Denial of Service

Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.

Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially crafted IKE network traffic that triggers a double-free memory corruption in the iked daemon. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms zero prerequisites for exploitation against any internet-exposed WatchGuard appliance with IPsec VPN active. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to disrupt VPN operations by sending specially crafted network packets. The flaw resides in VPN processing logic and can crash or destabilize the IKE service, cutting off IPsec/IKEv2 tunnels for connected clients and sites. No public exploit has been identified at time of analysis and CISA KEV listing is not confirmed; however, the unauthenticated network attack vector and CVSS 4.0 score of 8.7 place this in the priority triage tier for organizations relying on WatchGuard Firebox VPN connectivity.

Buffer overflow in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to trigger a denial-of-service condition or potentially execute arbitrary code by submitting specially crafted traffic to the management interface. The root cause is CWE-787 (out-of-bounds write) in the web-based management component, and the CVSS 4.0 vector confirms network reachability with high-privilege authentication as prerequisites. No public exploit code or active exploitation has been identified at time of analysis, though the RCE potential on a network perimeter device elevates the severity beyond what the privilege requirement alone might suggest.

Arbitrary local file disclosure and denial-of-service exist in Trilium's automatic image-download feature, affecting all versions prior to 0.104.0. Any authenticated user or valid ETAPI token holder can embed file:// scheme URLs in note img tags to cause the server to read and store arbitrary local files - including sensitive system files accessible to the Trilium process - as retrievable note attachments. The same code path, when directed at an unbounded source such as /dev/zero, triggers uncontrolled memory allocation that crashes the server entirely. No public exploit code or CISA KEV listing has been identified at time of analysis.

Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. No public exploit has been identified and the EPSS probability is very low (0.16%, 5th percentile), though the unauthenticated, network-accessible attack path makes any openly exposed endpoint a viable denial-of-service target.

Denial of Service exposure in Spring Framework's data binding infrastructure allows unauthenticated remote attackers to exhaust application resources by submitting crafted property path expressions to any endpoint that binds user-supplied paths onto Java target objects. Affected versions span the entire actively maintained Spring Framework lineage - 5.2.x through 7.0.x - making the aggregate exposure footprint very large. No public exploit is referenced and EPSS sits at 0.15% (4th percentile), indicating low current exploitation activity despite the high CVSS score of 7.5.

Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.

Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.

CPU-pinning denial of service in NLTK's PorterStemmer component (versions ≤ 3.10.2) allows a remote unauthenticated attacker to exhaust a CPU core for seconds to minutes by submitting a single crafted token. The root cause is quadratic algorithmic complexity: _is_consonant() re-walks trailing 'y' characters on every invocation, and _measure() calls it once per stem position, resulting in O(n²) processing time. Any service that passes untrusted text through PorterStemmer.stem() without input length validation is vulnerable; a ~20-50 KB payload of repeated 'y' characters followed by a matching suffix such as 'ness' is sufficient to trigger the condition. No public exploit code is identified at time of analysis, but the attack primitive is trivially constructable from the public description. Fix is available in NLTK 3.10.3.

Uncontrolled memory allocation in jahlives/openssl_encrypt before 1.4.9 enables remote, unauthenticated denial of service by processing crafted encrypted files with arbitrarily large Argon2, scrypt, or balloon KDF cost parameters. Any application that passes attacker-controlled encrypted files or keystore data to this library can be crashed without requiring credentials, as the library performs no upper-bound validation on memory-hard KDF parameters before allocating the specified memory. No public exploit has been identified at time of analysis and it does not appear in CISA KEV, but the low attack complexity (AV:N/AC:L/PR:N/UI:N) makes exploitation straightforward wherever untrusted encrypted input reaches the library.

Pre-authentication denial-of-service in jahlives/openssl_encrypt before 1.4.9 allows unauthenticated network attackers to exhaust server memory and CPU by supplying crafted files with arbitrarily large key derivation function cost parameters, crashing or permanently wedging the process before any password verification occurs. The attack requires no credentials and no user interaction, making it trivially automatable against any service that accepts attacker-supplied encrypted files as input. No public exploit code has been identified at time of analysis, and the library's niche footprint limits broad internet exposure despite the low-complexity attack vector.

Uncontrolled memory allocation in the jahlives openssl_encrypt PHP library (versions before 1.4.9) exposes any application processing QR codes to remote denial of service. The library fails to validate the 'total' field within QR JSON payloads before allocating memory for range materialization, allowing an unauthenticated attacker to supply a crafted QR image containing an arbitrarily large 'total' value and exhaust host memory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is low-complexity and requires no authentication, making automated exploitation plausible against any internet-facing service that accepts QR input.

Uncontrolled memory allocation in the openssl-encrypt Python package (pip, versions ≤1.4.8) exposes any service invoking its `decrypt --stego-extract` command to unauthenticated denial of service via a crafted FLAC file. The STREAMINFO total_samples field - a 36-bit value fully controlled by the file author - is passed without bounds validation directly to NumPy as an array dimension, causing allocations of tens of gigabytes from a ~50-byte input. A vendor-released patch exists in version 1.4.9; no public exploit code has been identified at time of analysis, though the attack requires no authentication and minimal complexity.

