Denial of Service

Use-after-free in Google Chrome's Browser process prior to version 152.0.7977.75 enables sandbox escape, allowing an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. The CVSS vector (AV:N/AC:H/S:C/C:H/I:H/A:H) reflects both the network-reachable delivery and the scope change from renderer to host-level execution. No public exploit or CISA KEV listing has been identified at time of analysis, but sandbox-escape primitives of this class are highly valued in exploit chains.

Remote code execution inside Chrome's sandbox is achievable via a use-after-free in WebRTC, triggered when a victim visits a specially crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75 across desktop platforms. No public exploit code or CISA KEV listing has been identified at time of analysis, though the sandboxed execution boundary limits the practical impact compared to the raw CVSS 8.8 score - Google's own Chromium severity rating of 'Medium' reflects this containment.

Remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in Dawn, Chrome's WebGPU/GPU graphics abstraction layer, and - per Google's advisory - allows a crafted HTML page to execute arbitrary code outside the renderer sandbox. Exploitation only requires an unauthenticated victim to visit a malicious page, giving the attacker high-impact code execution on the device. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, though the sandbox-escape framing makes it a high-priority browser patch.

Remote code execution in Google Chrome desktop before 152.0.7977.75 stems from a use-after-free in the Proxy component that a remote attacker can trigger with crafted network traffic to run arbitrary code OUTSIDE the browser sandbox. Google rates the Chromium severity High and a patched Stable channel build is available; no public exploit code has been identified at time of analysis. Because the flaw yields a sandbox escape rather than a contained renderer bug, successful exploitation gives attacker-controlled code on the host at browser-process privilege.

Unbounded recursion in Net::DNS before 1.57 for Perl allows a remote unauthenticated attacker to exhaust memory and terminate any DNS forwarder or proxy process by sending a crafted DNS message carrying a TSIG record misplaced in the answer or authority section with an empty MAC field. Because the library's decoder does not drop the malformed packet as RFC 8945 section 5.2 requires, the TSIG survives the re-encoding strip step and drives `sig_data` into infinite recursion; payloads under 100 bytes on the wire are sufficient to crash the process. No public exploit has been identified at time of analysis, and EPSS indicates low current exploitation probability (0.17%), though the trivially small payload and zero-authentication requirement make this an operational priority for any Perl-based DNS forwarder or proxy deployment.

Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's `maxTotalMergeKeys` safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (`<<`) processing is enabled by default on both release lines. No confirmed active exploitation appears in CISA KEV at time of analysis, but the attack is trivially reproducible from the published advisory and pathological test case, and the library's ubiquity in the npm ecosystem makes this a high-priority availability risk.

Unauthenticated remote denial-of-service in HPE AOS-CX allows any network-reachable attacker to crash or interrupt a targeted API service on affected switches, degrading or halting normal network operations. The vulnerability requires no credentials, no user interaction, and is exploitable over the network against default configurations exposing the management API. This CVE is part of HPE Security Bulletin HPESBNW05134, which also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749) and a CVSS 7.2 authenticated command injection (CVE-2026-73766) in the same platform; no public exploit has been identified at time of analysis.

Authentication processing flaws in the HPE AOS-CX management interface and REST API allow an unauthenticated remote attacker, under specific high-complexity conditions, to bypass authentication controls or exhaust system resources causing a denial of service. Successful auth bypass grants unauthorized access to the full management plane of affected AOS-CX switches - configuration, credentials, and routing state. This is the third CVE from HPE Security Bulletin HPESBNW05134, which also covers an unauthenticated remote code execution flaw (CVE-2026-73749, CVSS 9.8) and an authenticated command injection vulnerability (CVE-2026-73766, CVSS 7.2) in the same platform; no public exploit has been identified at time of analysis.

Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.

Memory exhaustion in gRPC-Go before version 1.83.1 allows an unauthenticated remote attacker to crash any service built on this library by sending HTTP/2 streams fragmented into millions of tiny one-byte DATA frames. Each fragment is stored as a separate recvMsg object in recvBuffer, creating severe heap overhead that bypasses HTTP/2 flow-control protections - which limit payload bytes, not the number of allocated metadata objects. No public exploit has been identified at time of analysis, but the attack is fully derivable from the public GitHub advisory and PR diff.

Worker process exhaustion in Erlang/OTP's inets httpd enables unauthenticated remote denial of service by exploiting a bare-catch error-handling flaw in the chunked transfer-encoding decoder, permanently consuming HTTP worker processes until the pool is exhausted and the server becomes unresponsive to legitimate clients. The defect lies in httpd_request_handler:handle_info/2, where a throw exception raised by an invalid chunk-size is silently coerced into a normal return tuple rather than propagated as an error, leaving the worker suspended indefinitely with the request timeout already cancelled and no default byte-rate watchdog to reclaim it. Affected OTP versions span three active release lines (27.x, 28.x, 29.x) in their default configurations; no public exploit is confirmed, though the fix commit includes a regression test that is functionally equivalent to a proof-of-concept attack.

Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.

ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event loop by submitting a small crafted XML document containing a malformed end tag. The SAX parser in lib/sax.js uses an unanchored global regex /[ \t\n\r]+$/g to trim end-tag names; a tag with N whitespace characters followed by one non-whitespace character causes the engine to retry the match from every character position with O(N) backtracking per position, yielding O(N²) total work that blocks the single-threaded event loop. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 4.0 score of 8.7 with VA:H and PR:N reflects the severity of unauthenticated, network-reachable availability impact.

Erlang/OTP's inets HTTP server (httpd) fails to enforce an administrator-configured request body-size limit when processing chunked transfer-encoded requests, enabling unauthenticated remote attackers to exhaust server memory and cause denial of service. Affected OTP branches span 17.x through 27.3.4.16, 28.x through 28.5.0.5, and 29.x through 29.0.5, covering inets versions 5.10 through 9.7.1. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, but the zero-authentication, low-complexity network attack path makes this an operationally straightforward DoS risk for any deployment exposing inets httpd to untrusted clients.

Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js process heap by sending a compact, crafted XML document with repeated namespace prefix declarations. The unmaintained legacy `xmldom` package (versions 0.1.5-0.6.0) has no available fix, while `@xmldom/xmldom` is patched in releases 0.8.15 and 0.9.12. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the attack is trivially automatable against any application that parses untrusted XML with this library.

Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The `@xmldom/xmldom` package before versions 0.8.15 and 0.9.12, and all versions of the legacy `xmldom` package (0.3.0-0.6.0), expose both paths through the default `DOMParser.parseFromString()` interface, requiring no authentication or special configuration. No public exploit has been identified at time of analysis, but the security advisories and fix commits are publicly available on GitHub.

Unbounded memory exhaustion in the Erlang/OTP inets httpc HTTP client allows any server the client connects to - including via redirect or man-in-the-middle - to crash the BEAM VM by returning an arbitrarily large volume of response headers. The root cause is that max_header_size defaults to the atom nolimit and the header accumulation loop in httpc_response:parse_headers/6 collects all header data into an in-process list before any size check fires. A proof-of-concept server delivering 100,000 headers of ~4,000 bytes each consumed over 13 GB of RAM in under 30 seconds; no public exploit code has been separately released but the PoC is embedded in the official advisory, and vendor patches are available for OTP 27, 28, and 29 branches.

Erlang/OTP's inets HTTP server (httpd) is vulnerable to a slow-body resource exhaustion attack exploitable by unauthenticated remote attackers across OTP versions 17.0 through 29.0. The request handler cancels its active timeout after successfully parsing request headers, then re-arms the socket for body data without installing any replacement timer, allowing an attacker to open connections with syntactically valid headers and a large Content-Length and then stall indefinitely - permanently occupying a worker process per connection. Vendor patches are available for the OTP 27.x, 28.x, and 29.x branches; no public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated denial of service in Erlang/OTP's inets httpd allows any remote attacker to exhaust a server's process pool, memory, and file descriptors by holding open an unlimited number of TCP connections. The flaw affects all inets httpd deployments across OTP 17.x through 29.x that do not explicitly configure the max_clients option; when that option is absent, a type-comparison defect caused by Erlang's term-ordering rules makes the connection-count guard unconditionally pass, accepting connections without bound. Vendor patches are available in OTP 27.3.4.17, 28.5.0.6, and 29.0.6; no public exploit code or CISA KEV listing has been identified at time of analysis.

Quadratic regex backtracking in @xmldom/xmldom versions 0.9.0-beta.9 through 0.9.10 allows unauthenticated remote attackers to stall the Node.js event loop by supplying a small malformed XML document containing an unterminated processing instruction with a long whitespace tail. The flaw resides in the processing-instruction production regex in lib/grammar.js, where the greedy S+ separator and lazy Char*? data group endlessly repartition whitespace when the required closing ?> is absent, causing O(n²) backtracking in both parsePI and parseProcessingInstruction. No public exploit has been identified at time of analysis, but the fix commit and GitHub Security Advisory GHSA-g53g-w8rj-fmg7 fully document the vulnerable code path, making independent reproduction straightforward. Vendor-released patch: 0.9.11.

Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the communication service by sending a specially crafted CIP packet with a manipulated data length field. The root cause is an integer underflow (CWE-191) in the packet length validation routine, causing the service to terminate and requiring a manual restart to recover. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the zero-barrier network attack vector against a critical ICS communication layer makes this a high-priority remediation target.

Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the RSLinx Classic communication service by sending a single crafted CIP packet targeting the Forward Close service. Because RSLinx Classic acts as the primary communication bridge between engineering workstations and Allen-Bradley PLCs, a crash forces a manual service restart and can halt production operations in industrial environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the RSLinx Classic service by sending a single crafted CIP (Common Industrial Protocol) packet, after which the service must be manually restarted to restore communications. The flaw is rooted in an integer-overflow (CWE-190) style mishandling of a malformed packet and carries a CVSS 4.0 base score of 9.2 driven by high availability impact on both the service and dependent systems. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Denial-of-service in a Rockwell Automation industrial module allows unauthenticated remote attackers to crash the device by sending a single crafted CIP (Common Industrial Protocol) packet, requiring a manual restart to restore availability. The vulnerability affects operational technology (OT) environments where CIP is network-accessible, making it particularly dangerous in industrial control system (ICS) contexts where device downtime can disrupt physical processes. No public exploit code has been identified at time of analysis, and Rockwell Automation has published advisory SD1798 addressing the issue.

