions 6.65 and earlier) exposes any WordPress installation running the plugin to remote denial of service by unauthenticated network attackers. The root cause (CWE-770) indicates that one or more plugin endpoints perform resource-intensive operations without adequate rate limiting or throttling, allowing an attacker to exhaust server capacity without supplying credentials. No public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated denial of service in MalCare Security WordPress plugin versions 6.69 and earlier allows any remote attacker with no credentials to exhaust server resources and take down affected WordPress sites. The vulnerability, rooted in CWE-770 (resource allocation without throttling), exposes a network-accessible plugin endpoint that can be abused to render the site unavailable. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward target for automated abuse.

Persistent denial of service in MISP's event template subsystem allows an authenticated user with event-template write permissions to store malformed JSON as a template definition by bypassing semantic validation. When any authenticated user subsequently loads the event template index - an endpoint accessible to all authenticated users - an unhandled exception in afterFind() causes HTTP 500 errors instance-wide until an administrator manually repairs the offending database row. The patch enforces strict array-only validation on save and adds exception handling on retrieval with graceful degradation to an empty definition.

Process-terminating denial of service in libmongocrypt's decryption path allows a low-privileged attacker to crash applications using MongoDB Client-Side Field Level Encryption (CSFLE). Tracked as MONGOCRYPT-971, the vulnerability is triggered when an unexpected-size encrypted value reaches the decryption routine, firing a reachable assertion (CWE-617) that abruptly terminates the host process rather than returning a handled error. An attacker who can store crafted encrypted values in a shared MongoDB collection, or influence the encrypted data an application receives, can repeatably crash the targeted application.

Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.

Insecure Direct Object Reference (IDOR) in the vhr open-source HR management system allows any authenticated user to overwrite arbitrary HR profiles - including administrator accounts - via the PUT /hr/info endpoint by supplying a victim's profile ID in the request body. The flaw stems from a complete absence of object-level authorization in HrInfoController.java: the server updates whichever record ID is provided without verifying the requester owns or has permission to modify it. Beyond profile data manipulation, an attacker can disable administrator accounts, effectively causing a denial-of-service against system administration functions. No vendor-released patch has been identified at time of analysis.

NULL pointer dereference in GStreamer's RTSP support library (gst-plugins-base) crashes any process that parses a Digest authentication header containing specially crafted whitespace, resulting in a denial-of-service condition. The flaw is bidirectional: an unauthenticated remote attacker can crash an RTSP server by sending a single malformed request when Digest authentication is enabled, and a malicious or compromised RTSP server can crash an RTSP client using the same technique. No confidentiality or integrity impact is confirmed; the sole consequence is process termination. No public exploit code or CISA KEV listing has been identified at time of analysis.

NULL pointer dereference in the Linux kernel's psxpad-spi driver crashes the kernel when system suspend is triggered on hardware using SPI-connected PlayStation controllers. The probe() function in drivers/input/joystick/psxpad-spi.c omits the spi_set_drvdata() call that stores per-device state, so psxpad_spi_suspend() unconditionally dereferences a NULL pointer on suspend entry, causing a kernel panic. Patches are available across all active stable kernel branches (5.10 through 7.2); EPSS is 0.21% and no active exploitation has been identified.

Out-of-bounds memory read in the Linux kernel's DRM HDMI connector subsystem allows a local, low-privileged user to potentially leak up to 32 bytes of adjacent kernel heap memory or trigger a page fault leading to kernel crash. The flaw exists in a helper function that copies audio infoframe data using the destination buffer size (60 bytes) rather than the source structure size (28 bytes), reading 32 bytes beyond the source allocation. No public exploit code exists, and EPSS sits at the 10th percentile; however, the availability impact is real - the overread can cross a page boundary and cause an access violation.

Btrfs in the Linux kernel fails to reinitialize inode address-space mapping flags and minimum folio order when re-reading previously evicted cached inodes, causing a kernel assertion failure and system crash (denial of service). The defect surfaces only when btrfs is mounted with a block size larger than the host memory page size - a non-default but valid configuration - and manifests after a create/evict/re-read inode cycle. No public exploit code exists and EPSS is 0.20% (10th percentile), reflecting negligible real-world exploitation probability beyond accidental triggering.