Unbounded KDF iteration processing in jahlives/openssl_encrypt before 1.4.9 allows remote unauthenticated attackers to trigger sustained CPU exhaustion by supplying crafted files whose metadata contains arbitrarily high key derivation function iteration counts. Because the library reads this attacker-controlled value from file metadata and begins key derivation without enforcing any upper time or iteration ceiling, authentication can be held hostage indefinitely, starving the host of CPU resources. No public exploit has been identified at time of analysis, though the AV:N/PR:N/UI:N CVSS profile means any service that accepts encrypted file uploads from untrusted parties is exposed without prerequisite access.

Unbounded memory exhaustion in Ruby's resolv gem (before 0.7.2) allows an attacker controlling DNS responses to permanently grow a target process's memory without limit, eventually crashing the service. The root cause is that Resolv::DNS::Resource.get_class and related methods register a new Ruby class as a constant for each unknown DNS resource record type/class pair encountered, preventing garbage collection for the lifetime of the process. Because resolv is a default Ruby gem requiring no installation step, any plain Ruby installation performing DNS resolution - web services, workers, CLI tools - is exposed without opt-in configuration, and no public exploit has been identified at time of analysis.

WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. No public exploit has been identified at time of analysis and WibuKey has not been listed in the CISA KEV catalog, but the low attack complexity makes this a high-value local privilege escalation primitive for post-compromise chains.

CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed data length field, allowing remote unauthenticated attackers to trigger an out-of-bounds read and segmentation fault. Wibu-Systems versions before 8.41a and 9.10 are confirmed affected. The impact is a full service crash, denying access to any software whose licensing depends on the CodeMeter Runtime server - no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes and sensitive process memory disclosure, including stack canary values, via unsanitized logger input. Wibu-Systems' logging component passes externally controlled strings directly as printf-family format arguments, allowing an attacker to inject specifiers such as %x or %s to read stack memory or terminate the process. The vulnerability is trivially exploitable locally via the cmu CLI tool and becomes remotely exploitable without authentication when chained with CVE-2026-81573; no public exploit has been identified at time of analysis.

Denial of service in Spring Framework WebFlux applications (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8) occurs when the Aalto XML processor is used to parse request bodies, because the maxInMemorySize buffering limit is not correctly enforced. Remote attackers can submit oversized XML to trigger unbounded in-memory buffering and exhaust heap memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC lists exploitation status as none, though it rates the flaw automatable with total technical impact.

Uncontrolled resource consumption in Spring Framework's SpEL evaluator allows unauthenticated remote attackers to trigger a Denial of Service by submitting expressions using the power operator (^) with BigDecimal or BigInteger operands and arbitrarily large exponents, causing unbounded CPU and memory exhaustion in the JVM. All maintained Spring Framework release lines from 5.2.x through 7.0.x are affected, covering a large portion of the enterprise Java ecosystem. No public exploit has been identified and exploitation probability is very low (EPSS 0.15%, 4th percentile), though SSVC flags the attack class as automatable.

Spring WebFlux's PartEventHttpMessageReader fails to enforce the configured maxPartSize limit when maxInMemorySize is explicitly set to -1, allowing remote unauthenticated attackers to upload multipart request parts of arbitrary size in violation of application-defined policy. Affected are Spring Framework 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. No public exploit code has been identified at time of analysis and EPSS is very low at 0.15% (4th percentile), but the SSVC automatable flag means scanning and exploitation can be automated at scale against exposed endpoints.

Uncontrolled resource consumption in Spring Batch's FlatFileItemReader allows denial-of-service against batch jobs that process externally-supplied flat files containing multi-line records. When a specially crafted file is fed to the reader - exploiting its logic for assembling logical records spread across multiple physical lines (e.g., quoted CSV fields with embedded newlines) - the job stalls or exhausts memory, disrupting batch processing pipelines. Affected are all actively maintained Spring Batch branches: 4.3.0-4.3.13, 5.2.0-5.2.6, and 6.0.0-6.0.4. No public exploit or active exploitation has been identified at time of analysis.

Denial of service in ccoap's option parsing logic allows unauthenticated remote attackers to crash any service built on commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 by sending a single CoAP message carrying an invalid option number, triggering a segmentation fault. The impact is strictly availability - confidentiality and integrity are unaffected (CVSS C:N/I:N). No public exploit code and no CISA KEV listing have been identified; EPSS at 0.17% (7th percentile) reflects minimal current exploitation interest.

Denial of service in free5GC v4.1.0 allows remote unauthenticated attackers to crash the Access and Mobility Management Function (AMF) by sending a crafted PATCH request to the event subscription endpoint processed by ModifyAMFEventSubscriptionProcedure in processor/event_exposure.go. The root cause is CWE-770 - uncontrolled resource allocation - meaning the handler does not bound consumption triggered by attacker-supplied input. SSVC classifies this as automatable, making scripted mass exploitation feasible, though no active exploitation or public proof-of-concept code is confirmed at time of analysis.