Rockwell Automation's ArmorStart LT industrial motor control device contains a denial-of-service flaw in its embedded web server, exploitable by sending a crafted HTTP PUT request with no authentication or special preconditions. The root cause (CWE-770) is improper resource throttling during HTTP PUT processing, which causes the web server to become unavailable. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the unauthenticated network attack surface in an OT/ICS context makes this a material operational risk wherever the device's web interface is reachable.

Unauthenticated atom table exhaustion in ash_typescript 0.1.0-0.17.x allows any network attacker to crash the entire Erlang/BEAM node by submitting RPC requests with attacker-controlled field names. The library's `convert_to_field_atom/2` function calls `String.to_atom/1` on client-supplied strings without validation, minting permanent, non-garbage-collected atoms until the VM hits its table limit and aborts. Additionally, field names exceeding 255 characters trigger an uncaught `SystemLimitError`. No public exploit is identified at time of analysis, but exploitation is trivial given no authentication or special configuration is required.

Unauthenticated BEAM atom table exhaustion in ash_typescript 0.11.0-0.17.x allows a remote attacker to abort the Erlang VM and take down the entire application node by sending RPC requests carrying many distinct, unrecognized field names targeting a typed struct field selector. The root cause is `resolve_typed_struct_field/2` calling `String.to_atom/1` on unresolvable client input before any field-existence validation, permanently minting atoms that the BEAM runtime never reclaims. A vendor-released patch is available in 0.18.0; no public exploit code or CISA KEV listing exists at time of analysis.

Reachable assertion in llama.cpp's GGUF file parser (gguf_reader::read) allows a remote unauthenticated attacker to crash the process by supplying a crafted GGUF model file to any service built on llama.cpp b5693 or earlier. CWE-617 (Reachable Assertion) causes process abort on assertion failure, making this effectively a denial-of-service primitive. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at the 4th percentile (0.14%), reflecting low observed exploitation pressure.

Uncontrolled resource consumption in cleverange_auth v0.1.10 allows remote unauthenticated attackers to exhaust server resources and cause a denial of service by invoking the account_verification function exposed through the accounts/models.py component. The PyPI-distributed Python authentication library is affected in its only publicly released version (0.1.10), and a public disclosure repository exists on GitHub. No vendor-issued patch has been identified at time of analysis, leaving all deployments vulnerable.

Remote unauthenticated denial of service in llama.cpp (through commit 97f06e9) allows any network attacker to crash the inference server by submitting a POST request to the /rerank endpoint with a negative top_n value, triggering a std::bad_alloc exception and an HTTP 500 response. The attack surface is exclusively present when the server is started with the non-default --reranking flag. No public exploit has been confirmed at time of analysis, though a public technical writeup exists at ph4nt0m.xyz that details the flaw and may contain proof-of-concept request data.

Remote unauthenticated denial of service in Kamailio 6.1.1 and earlier crashes the P-CSCF SIP proxy by triggering a NULL pointer dereference in the `free_security()` function when processing IMS registration cleanup of partially initialized IPsec security structures. The upstream commit (91c5ca7) confirms the root cause: `shm_free()` was called unconditionally on pointer fields that may be NULL in the `ims_usrloc_pcscf` module, crashing the Kamailio process and dropping all active registrations. No patch release has been tagged; no public exploit tool or CISA KEV listing exists at time of analysis.

Denial of service in Kamailio v6.1.1 and earlier allows an unauthenticated remote attacker to crash the SIP proxy by sending a crafted SIP REGISTER message with a malformed Security-Agreement header. The vulnerability resides in the `ims_registrar_pcscf` module's `parse_sec_agree()` function in `sec_agree.c`, which unconditionally calls `shm_free()` on IPSec parameter string pointers that may be NULL or uninitialized when header parsing fails mid-way, corrupting the Kamailio shared memory pool and crashing the process. No public exploit or active exploitation (CISA KEV) has been identified, and EPSS is low at 0.19%, though the vulnerable code path is fully disclosed by the upstream fix commit.

Uncontrolled recursion in llama.cpp's JSON-schema-to-grammar converter (common/json-schema-to-grammar.cpp, versions through build b5693) allows a remote unauthenticated attacker to crash the service by submitting a crafted JSON schema that triggers unbounded recursive processing, exhausting the call stack and producing a denial of service. The CVSS vector confirms network reachability with no authentication required and no user interaction needed, making this exploitable against any deployment that exposes the llama.cpp HTTP server endpoint to untrusted clients. No public exploit identified at time of analysis.

