By weakness (CWE)

CWE-400: related vulnerabilities

CVEs classified under CWE-400. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

171 published vulnerabilities · page 1 of 2

• CVE-2026-45169HIGH 8.6

  Idira Privileged Access Manager Self-Hosted Vault contains a flaw in how it validates certain inputs. When specific conditions and configurations align, an attacker can send specially crafted requests over the network that cause the vault service to crash unexpectedly. While the service is down, legitimate users cannot access their privileged credentials, creating a denial-of-service condition. The vulnerability affects multiple older versions of the product, though patches have been released.

• CVE-2026-37234HIGH 8.2

  FlexRIC v2.0.0 contains a resource management flaw in how it handles SCTP (Stream Control Transmission Protocol) connections to the RIC (Radio Interface Controller). An attacker can abuse the E42 setup protocol to register multiple application IDs (xapp_ids) over a single connection. When that connection is closed, only the first registered application's resources are cleaned up; the others remain as orphaned entries in system memory. Over time or through repeated connections, this allows an attacker to accumulate stale subscriptions and exhaust available resources, potentially corrupting the internal state of the intelligent application platform (iApp).

• CVE-2026-46866HIGH 8.2

  A remotely exploitable vulnerability exists in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 that allows attackers without credentials to cause service outages or corrupt data. An attacker with network access can send specially crafted HTTPS requests to trigger either a denial-of-service condition or unauthorized modifications to Enterprise Manager data. No user interaction is required, and the attack can be repeated reliably. This is a high-severity issue that directly impacts service availability and data integrity.

• CVE-2026-35277HIGH 8.1

  Oracle REST Data Services contains a flaw that allows authenticated users with basic network access to read and modify sensitive data they shouldn't be able to access. An attacker with a low-privilege account can exploit this remotely without user interaction, potentially accessing, changing, or deleting critical information across the service. This is a significant risk because it bypasses normal data access controls.

• CVE-2026-35266HIGH 7.9

  Oracle REST Data Services contains a vulnerability that allows an attacker with low-level network access and user credentials to manipulate critical data or disrupt service availability. The attack requires tricking another user into taking action, making it moderately difficult to exploit in practice. Versions 24.2.0 through 26.1.0 are affected. Success can lead to unauthorized access, modification, or deletion of sensitive information, as well as partial service outages.

• CVE-2026-33235HIGH 7.7

  AutoGPT versions before 0.6.52 contain a denial-of-service vulnerability in the Fill Text Template block. An authenticated user can craft computationally expensive expressions that lock up or crash the server, affecting all other users. The vulnerability stems from the platform's failure to enforce CPU and memory limits on template processing, even though it does block dangerous attribute access. This is particularly damaging in shared or self-hosted deployments where one user's action can take down the entire service.

• CVE-2026-9165HIGH 7.7

  Red Hat Advanced Cluster Security for Kubernetes (RHACS) has a vulnerability in its Central management component that fails to restrict the complexity of GraphQL queries. An attacker with valid API credentials can craft extremely nested queries that consume excessive system resources, effectively freezing the management plane and preventing legitimate administrative operations. This is a denial-of-service issue that targets authenticated users—meaning someone with legitimate access, insider threats, or compromised credentials can exploit it.

• CVE-2023-54365HIGH 7.5

  Traefik, a widely-used API gateway and reverse proxy, is vulnerable to a denial-of-service attack that allows remote attackers to disable the service without authentication. The vulnerability stems from how Traefik handles HTTP/2 connections—attackers can rapidly open and close streams to overwhelm server resources. This flaw was inherited from Go's standard HTTP/2 library and affects Traefik versions before 2.10.5 and 3.0.0-beta4. No special privileges or interaction is required; an attacker on the network can trigger the issue simply by sending crafted HTTP/2 requests.

• CVE-2024-14036HIGH 7.5

  Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service flaw affecting hospital networks. An attacker on the same network can send specially crafted, unencrypted discovery messages that force the affected system to consume excessive CPU resources. Once the system is overloaded, it stops processing legitimate discovery messages, disrupting device communication. This requires network access but no authentication.