Denial of Service in Open5GS v2.7.6 targets the NUDM-UECM (Network Unified Data Management - UE Context Management) interface, where a crafted HTTP DELETE request triggers a reachable assertion failure that crashes the UDM process. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and SSVC 'Automatable: yes' rating indicate this is trivially scriptable over the network. No active exploitation or public proof-of-concept code has been identified at time of analysis.

Integer overflow in the open5gs 2.7.6 NRF (Network Repository Function) discovery endpoint enables remote unauthenticated denial of service. Sending a crafted HTTP/2 GET request to /nnrf-disc/v1/nf-instances triggers arithmetic overflow that crashes the NRF service, disrupting 5G network function discovery for all dependent core network components. No public exploit has been identified and EPSS at 0.18% (7th percentile) reflects low current exploitation interest, though the unauthenticated network vector lowers the bar for any attacker with access to the SBI interface.

NULL pointer dereference in the AMF NGAP Dispatcher of free5GC v4.0.1 allows an unauthenticated remote attacker to crash the Access and Mobility Management Function by sending crafted NGAP messages during the initialization of a new RAN connection, resulting in complete availability loss for the 5G core control plane. The AMF is a central 5G core component responsible for registration and mobility management for all connected user equipment, so a successful crash severs control-plane service for all gNBs attached to that AMF instance. No public exploit code has been confirmed and no CISA KEV listing exists at time of analysis, though SSVC rates the attack as Automatable given the no-authentication, low-complexity network exposure.

Denial-of-service in free5gc v4.0.1 allows remote unauthenticated attackers to crash the 5G core network's AMF component by sending a specially crafted NAS PDU to the NGAP handler. The vulnerability stems from improper resource allocation (CWE-770) in the NGAP message processing path, which when triggered drops all active 5G sessions handled by that AMF instance. No public exploit code has been identified and CISA KEV confirms no active exploitation, but SSVC rates the attack as automatable, meaning it can be scripted without manual interaction.

NULL pointer dereference in FFmpeg development snapshot N-122528-gdd2976b9e1 crashes the FFmpeg process when parsing a maliciously crafted video file via the get_min_buffer_size function in libswscale/slice.c. Any application or automated pipeline using this FFmpeg build to process untrusted video input is exposed to unauthenticated remote denial of service, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code exists at time of analysis, and EPSS at 0.15% (4th percentile) signals low current threat-actor activity.

Denial of service in free5gc v4.0.1's NAS decoder allows unauthenticated remote attackers to crash the AMF (Access and Mobility Management Function) by sending a crafted Registration Request message, disrupting 5G core network availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) confirms zero-prerequisite network exploitability - any host able to reach the N1 interface can trigger the fault. No public exploit or active exploitation has been identified at time of analysis; EPSS at 0.15% (4th percentile) reflects low observed exploitation probability, consistent with free5gc's predominantly research-oriented deployment footprint.

Denial of service in free5GC v4.0.1 affects the SUCI (Subscription Concealed Identifier) parsing routine invoked during 5G UE registration, allowing unauthenticated remote attackers to crash or resource-exhaust the core network by sending crafted SUCI payloads. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), any attacker reachable on the AMF's N1/NAS interface can trigger the flaw before any subscriber authentication occurs. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Integer overflow in FFmpeg's libswscale/output.c (yuv2planeX_8_c function) allows a remote attacker to crash the FFmpeg process by supplying a crafted video file, causing denial of service in any pipeline that processes untrusted media. The affected build is development snapshot N-122528-gdd2976b9e1; stable release exposure is unconfirmed. No public exploit code and no CISA KEV listing exist; EPSS of 0.15% (4th percentile) indicates very low near-term exploitation probability despite the high CVSS base score.

Denial of service in free5gc v4.1.0 allows unauthenticated remote attackers to crash the UE context management service by sending a crafted HTTP PUT request to the /v1/ue-contexts/{supi} REST API endpoint, invoking the CreateUEContextProcedure function. The root cause is CWE-770 - uncontrolled resource allocation - where a malformed request triggers unchecked resource consumption that terminates the AMF process. No public exploit code has been identified and the EPSS score is 0.15% (4th percentile), though the zero-prerequisite network vector makes any exposed deployment immediately actionable.

Integer overflow in FFmpeg's libswscale library allows any application or service processing attacker-controlled image files to be crashed via a specially crafted input, causing a Denial of Service. The vulnerable function hScale16To19_c() in output.c is affected in build N-122528-gdd2976b9e1; the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects worst-case exposure in automated media-processing services. Despite the high CVSS score of 7.5, the EPSS probability is just 0.15% at the 4th percentile and no active exploitation has been confirmed, indicating limited real-world exploitation activity at time of analysis.