Denial-of-service in Tornado prior to 6.5.8 allows unauthenticated remote attackers to stall the entire server by sending a single POST request with millions of separator-delimited fields in an application/x-www-form-urlencoded body. Because Tornado's RequestHandler parses the body synchronously before handler dispatch using urllib.parse.parse_qs without a max_num_fields limit, a request body up to the 100 MB default max_buffer_size can consume all CPU on the single-threaded event loop and delay every concurrent connection. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AV:N/AC:L/PR:N/UI:N) makes this trivially automatable against any exposed Tornado endpoint.

Denial of service in SmallRye GraphQL allows unauthenticated remote attackers to exhaust server CPU or heap memory by submitting a GraphQL query containing a large-exponent float literal (e.g., 1e999999999) that triggers unconstrained BigInteger allocation during scalar coercion. Affected deployments include any application built on Red Hat Build of Quarkus that exposes a GraphQL endpoint via SmallRye GraphQL. No public exploit or KEV listing has been identified at time of analysis, though the attack technique is trivially constructible from the public description.

Resource exhaustion in HTML::FormFu through version 2.08 for Perl allows unauthenticated remote attackers to exhaust server memory and CPU via a crafted query string parameter. The Repeatable element's process method accepts an attacker-controlled integer from the counter_name query parameter with no upper bound, triggering deep-cloning of element subtrees that scales linearly - and with nesting, multiplicatively - with the supplied value. No public exploit is identified at time of analysis, but exploitation requires only a plain GET request with no credentials, authentication, or request body, making the attack surface trivially accessible to any internet-facing application using this feature.

Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts, which default to unlimited, allowing unauthenticated remote attackers to exhaust JVM heap memory or hold connections open indefinitely until the server crashes. Affected deployments span Red Hat JBoss EAP 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Undertow packages in RHEL 8, 9, and 10. No public exploit code has been identified at time of analysis, though the attack primitive requires no specialized tooling and has no complexity or authentication barrier.

Memory exhaustion denial of service in @pdfme/pdf-lib before 5.5.10 allows network-accessible attackers with low-privilege PDF upload access to crash Node.js server processes or freeze browser tabs by submitting a crafted PDF embedding a FlateDecode decompression bomb. The DecodeStream.ensureBuffer() method doubles its internal buffer without any upper-bound check, enabling a kilobyte-scale compressed payload to trigger unbounded memory allocation during parsing. No active exploitation is confirmed in CISA KEV, but the GHSA advisory for GHSA-vrqm-gvq7-rrwh includes a proof-of-concept Python script that lowers the exploitation barrier.

Atom table exhaustion in ash_admin's Phoenix LiveView event handlers allows any authenticated user reaching the admin interface to crash the entire BEAM VM node. Two handlers - AshAdmin.PageLive's set_actor and AshAdmin.Components.Resource.Show's calculate - passed unvalidated client strings directly to Module.concat/1 and String.to_atom/1 respectively, minting a permanent new atom per unique request. Because BEAM atoms are never garbage collected and the table is capped at roughly one million entries, flooding either handler terminates the VM and takes down every Elixir application co-hosted on the node. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch version 1.3.1 is available.

Unauthenticated remote attackers can arbitrarily modify wireless transmit-power settings or deny wireless service on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 by sending a crafted POST to the device's CGI management interface. The setWiFiSignalCfg function is reachable without any authentication gate, a CWE-284 improper access control defect that allows an adversary to degrade or eliminate wireless connectivity for all clients on the affected device. No public exploit code or CISA KEV listing is recorded; EPSS at 0.18% (7th percentile) reflects minimal current exploitation interest despite trivially automatable attack conditions.

Per-file size and file-count upload limit enforcement in Apache Wicket 8.x through 10.x can be bypassed when a co-deployed servlet component pre-consumes the multipart request body before Wicket processes it. Affected deployments fall back to HttpServletRequest#getParts(), which silently skips Wicket's configured Form#setFileMaxSize and Form#setFileCountMax constraints, allowing remote unauthenticated submitters to upload files larger or more numerous than the application intends to permit. Parts omitting a Content-Type header are additionally loaded entirely into JVM heap during parsing, creating a secondary denial-of-service path limited only by external container allocation bounds. No public exploit or CISA KEV listing exists; EPSS stands at 0.20% (10th percentile), consistent with a conditional, architecturally specific flaw.

Out-of-bounds read in Exiv2's CrwMap::decodeBasic() function affects versions prior to 0.28.9, impacting applications that use the library to parse Canon CRW image metadata. Classified as low severity by the Exiv2 maintainers, this flaw has only been reproduced using a dedicated fuzz target - the standard exiv2 command-line tool cannot trigger it under normal operation. No public exploit exists and no active exploitation has been identified, making real-world impact minimal despite the memory safety class of defect.

Out-of-bounds write in Exiv2's RemoteIo::Impl::populateBlocks() affects all versions prior to 0.28.9, exploitable only when Exiv2 is invoked with a remote URL as input rather than a local file path. Memory corruption from the write could theoretically enable code execution in the Exiv2 process context if a user or automated pipeline fetches a specially crafted image from an attacker-controlled server. Fixed in the 0.28.9 release; no public exploit or KEV listing identified at time of analysis.