Uncontrolled recursion in Amazon Ion-C before v1.1.6 allows a remote unauthenticated attacker to crash any application that parses untrusted Ion data using this library, causing a denial of service via native call stack exhaustion. The fix, released in v1.1.6 and titled 'Harden container depth,' confirms the root cause is missing or insufficient depth limiting on nested Ion container parsing. No authentication is required and no special configuration is needed beyond the application accepting Ion input from untrusted sources. No public exploit code has been identified at time of analysis.

Denial-of-service in the Go extended cryptography library's SSH package allows a malicious peer to deadlock an entire SSH connection by sending crafted RFC 4254 channel messages after a channel is established. All versions of golang.org/x/crypto/ssh below 0.56.0 are affected; the flaw manifests because unrecognized channel messages were buffered and allowed to block rather than being rejected as protocol errors. No public exploit or active exploitation has been identified, but the attack requires no privileges in the worst-case client scenario where a malicious SSH server targets a connecting client.

Connection deadlock in golang.org/x/crypto/ssh (all versions before 0.56.0) allows a malicious remote SSH peer to permanently freeze an SSH connection by flooding the incomingRequests queue of a channel that has been registered in the mux's chanList but not yet established. The attack exploits the absence of any established-state guard in the packet handler, causing a deadlock that renders the entire connection unresponsive without triggering an explicit teardown. No public exploit has been identified and no CISA KEV listing exists, but the network-accessible, no-authentication CVSS vector makes this straightforward to trigger against any Go application using this library for SSH.

BEAM atom table exhaustion in Boruta Server prior to 0.10.0 allows any authenticated end user to crash the entire OAuth 2.0/OpenID Connect umbrella application by repeatedly submitting PUT /users/settings requests with arbitrary novel body keys. The UserSettingsController calls String.to_atom/1 on all user-supplied map keys before any validation, permanently interning them in the Erlang VM's global atom table (hard cap: 1,048,576 entries). Once exhausted, the BEAM runtime aborts with 'no more index entries in atom_tab', taking down the auth, admin, and gateway components simultaneously. No public exploit identified at time of analysis, and the issue has been patched in version 0.10.0.

Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. Depending on the downstream dependency tree, exploitable outcomes range from reliable denial of service to remote code execution via prototype-pollution gadget chains; no public exploit or active exploitation is confirmed at time of analysis.

Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. Exploitation is gated on a non-default configuration - Web Access must be explicitly enabled on devices registered to Cisco Unified Communications Manager - materially limiting real-world attack surface despite the network-accessible vector. No public exploit code and no CISA KEV listing were identified at time of analysis.

Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an unauthenticated attacker run code as root by connecting to TCP ports 43210 and 43211, which are exposed by default in the Layer 3 default VRF. Crafted input to the S1HAL process is executed with root privileges, and the same flaw can crash S1HAL to force a device reload (denial of service). Rated CVSS 9.8; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-authentication, network-facing nature makes it a top-priority patch.

NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching.

Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.

Unauthenticated remote denial of service in Libreswan's pluto IKE daemon allows any network attacker to repeatedly crash and restart the VPN service by sending a malformed X.509 certificate in a CERT payload during IKE handshake negotiation. The crash is triggered by a reachable assertion in `add_decoded_cert()`: when NSS's `CERT_ExtractPublicKey()` receives a certificate with an invalid RSA exponent (e.g., zero), it returns NULL, which the FIPS-mode code path does not handle, causing the daemon to abort. The vendor explicitly confirms no remote code execution is possible; impact is limited to availability. No CISA KEV listing and no public exploit code have been identified at time of analysis.

Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the Shared Tab Groups feature (CWE-416). A remote attacker who lures a victim into visiting a crafted HTML page can corrupt freed memory to execute arbitrary code outside the renderer sandbox. Chromium rates the severity Critical (CVSS 9.6); the vendor has shipped a fix, but no public exploit has been identified at time of analysis.

Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the WebGL implementation, letting a remote attacker who lures a victim to a crafted HTML page execute arbitrary code OUTSIDE the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector; a vendor patch shipped in the September 2026 Stable channel update. No public exploit identified at time of analysis, though the tracker bug (issues.chromium.org/546260492) and Google's own reporting indicate the flaw is well characterized.

Use-after-free in Chrome's TabStrip component enables remote code execution outside the renderer sandbox in Google Chrome versions prior to 152.0.7977.75. An attacker must social-engineer a user into a specific UI interaction to trigger the memory-corruption primitive, after which arbitrary code executes at browser-process privilege - a full sandbox escape. Google has issued a stable channel patch; no public exploit or CISA KEV listing has been identified at time of analysis.