Integer overflow in FFmpeg's libswscale image-scaling library (output.c) enables Denial of Service against any service or application that processes attacker-supplied media through the swscale API. The flaw, confirmed in snapshot build N-122528-gdd2976b9e1, resides in the target_sws_fuzzer() harness and indicates that the underlying scaling output path contains an integer wraparound reachable via crafted input. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS probability is negligible at 0.15%, suggesting minimal current threat actor interest.

NULL pointer dereference in free5gc v4.0.1's CDR processing path enables unauthenticated remote attackers to crash the 5G core network service by sending a crafted payload, causing a complete denial of service against the affected network function. The CVSS 7.5 score reflects a straightforward, credential-free network attack path requiring no complexity; however, EPSS places real-world exploitation probability at 0.18% (8th percentile), indicating limited threat actor interest at time of analysis. No public exploit code and no CISA KEV listing have been identified.

Integer overflow in Open5GS v2.7.6's Session Management Function (SMF) allows remote unauthenticated attackers to crash the service via a crafted GTP packet, causing Denial of Service against 5G core network infrastructure. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms zero-authentication network exploitation requiring no user interaction. Researcher-published proof-of-concept code exists in a public GitHub repository and gist, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.

Denial of Service in free5gc v4.0.1 allows unauthenticated remote attackers to crash the NSSF (Network Slice Selection Function) by sending a crafted POST request to the NssaiAvailabilitySubscriptionCreate endpoint. The affected component handles 5G network slice subscription lifecycle management, and resource exhaustion causes the NSSF to become unresponsive, disrupting slice selection for all connected 5G devices on that core instance. No active exploitation is confirmed (no CISA KEV listing) and EPSS is very low at 0.18% (8th percentile), indicating minimal real-world exploitation at time of analysis.

free5gc v4.0.1, an open-source Go-based 5G core network implementation, is vulnerable to denial-of-service via crafted input to the HandleGetSharedData function, which can exhaust system resources and crash core network functions. The CVSS score of 7.5 HIGH reflects a zero-authentication network vector, though the very low EPSS of 0.15% (4th percentile) and absence of KEV listing or public proof-of-concept indicate minimal observed exploitation risk at this time. Deployments are typically confined to research and lab environments, reducing broad exposure.

Heap-based buffer overflow in FFmpeg's libswscale library enables unauthenticated remote attackers to crash media-processing applications via a crafted input file. The vulnerable function ff_sws_alphablendaway, invoked during alpha channel compositing in git-master commit 722a217, mishandles attacker-controlled input and corrupts heap memory, producing a Denial of Service. No active exploitation is confirmed - EPSS stands at 0.15% (5th percentile) with no CISA KEV listing - indicating this is currently a crash risk rather than a weaponized threat.

Null pointer dereference in ccoap (commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5) allows remote unauthenticated attackers to crash the CoAP server by submitting requests that trigger a race condition between the session dispatch and cleanup threads. The impact is confined to availability - the server process crashes, producing a denial-of-service condition with no confidentiality or integrity consequences. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.17% (7th percentile) places this in the lowest tier of current exploitation likelihood.

Denial of service in free5gc v4.0.1 is exploitable via the HTTPModifySubscription handler, which fails to reject crafted HTTP input before processing, causing the affected 5G core network function to crash. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote, unauthenticated exploitation with no user interaction required, making any network-reachable deployment of the SBI interface a viable target. No public exploit code has been identified and EPSS sits at just 0.15% (4th percentile), indicating low observed attacker interest at time of analysis.

Denial of service in free5gc v4.1.0's CreateUEContext handler allows unauthenticated remote attackers to crash or exhaust the 5G core network service by sending crafted UE context creation requests. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) - the handler performs no rate limiting or resource bounding when processing incoming context requests. No active exploitation is confirmed (not in CISA KEV), though SSVC flags the attack as automatable, meaning a single host could sustain a disruptive flood without manual repetition.

Reachable assertion in Open5GS v2.7.6 SMF crashes the Session Management Function via a crafted DELETE request to the /nsmf-pdusession/v1/sm-contexts endpoint, enabling unauthenticated remote denial of service against the 5G core. Per CVSS PR:N, no authentication is required, though network access to the internal Service Based Interface (SBI) is a practical prerequisite in standard deployments. No active exploitation has been confirmed (not in CISA KEV), no public exploit code is known, and SSVC rates this as non-automatable with partial technical impact - suggesting real-world risk is lower than the 7.5 CVSS score implies.

Resource exhaustion in the free5GC v4.0.1 NF Discovery endpoint allows unauthenticated remote attackers to crash or hang the Network Repository Function (NRF) by sending a crafted snssais query parameter, disrupting 5G core service discovery for all dependent network functions. The root cause is CWE-770 - missing input validation and resource throttling on a control-plane REST API that is central to 5G Service Based Architecture (SBA) operation. No public exploit code exists and EPSS sits at the 4th percentile, indicating low opportunistic exploitation likelihood; however, the absence of a confirmed patch makes this a persisting exposure for free5GC operators.