AshGraphql's Absinthe complexity calculator undercounts nested Relay connection and keyset pagination queries, allowing unauthenticated clients to bypass any configured `max_complexity` cap and force unbounded database reads. Versions 0.16.23 through 1.10.x expose this flaw whenever a schema uses `first`/`last`-based pagination: a single crafted query such as `posts(first: 500) { edges { node { comments(first: 500) { ... } } } }` scores near-zero in Absinthe's guard while materializing up to 250,000 records per request. No active exploitation is confirmed (no CISA KEV listing), but the attack requires no authentication and is trivially constructable from the public advisory description alone.

Authentication denial of service in free5GC AUSF v1.4.4 and current main allows an attacker with access to the AUSF SBI/N12 interface to permanently block a target subscriber from completing 5G authentication by flooding the AUSF with concurrent POST /nausf-auth/v1/ue-authentications requests for the same SUPI. Each concurrent request silently overwrites the active EAP-AKA' session context stored under that SUPI key, so the legitimate UE's EAP response is validated against mismatched cryptographic material (K_aut, XRES) and fails AT_MAC verification. No vendor patch has been released; a working proof-of-concept was reproduced in a controlled lab and is documented in the upstream GHSA advisory, with no CISA KEV listing identified at time of analysis.

Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js server completely unresponsive using a single small multipart/form-data request. Two specially crafted field names - a large numeric array index followed by a non-numeric key - cause multer's underlying append-field dependency to synchronously iterate a maximum-length sparse array, permanently blocking the event loop and preventing the process from handling any further requests. No public exploit has been identified at time of analysis, but the attack requires no authentication and a minimal payload, making it trivially automatable against any Node.js application using unpatched multer.

Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt the schema-refresh routine by creating a view in a sampled namespace that reliably fails on evaluation. The mongosqld process misclassifies the persistent failure as transient, exhausts its retry budget, then continues running with no valid schema - leaving all downstream SQL clients unable to retrieve results until an operator manually removes the offending view or excludes the namespace. No public exploit has been identified at time of analysis, but the low privilege requirement and network accessibility make this a credible insider or multi-tenant threat.

Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers to crash the entire Node.js process by submitting a small, specially crafted multipart/form-data request. The attack exploits an uncaught RangeError in multer's append-field dependency: a first field with an extremely large numeric index allocates a maximum-length sparse array, and a second field pushes past that limit, throwing an exception that multer does not catch. No public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity nature of the attack makes this a realistic availability threat for any internet-facing Node.js application using multer.

File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial of service by repeatedly sending aborted or malformed multipart upload requests. Each aborted request causes multer to delete the visible file entry while leaving the underlying write file descriptor open, retaining disk blocks until process exit. With no public exploit identified at time of analysis and no CISA KEV listing, this is nonetheless trivially automatable - any publicly exposed upload route using DiskStorage is a viable target.

Remote unauthenticated denial-of-service in alos-http, a Linux amd64 Go web framework, allows any network-reachable client to crash the entire server process with a single malformed HTTP request. The flaw exists in the request-line parser's `sanitizeRequestPath` function, which performs an unchecked index into an empty string after stripping a bare query-string path such as `GET ? HTTP/1.1`. Because the panic fires in the connection-worker goroutine before the handler chain, the framework's own `core.Recovery()` middleware cannot intercept it, making the crash total and immediate. A publicly available proof-of-concept exploit exists; the vulnerability is not currently listed in the CISA KEV catalog.

Exponential backtracking ReDoS in Protego (pip/protego <= 0.6.1) allows any party who can serve a crafted robots.txt to freeze the `can_fetch()` call indefinitely, denying service to any application using this library for robots.txt compliance. A working proof-of-concept is publicly available in the GitHub security advisory GHSA-wjmf-p669-5m5p; the CVSS 4.0 score of 7.1 (VA:H) reflects meaningful availability risk for web-crawling deployments. No public exploit identified at time of analysis beyond the published PoC, and no CISA KEV listing exists.

Missing function-level access control in Yamcs Core's REST API allows any authenticated user - including completely unprivileged 'Guest' accounts - to bypass the platform's RBAC system across three distinct API controllers. Affected endpoints in IndexesApi, Cop1Api, and TimeApi omit authorization checks entirely, enabling telemetry metadata exfiltration, disruption of COP-1 satellite telecommand protocols, and manipulation of global simulation time. Publicly available exploit code (curl-based PoC) confirms exploitability; the vulnerability is not currently listed in CISA KEV, though the spacecraft operations context elevates real-world impact severity.

Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.

NF registration poisoning in free5GC's Network Repository Function (NRF) lets attackers with SBI network access register forged Network Function profiles containing arbitrary, attacker-controlled service endpoint IPs, because the RegisterNFInstance handler performs no field validation against 3GPP TS 29.510. Legitimate NFs (AMF, SMF, AUSF, UDM, PCF, NSSF) then discover the fake profiles via NFDiscover and route control-plane signaling to the attacker, enabling interception, OAuth2 credential harvesting, and denial of service across the entire 5G core service mesh. Publicly available exploit code exists and the vendor has released a patch; the flaw is CWE-20 with a vendor CVSS 4.0 base score of 9.3 (Critical).