Denial of service in free5gc v4.0.1 allows unauthenticated remote attackers to crash the 5G core network processor by sending a crafted input to the buildFilter function in processor/processor.go. The flaw stems from improper input validation (CWE-20), meaning the function does not adequately sanitize or reject malformed data before processing it, causing an unrecoverable failure of the affected network function. No public exploit code or active exploitation has been identified; EPSS stands at 0.15% (4th percentile), indicating very low current exploitation probability.

Remote unauthenticated denial-of-service in the NRF Discovery service of free5gc v4.0.1 can be triggered by sending crafted input to the complexQueryFilterSubprocess function, crashing the service without any authentication or user interaction. The NRF (Network Repository Function) is a critical 5G core component responsible for service discovery; its disruption can cascade to affect the entire 5G core network's ability to register and locate network functions. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), suggesting low observed exploitation activity despite the high CVSS base score.

Remote unauthenticated Denial of Service in free5gc v4.0.1 allows network-accessible attackers to crash the 5G core parameter provisioning service by sending a crafted input to the HandleUpdate function in /sbi/parameter_provision.go. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no authentication or special preconditions are required, though the EPSS score of 0.15% at the 4th percentile and absence from CISA KEV indicate no public exploit code and no confirmed active exploitation at time of analysis.

Null pointer dereference in ccoap's CoAP server (commit 77f55c4b) allows unauthenticated remote attackers to crash the server process by sending a crafted CoAP message. The vulnerability exists in coap_server_handle_session(), which calls strncmp() on a URI_PATH option's data pointer without first validating that the pointer is non-NULL, triggering a segmentation fault on receipt of a malformed packet. With CVSS A:H and no authentication required (PR:N/AC:L), this is a straightforward remote denial-of-service; no public exploit or KEV listing has been identified at time of analysis.

Null pointer dereference in ccoap's coap_dump_msg() function causes remote denial of service when processing CoAP messages that carry options with zero-length values. The flaw is pinned to commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 of the ipflavors/ccoap library. An unauthenticated remote attacker reachable by the CoAP service can crash any process that links this library by sending a single crafted packet. No public exploit has been identified at time of analysis, and EPSS is 0.15% (5th percentile), reflecting low real-world exploitation activity.

Denial of Service in free5gc v4.0.1 allows remote unauthenticated attackers to crash or disrupt the 5G core network by sending crafted input to the RechargePut function. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the function fails to bound resource consumption when processing malformed payloads. No public exploit exists at time of analysis, and an EPSS score of 0.15% (4th percentile) reflects minimal real-world exploitation pressure despite the network-accessible, no-authentication attack vector.

NULL pointer dereference in free5gc v4.0.1's UDMC registration handler exposes remote unauthenticated attackers to crashing the 5G core network process by submitting a specially crafted registration payload, resulting in complete availability loss of the affected network function. Any deployment with a network-accessible UDMC registration interface running free5gc v4.0.1 is at risk. No public exploit has been identified at time of analysis; EPSS exploitation probability is very low at 0.15% (4th percentile), consistent with the niche, research-oriented deployment footprint of this product.

Integer overflow in FFmpeg's libswscale/utils.c component, present in development snapshot N-122528-gdd2976b9e1, allows unauthenticated remote attackers to crash any application relying on that component for image scaling by supplying a specially crafted image file. The CVSS 7.5 High rating reflects a network-reachable, zero-authentication denial-of-service path, but the EPSS score of 0.15% at the 4th percentile indicates negligible observed exploitation activity. No public exploit code and no CISA KEV listing are confirmed at time of analysis.

Denial of service in Spring Reactor Core exposes reactive Java applications to an infinite-loop condition (CWE-835) when the Flux.bufferTimeout operator is used with fairBackpressure enabled. Affected branches span 3.7.x through 3.7.19 and 3.8.0 through 3.8.6, meaning applications on both supported and legacy release trains are vulnerable. No active exploitation has been identified (SSVC: none), and EPSS probability sits at 0.22%, but the network-accessible nature of reactive endpoints makes this a realistic denial-of-service vector for exposed services using the specific configuration.

Disk quota enforcement is absent from the SFTP write path in Pterodactyl Wings 1.13.2 and earlier, allowing any tenant with SFTP write access to a single server to exhaust the host node's entire physical disk. The flaw combines a stale, one-time cache check at file-handle open time with no per-write accounting, plus a logic gap that continues accepting SFTP writes to servers already stopped for quota violations. No public exploit has been identified at time of analysis, but exploitation requires only low-privilege SFTP credentials available to every legitimate tenant, making this a high-priority multi-tenant hosting risk.

Unbounded memory allocation in amqp091-go (RabbitMQ's official Go AMQP 0.9.1 client) before v1.13.0 allows a malicious or compromised AMQP broker to force connected clients to allocate and process content body frames exceeding the negotiated frame_max limit, bypassing protocol framing constraints and causing application-layer denial of service. The root cause - confirmed via PR diff - is the client's blind acceptance of broker-advertised frame sizes during the TUNE handshake without enforcing the AMQP specification's minimum frame floor. No public exploit or CISA KEV listing exists at time of analysis; a vendor-released patch is available in v1.13.0.

Null pointer dereference in Stomper (commit 5e2741e) allows any remote unauthenticated client to crash the STOMP server process by sending a SEND frame with the destination header omitted. The crash is deterministic and repeatable, making sustained denial-of-service trivially achievable without credentials or prior session state. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.15% (5th percentile) indicates low current exploitation probability, but the attack complexity is minimal for any attacker with network access to the service.

Denial-of-service (and potential memory corruption) in the Stomper STOMP message broker (commit 5e2741e) lets remote attackers crash the broker process by abusing frame sequencing. By opening a connection that sends multiple CONNECT frames and subscribes a destination, then having another client SEND to that destination, an attacker triggers a heap use-after-free on a freed StompStreamSocket object. A public proof-of-concept write-up exists (no confirmed active exploitation), and because the protocol path requires no authentication by default, exploitation is straightforward against exposed instances.

Heap use-after-free in Stomper (commit 5e2741e) allows any unauthenticated network client to reliably crash the broker process by repeatedly issuing SUBSCRIBE commands for the same destination on a single connection and then closing it. The broker's subscription cleanup logic leaves dangling pointers in internal structures that are dereferenced during StompClient destruction, causing a denial of service. A proof-of-concept bug report is publicly available; SSVC classifies exploitation as automatable, though EPSS sits at only 0.15% (5th percentile), consistent with a niche product not yet widely targeted.

Stomper at commit 5e2741e crashes its server process when a broker attempts to write data to a TCP socket already closed by the client peer, delivering a SIGPIPE signal that the process does not handle, causing immediate termination. Any unauthenticated remote client can reliably trigger this by closing the socket at the right moment during a broker-to-client transmission, making the denial-of-service condition automatable. No patch version has been confirmed; a publicly available proof-of-concept bug report exists, though EPSS places exploitation probability at only 0.15%.

Permanent resource exhaustion in the stomper STOMP broker (commit 5e2741e) allows any unauthenticated remote client to hang the broker's event loop by sending partial STOMP frames without completing them. The flaw exploits the interaction between edge-triggered epoll (EPOLLET) and a MSG_PEEK-based recv() pattern: because EPOLLET only fires on state transitions, a socket that holds partial data but never completes a frame stops generating new epoll events, trapping it in a permanent half-read state. As such connections accumulate, the broker's epoll_wait call never returns for those sockets, and the broker eventually stops processing all new messages. No public exploitation has been confirmed by CISA KEV; EPSS stands at 0.15% (5th percentile), suggesting low observed exploitation activity at time of analysis.

Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.

Race condition and error-path corruption in the Linux kernel sur40 input driver allow a local low-privileged user with access to an attached Samsung SUR40 multi-touch device to crash the kernel or corrupt input core state. The driver registers the input device in sur40_probe() before V4L2 video and vb2_queue components are fully initialized; any userspace process opening the input node immediately after registration can trigger the sur40_poll() worker thread, which dereferences the still-uninitialized vb2_queue and causes a data race leading to a potential system crash. A secondary error-path bug calls input_free_device() on an already-registered device instead of input_unregister_device(), corrupting input subsystem state if V4L2 initialization subsequently fails. No public exploit is identified at time of analysis.

Denial of service (kernel crash/oops) in the Linux kernel CephFS client affects systems mounting a Ceph filesystem alongside another journaling filesystem such as ext4. The ceph handle_reply() path stores a ceph_mds_request pointer in current->journal_info while prepopulating the inode/dentry cache from an MDS reply; if an allocation in that window enters direct reclaim and prunes dentries from an ext4 mount, JBD2 misinterprets the Ceph pointer as a journal handle and dereferences r_tid as h_transaction, causing a paging fault and kernel oops. No KEV listing and no public exploit identified at time of analysis; the reported impact class is Denial Of Service rather than the code execution implied by the supplied 9.8 score.

Out-of-bounds write in the Linux kernel's Tegra hardware crypto driver affects AES-GCM decrypt operations on NVIDIA Tegra SoC-based systems running kernel 6.10 and later. When a caller skips invocation of tegra_gcm_setauthsize() - leaving ctx->authsize at zero - the rctx->cryptlen calculation in tegra_gcm_do_one_req() produces an inflated length that causes a subsequent decrypt operation to write beyond the rctx->dst_sg scatter-gather buffer. A local attacker with low-privilege access to the kernel crypto API on affected Tegra hardware could trigger this to achieve privilege escalation or a kernel crash. No public exploit code or CISA KEV listing has been identified at time of analysis.

Memory corruption in the Linux kernel ipvlan driver arises because ipvlan devices inherit hard_header_len but leave needed_headroom and needed_tailroom at zero, so upper layers under-reserve skb space when the lower physical device needs extra header/trailer room (macsec, IPsec, WireGuard, tunnels, or veth with rx headroom). Triggering the header-prepend or tailroom-append path can cause skb headroom underflow and KASAN-detected slab-use-after-free crashes. It is tagged as Denial of Service, has a vendor fix across multiple stable branches, and shows no public exploit or CISA KEV listing at time of analysis.