Unbounded W3C tracestate parsing in the datadog-opentelemetry Rust crate (dd-trace-rs) allows remote unauthenticated attackers to exhaust CPU and memory on any instrumented service by sending HTTP requests with an arbitrarily large or pair-dense dd= vendor entry in the tracestate header. Affected versions 0.1.0 through 0.3.2 are exposed under default configuration because tracecontext extraction is enabled without any opt-in, making every internet-facing Rust service using Datadog APM a viable target. No active exploitation is confirmed (not in CISA KEV), but the zero-configuration attack surface and published advisory make this a prompt remediation priority for affected deployments.

Unbounded symlink-following in KubeVela's Terraform remote configuration loader allows any principal with `ComponentDefinition` create/update RBAC rights to OOM-kill the cluster-wide vela-core controller and halt all OAM application reconciliation. The root cause (CWE-59) is that `GetTerraformConfigurationFromRemote` in `pkg/controller/utils/capability.go` calls `os.ReadFile` on a symlink target without verifying the target is a regular file or bounding the read size; a repository containing `variables.tf -> /dev/zero` is sufficient to exhaust controller memory before HCL parsing is ever reached. No CISA KEV listing has been identified at time of analysis, but a complete proof-of-concept with exact reproduction commands is publicly disclosed in GHSA-fmgp-q6jx-gg3x, materially lowering the exploitation bar.

Stack buffer overflow in the PLANET GS-4210-16P2S managed switch web management interface exposes all firmware versions prior to 3.441b260626 to unauthenticated remote denial of service and potential memory corruption. The _readHttpParam function copies attacker-supplied HTTP query string data into a fixed-size stack buffer without enforcing size limits or guaranteeing NUL termination, after which parse_query_string processes the unbounded attacker-controlled content. No public exploit code has been identified at time of analysis and KEV status is not confirmed, but the pre-authentication network vector with no special preconditions makes this straightforwardly reachable; a vendor patch is available.

Unauthenticated denial of service in Smush Image Compression and Optimization plugin (versions ≤ 4.2.0) allows any remote attacker to exhaust WordPress server resources without credentials or user interaction. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms trivial, unauthenticated network exploitation with high availability impact, making every site running an affected version an easy target for sustained disruption. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity means exploitation requires minimal skill.

Pega Platform (marketed as Pega Infinity) versions 7.1.0 through 25.1.2 expose a network-accessible, unauthenticated attack surface via CWE-606 (Unchecked Input for Loop Condition), where attacker-controlled input can trigger unbounded loop execution. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, with vendor-assigned impacts of high integrity and high availability loss on the vulnerable system plus residual availability impact on downstream systems. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low-complexity, unauthenticated network exposure makes this a credible denial-of-service risk for any internet-reachable Pega deployment in the affected version range.

CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers to render affected servers unresponsive by submitting malformed form data, resulting in denial of service. Versions 2.49.0 through 2.52.1 of @sveltejs/kit are affected, but only when both the experimental.remoteFunctions and form features are simultaneously enabled - a non-default, opt-in configuration. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the complete availability impact against network-reachable endpoints with no authentication barrier once the experimental features are active.

Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the server process by sending malformed form data to a remote function endpoint, resulting in complete denial of service. Exploitation is gated behind two simultaneous non-default opt-in conditions - the experimental.remoteFunctions flag and form usage - which significantly narrows the real-world attack surface relative to the CVSS 4.0 score of 8.7. No public exploit or CISA KEV listing has been identified; a vendor-released patch is available in version 2.52.2.

Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who submit crafted multipart form requests that exploit a deserialization expansion flaw in the experimental `form` remote function, causing the server to construct disproportionately large `files` arrays and exhaust processing resources. Exploitation is gated behind a non-default opt-in flag (`experimental.remoteFunctions: true`) and requires the application to process the `files` array without length or size validation, substantially narrowing real-world exposure despite the CVSS 4.0 score of 8.7. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog.

Resource exhaustion in filebrowser through 2.63.23 allows denial-of-service by exploiting unvalidated named pipes in the archive and public download handlers. Both authenticated users and anonymous visitors holding public share links can trigger blocking open() syscalls by repeatedly requesting archives that include named pipe (FIFO) filesystem entries, pinning server goroutines until connection resources are exhausted. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the anonymous attack path via public shares elevates the practical concern for internet-exposed deployments.

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU on the imap-login process by sending an IMAP ID command with an excessive number of parameters before completing authentication. When the out-of-memory handler terminates the affected imap-login process, all other IMAP connections multiplexed on that same process are simultaneously dropped, amplifying the impact beyond the single malicious session. No public exploits are known, but the low attack complexity and zero authentication requirement make this a practical DoS vector against any internet-exposed OX Dovecot deployment.