Memory corruption in the Linux kernel's macvlan driver occurs because macvlan devices fail to inherit needed_headroom and needed_tailroom from their underlying lower device, leaving both at 0. On systems where a macvlan is stacked on a lower device requiring extra header/trailer space (macsec, IPsec, WireGuard, tunnels, or veth with RX headroom), the upper layers under-reserve skb space, producing headroom underflows and KASAN slab-use-after-free crashes during header insertion. Tagged as Denial Of Service; a vendor patch is available and no public exploit has been identified at time of analysis.

NULL pointer dereference in the Linux kernel ngbe (Wangxun) network driver crashes the kernel when the NIC operates in non-MSI-X interrupt mode (legacy INTx or single MSI). Systems running affected kernel versions with Wangxun WX1860-series NICs configured in non-MSI-X mode are exposed to a kernel panic, resulting in complete system availability loss. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, patch commits are available across multiple stable kernel branches.

Denial of service in the Linux kernel's TI AM65 CPSW NUSS Ethernet driver (am65-cpsw-nuss) allows sporadic kernel crashes because the driver treats the full 16-bit RX DMA descriptor Source Tag as the MAC port ID, when only the lower 8 bits are valid. On affected TI Sitara/K3 (AM65x-class) hardware, the arbitrary hardware-reserved upper 8 bits produce an invalid port_id that subsequent driver code uses to access out-of-bound memory, causing kernel panics. No public exploit is identified and it is not on CISA KEV; the vendor-tagged impact is Denial Of Service, not the remote code execution implied by the automated 9.8 score.

Denial of service via HPACK bomb in http4s ember-core's HTTP/2 implementation allows unauthenticated remote attackers to exhaust JVM heap memory and crash affected servers or clients. The flaw resides in the Hpack wrapper (Hpack.scala:L54), where HEADERS and CONTINUATION frames are concatenated and decoded wholesale into a Scala List before any size limit is enforced; the existing maxHeaderSize guard is bypassed entirely because it does not account for indexed headers. Approximately five concurrent malicious connections against a 2 GB heap suffice to trigger OutOfMemoryError; no public exploit code or CISA KEV listing has been identified at time of analysis.

Memory exhaustion in RustDesk versions before 1.4.7 allows unauthenticated remote attackers to crash or severely degrade server availability by sending crafted TCP frame headers through BytesCodec before any authentication occurs. The decoder blindly reserves up to 1,073,741,823 bytes of buffer capacity per connection based solely on an untrusted four-byte length field, and concurrent connections multiply the allocation pressure until host memory is exhausted. No public exploit code has been identified at time of analysis, though the upstream patch commit fully discloses the trigger mechanism; the fix is available in the vendor-released 1.4.7 build.

ReDoS in NLTK's tgrep module exposes applications to indefinite CPU saturation when user-controlled tgrep patterns containing /regex/ nodes reach the _tgrep_node_action function, which compiles and executes them via Python's re.search without validation or timeout. All NLTK versions before 3.10.3 are affected when tgrep_positions() or tgrep_compile() accept external input. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is conditional on a non-default, externally-exposed API configuration.

Catastrophic regex backtracking in NLTK before 3.10.0 allows unauthenticated remote attackers to saturate CPU and deny service to all users sharing the Python process by supplying crafted patterns to the Text.findall() or TokenSearcher.findall() methods. Any Python application that exposes NLTK regex search functionality to user-controlled input is affected across all platforms. No public exploit has been identified at time of analysis, but the vulnerability class (ReDoS) is well-understood and trivial to weaponize once the targeted endpoint is known.

NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

Denial of service in qTox v1.18.4 lets an attacker crash the client through the profile-serialization code in src/persistence/serialize.cpp, classified as uncontrolled resource consumption (CWE-400). The description scopes this to a local attacker requiring victim interaction, and SSVC records a proof-of-concept, so publicly available exploit code exists; it is not listed in CISA KEV and EPSS is low (0.13%, 3rd percentile), indicating no evidence of widespread exploitation. Impact is limited to availability of the desktop client for the affected user, not remote code execution.

Stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack, allows any unauthenticated attacker within Bluetooth radio range to crash the bluetoothd service and potentially execute arbitrary code. The flaw is triggered when a target device with Bluetooth discovery enabled processes a malicious Extended Inquiry Response (EIR) packet. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept is identified at time of analysis.

Uncontrolled resource consumption in Apache Tomcat's HTTP/2 implementation allows remote unauthenticated attackers to exhaust server memory by repeatedly opening and resetting HTTP/2 streams, exploiting an allocation leak in the backlog tracking mechanism that fails to release memory on stream reset. Affected branches span Tomcat 9.0.39-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24, with EOL branch 8.5.59-8.5.100 also confirmed vulnerable but unpatchable. No public exploit has been identified at time of analysis; EPSS stands at a low 0.22%, but the unauthenticated network vector and high availability impact make this operationally significant for any HTTP/2-enabled Tomcat deployment.