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, enabling unauthenticated denial of service against Sieve script management. The blast radius is mode-dependent: high-security mode (CE community default) limits disruption to the attacker's own connection, whereas high-performance mode (Pro default) terminates all connections sharing the same managesieve-login process, making repeated attacks an effective targeted DoS. No public exploit code exists and no CISA KEV listing is present, but the unauthenticated network vector with low complexity makes this straightforward to trigger.

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user by crafting an email whose headers contain an abnormally large number of addresses or MIME parameters. The malicious message passes delivery intact, but when the recipient's IMAP process parses it, uncontrolled memory allocation causes the process to hit its memory limit and terminate, interrupting that user's IMAP session. No public exploits are known and CISA has not added this to the KEV catalog, but the low attack complexity and lack of authentication requirements make this a realistic nuisance-level threat for any Dovecot deployment.

Denial of service in the Linux kernel's MediaTek mtk_eth_soc Ethernet driver: mtk_poll_controller() passed a net_device pointer to mtk_handle_irq_rx(), which expects a struct mtk_eth pointer (the value registered as the request_irq cookie). When CONFIG_NET_POLL_CONTROLLER is enabled and the ndo_poll_controller path is exercised (e.g. via netconsole/netpoll), the resulting bad-pointer dereference crashes the kernel. Only devices using the MediaTek SoC Ethernet driver are affected; there is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).

Race condition and error-handling flaws in the i2c-imx I2C controller driver allow a NULL pointer dereference via the kernel interrupt handler on NXP i.MX SoC-based systems. The vulnerability affects multiple stable kernel branches (5.15 through 7.x) and is triggered when I2C slave registration fails partway through a PM runtime resume, leaving a stale or NULL pointer that the shared IRQ handler can dereference concurrently. The realistic impact is a kernel panic causing system unavailability; no public exploit exists and EPSS is 0.17%, consistent with no observed active exploitation.

NULL pointer dereference in the Linux kernel netfilter subsystem's xt_nat module allows a local attacker with low privileges to crash the kernel by instantiating SNAT or DNAT targets through the nft_compat compatibility layer using an unsupported bridge family, triggering a NULL dereference in nf_nat_setup_info(). Multiple stable kernel branches from 5.10 through 7.x are affected across numerous long-term support trees. No public exploit has been identified at time of analysis, and EPSS probability is very low at 0.18% (7th percentile); critically, the description itself notes the original crash was already mitigated by a prior upstream commit, making this patch a defense-in-depth hardening measure rather than a primary fix.

Use-after-free in the Linux kernel's UFS (Universal Flash Storage) core tracing subsystem allows a local attacker with tracing access to trigger a kernel crash or potentially achieve privilege escalation. The UFS trace event infrastructure stores raw pointers to the `hba` (Host Bus Adapter) structure in the trace ring buffer, then dereferences those pointers inside `TP_printk()` when `/sys/kernel/tracing/trace` is read - which may occur long after the underlying UFS device has been detached and its memory freed. No public exploit has been identified at time of analysis, and EPSS is 0.17% (6th percentile), indicating low near-term exploitation probability despite the high CVSS score.

Unaligned memory access in the Linux kernel netfilter synproxy timestamp adjustment code can crash the kernel or degrade performance on strict-alignment CPU architectures when synproxy is actively configured. Systems running synproxy as a SYN-flood mitigation layer on architectures such as SPARC, classic MIPS, or ARM without hardware unaligned-access emulation are exposed to remote-triggered denial of service via crafted TCP packets. No active exploitation is confirmed (absent from CISA KEV) and EPSS at 0.17% (6th percentile) indicates negligible observed exploitation probability, though the network-reachable vector warrants timely patching on vulnerable platforms.

NULL pointer dereference in the Linux kernel's EMAC (Ethernet MAC) network driver during device probe can crash the kernel, resulting in complete system availability loss on affected hardware. The fault lies in `emac_probe()` where `devm_request_irq()` is called before `dev->emacp` is mapped via `devm_platform_ioremap_resource()`, leaving a race window during initialization in which any hardware interrupt invoking `emac_irq()` will dereference a NULL pointer and trigger a kernel panic. No public exploit code exists and the vulnerability is absent from CISA KEV; patches have been released across multiple Linux stable branches.

Lock mode mismatch in the Linux kernel's DRM XE GPU driver allows a local low-privileged user to trigger a kernel WARN_ON assertion via the xe_vm_bind_ioctl interface on systems compiled with the debug option CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y. The vulnerability arises because xe_pt_svm_userptr_pre_commit() acquires the SVM notifier_lock for read, but the injected test path calls into drm_gpusvm_unmap_pages() expecting a write-mode hold, causing the assertion to fire and potentially destabilizing the kernel. No public exploit has been identified and an EPSS of 0.18% (7th percentile) reflects minimal real-world threat, with impact confined entirely to debug kernel builds.

The Linux kernel ims-pcu USB driver exposes sysfs device attributes on the secondary data interface in addition to the intended primary control interface, allowing local users to trigger kernel crashes or undefined behavior by accessing those attributes on the data interface, which lacks the descriptors and internal state the driver requires. Affected systems must have an IMS Passenger Control Unit USB device physically connected and run a kernel version between commit 204d18a7a0c67352857dee1bbac517ed63f01d8e and the respective fix commits. No public exploit code exists, and the EPSS score of 0.17% (6th percentile) reflects the extreme hardware rarity required for exploitation; no CISA KEV listing exists.

Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.

Uncontrolled resource consumption in relibc's with_argv function (commit 61f42d) enables remote unauthenticated attackers to crash applications by supplying a crafted argument payload, causing a Denial of Service. relibc is a Rust-based C standard library implementation for Redox OS; the affected function in /unistd/mod.rs fails to bound resource usage when parsing process arguments. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to abuse.

Denial of Service in relibc's seekdir() implementation at git commit 61f42d allows an attacker to crash or hang applications that use the library by supplying crafted directory position input to the vulnerable /dirent/mod.rs code path. The flaw is rooted in uncontrolled resource consumption (CWE-400), and a public proof-of-concept exploit exists at the Marsman1996 GitHub repository. No active exploitation has been confirmed in production environments - relibc is not listed in the CISA KEV catalog - but the combination of a public PoC and a network-attributed CVSS score elevates practical concern for any application consuming this library version.

Resource exhaustion in OWASP json-sanitizer v1.2.3 allows unauthenticated remote attackers to trigger a Denial of Service by supplying a crafted payload to the JsonSanitizer.sanitize() method. Any Java application that passes untrusted or externally supplied input through this library is affected, making the attack surface proportional to the library's adoption in internet-facing services. SSVC classifies this as automatable with no confirmed exploitation at time of analysis, and no public exploit code has been identified.

Memory exhaustion via unbounded URL fetch in vLLM up to 0.17.0 allows remote unauthenticated attackers to crash the inference server by supplying a multimodal API request pointing to an arbitrarily large file. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py use aiohttp to retrieve user-controlled URLs but call r.read() with no response-size cap, meaning the server will buffer the entire remote payload into process memory. No public exploit confirmation or CISA KEV listing exists at time of analysis; however, the attack surface is trivially reachable against any vLLM deployment accepting multimodal API requests without network-layer restrictions.

WatchGuard Dimension's log listening service can be rendered unavailable by an unauthenticated remote attacker flooding it with TCP SYN packets, a classic resource exhaustion denial-of-service technique. The CVSS 4.0 base score of 8.7 reflects high availability impact with no authentication, no user interaction, and no configuration prerequisite required. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.

Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN session negotiation. By sending specially crafted network packets to the IKE service, an attacker can trigger an integer underflow in iked, crashing VPN processing and disrupting all VPN-dependent connectivity without any authentication. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.

Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic, resulting in a Denial of Service condition. All Fireware OS versions appear affected per the wildcard CPE, and the vulnerability is reachable without authentication from any network path to the iked listener. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic target for disrupting VPN availability on WatchGuard appliances.

Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic. The flaw (CWE-191) resides in the IKEv1/IKEv2 key exchange handler, meaning any internet-exposed WatchGuard appliance with VPN enabled is reachable from the network perimeter without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack vector and availability impact of 8.7 (CVSS 4.0) make this a meaningful risk for organizations relying on WatchGuard VPN for remote access continuity.

Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.

Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially crafted IKE network traffic that triggers a double-free memory corruption in the iked daemon. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms zero prerequisites for exploitation against any internet-exposed WatchGuard appliance with IPsec VPN active. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to disrupt VPN operations by sending specially crafted network packets. The flaw resides in VPN processing logic and can crash or destabilize the IKE service, cutting off IPsec/IKEv2 tunnels for connected clients and sites. No public exploit has been identified at time of analysis and CISA KEV listing is not confirmed; however, the unauthenticated network attack vector and CVSS 4.0 score of 8.7 place this in the priority triage tier for organizations relying on WatchGuard Firebox VPN connectivity.

Buffer overflow in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to trigger a denial-of-service condition or potentially execute arbitrary code by submitting specially crafted traffic to the management interface. The root cause is CWE-787 (out-of-bounds write) in the web-based management component, and the CVSS 4.0 vector confirms network reachability with high-privilege authentication as prerequisites. No public exploit code or active exploitation has been identified at time of analysis, though the RCE potential on a network perimeter device elevates the severity beyond what the privilege requirement alone might suggest.

Arbitrary local file disclosure and denial-of-service exist in Trilium's automatic image-download feature, affecting all versions prior to 0.104.0. Any authenticated user or valid ETAPI token holder can embed file:// scheme URLs in note img tags to cause the server to read and store arbitrary local files - including sensitive system files accessible to the Trilium process - as retrievable note attachments. The same code path, when directed at an unbounded source such as /dev/zero, triggers uncontrolled memory allocation that crashes the server entirely. No public exploit code or CISA KEV listing has been identified at time of analysis.

Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. No public exploit has been identified and the EPSS probability is very low (0.16%, 5th percentile), though the unauthenticated, network-accessible attack path makes any openly exposed endpoint a viable denial-of-service target.