Unauthenticated denial of service in Faktory prior to 1.10.0 allows any network-reachable attacker to crash the entire job server process by sending a single bare command verb without a payload. Because Go's runtime panics on out-of-bounds slice operations and no recover() wrapper exists in the command-dispatch path, the panic terminates the whole process rather than just the offending connection, instantly dropping all workers, clients, and in-flight jobs. No public exploit code has been identified at time of analysis, but the attack vector is trivially constructable from the description alone and can be repeated indefinitely to sustain the outage.

Worker-thread exhaustion in Mesop's debug-mode hot-reload endpoint (prior to version 1.3.3) allows an unauthenticated remote attacker to render the server completely unavailable with minimal effort. The GET /hot-reload endpoint in debug mode enters an unbounded loop controlled by the attacker-supplied counter parameter, holding worker threads indefinitely until the thread pool is exhausted and the server stops responding to all requests. Recovery requires a manual server restart. No public exploit has been identified at time of analysis, but the attack mechanism is trivially simple and fully automatable.

Unauthenticated access to the NVIDIA NemoClaw inference server on Linux exposes sensitive model inference data and enables denial of service by adjacent network attackers. The flaw stems from a missing authentication check (CWE-306) on the inference service endpoint, meaning any host on the same network segment can interact with the service without credentials. No active exploitation has been confirmed by CISA KEV and no public exploit code is known at time of analysis, but the low attack complexity and absence of authentication barriers make this straightforward to exploit for any attacker with adjacent network positioning.

Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV.

Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-privilege access to inject and execute arbitrary code within the process context, yielding full confidentiality, integrity, and availability impact on the vulnerable system. SSVC rates technical impact as total, consistent with the CVSS 7.8 rating, though EPSS remains very low at 0.16% (5th percentile) and no active exploitation has been observed. No public exploit has been identified at time of analysis.

Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer executing code without verifying its integrity, letting an attacker who can supply or interpose malicious code during installation achieve arbitrary code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA assigns a CVSS of 9.8 with a fully network-based, no-privilege, no-interaction vector, though the flaw is rooted in the install process. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (17th percentile), and CISA SSVC records no known exploitation.

OS command injection in NVIDIA NemoClaw for Linux allows a local low-privileged attacker to execute arbitrary operating system commands through the application's status and logs plugin command interfaces. The CVSS 7.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity and no user interaction required. No public exploit identified at time of analysis, and no CISA KEV listing observed, but the fully unscopeed local impact makes this a meaningful risk on multi-tenant or shared Linux systems running NemoClaw.

OS command injection in NVIDIA NemoClaw's NIM management component on Linux enables a local authenticated attacker to execute arbitrary operating system commands with the privileges of the targeted process. All versions of NemoClaw are indicated as affected per NVD CPE data (wildcard version range). Successful exploitation can result in full code execution, persistent data tampering, sensitive information disclosure, and denial of service on the host. No public exploit code or CISA KEV listing has been identified at time of analysis.

OS command injection in NVIDIA NemoClaw's command-line interface on Linux enables a local low-privileged attacker to execute arbitrary operating system commands, leading to full compromise of confidentiality, integrity, and availability. All versions of NemoClaw appear affected per the CPE wildcard (*), and the vulnerability is rooted in improper neutralization of user-supplied input passed to shell commands (CWE-78). No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting current real-world risk primarily to environments with untrusted local users.

Sandbox-escaping remote code execution is possible in Google Chrome for iOS before 152.0.7977.65, where a use-after-free in the Sync component can be triggered by a victim visiting a crafted HTML page, potentially letting a remote attacker run arbitrary code outside the renderer sandbox. Google has shipped a fixed stable build, and there is no public exploit identified at time of analysis; the flaw is not listed in CISA KEV and SSVC records exploitation status as none. Notably, Chromium's own severity rating for this bug is Low, which stands in sharp contrast to the 9.6 CVSS score in the input.

Remote code execution within the Chrome sandbox is achievable in Google Chrome prior to 152.0.7977.65 through a use-after-free vulnerability in V8, Chrome's JavaScript engine, triggered by a crafted HTML page. Any unauthenticated remote attacker who can induce a user to visit a malicious URL can exploit this flaw; however, execution is confined to the Chrome sandbox, meaning a chained sandbox escape would be required for full host-system compromise. No public exploit code or confirmed active exploitation is documented at time of analysis, and SSVC assessment lists exploitation as none, tempering urgency despite the high CVSS base score.

Use-after-free in the Animation component of Google Chrome prior to 152.0.7977.65 enables arbitrary code execution within the browser's renderer sandbox when a user visits a crafted HTML page. The flaw scores 8.8 CVSS HIGH, though Google's own internal Chromium severity rating is Low - a notable discrepancy that reflects the sandboxed containment of the impact. No public exploit code has been identified, SSVC indicates no active exploitation, and a vendor patch is confirmed available in Chrome 152.0.7977.65.