• CVE-2025-52293HIGH 7.5

  CVE-2025-52293 is a crash vulnerability in GPAC MP4Box v2.4 that occurs when the HEVC video parser encounters malformed video stream headers. An attacker can craft a specially designed HEVC Sequence Parameter Set (SPS) and deliver it to a system running MP4Box to trigger a segmentation fault, causing the application to crash and become unavailable. This is a network-exploitable denial-of-service issue that requires no user interaction or special privileges to trigger.

• CVE-2025-53114HIGH 7.5

  CometD, a web messaging framework used for real-time server-to-client communication, contains a denial-of-service vulnerability in multiple versions. The issue occurs when the server has enabled the acknowledgement extension—a feature that tracks message delivery—and a misbehaving client repeatedly sends the same batch identifier. This causes the server to accumulate unacknowledged messages in memory without ever clearing them, eventually consuming all available heap space and crashing the server. The vulnerability affects versions 5.0.0–5.0.22, 6.0.0–6.0.18, 7.0.0–7.0.18, and 8.0.0–8.0.8. Patches are available for all affected branches.

• CVE-2025-61025HIGH 7.5

  OpenLink Virtuoso Open Source version 7.2.11 contains a vulnerability in its SQL query parsing component (sslr_qst_get) that allows remote attackers to crash the database server without authentication. By sending specially crafted SQL statements over the network, an attacker can trigger a denial of service condition, making the database unavailable to legitimate users. No special privileges or user interaction are required to exploit this flaw.

• CVE-2026-10069HIGH 7.5

  A denial-of-service vulnerability exists in Shibby Tomato 1.28's miniupnpd service that allows unauthenticated attackers to exhaust system resources remotely. The flaw resides in an unspecified function within the UPnP daemon and can be triggered without special privileges or user interaction. While Shibby Tomato is no longer maintained (superseded by FreshTomato), organizations still running this legacy firmware remain at risk.

• CVE-2026-10143HIGH 7.5

  kafka-python versions before 2.3.2 contain a denial-of-service flaw in their SCRAM authentication mechanism. When connecting to a Kafka broker, the client accepts an iteration count from the broker without validation and passes it directly to a cryptographic hashing function. A malicious broker or attacker positioned between client and broker can send an extremely large iteration count, causing the client's event loop to freeze during authentication. This blocks all Kafka operations—producers cannot send messages, consumers cannot poll, admin commands fail, and heartbeats stop. Frozen clients are evicted from consumer groups and enter a cycle of reconnection failures, effectively denying service to applications relying on Kafka.

• CVE-2026-12151HIGH 7.5

  The undici WebSocket client, a widely-used library in Node.js applications, has a vulnerability that allows a malicious or compromised WebSocket server to exhaust memory on the client side. The issue stems from the library's failure to limit the number of WebSocket message fragments—even though each fragment individually respects size limits, an attacker can send hundreds or thousands of small fragments to accumulate unbounded memory usage. This causes the client process to crash due to memory exhaustion, creating a denial-of-service condition. Any application that connects to untrusted WebSocket endpoints is at risk.

• CVE-2026-15308HIGH 7.5

  Python's built-in HTML parser can be forced to consume excessive CPU resources when processing specially crafted HTML containing repeated unterminated markup declarations. An attacker who can submit or inject malicious HTML into an application using Python's html.parser.HTMLParser can trigger a denial-of-service condition, potentially freezing or slowing the affected service. This vulnerability affects the standard library across Python versions and requires no authentication or user interaction to exploit.

• CVE-2026-24012HIGH 7.5

  Apache IoTDB contains a denial-of-service vulnerability in query processing that allows unauthenticated attackers to crash DataNode instances. When submitting queries with extreme parameters—such as a very large time range paired with a minimal aggregation interval—an attacker can force the DataNode to allocate massive amounts of memory, overwhelming the Java heap and terminating the process. No authentication is required to exploit this issue, making it a network-accessible threat to any exposed IoTDB deployment.

• CVE-2026-26307HIGH 7.5

  Gitea, a self-hosted Git service, has a vulnerability in versions before 1.25.5 where git grep searches do not have a timeout limit. An attacker can submit expensive or deliberately complex search queries that cause the server to consume excessive CPU and memory, degrading performance or causing service outages without needing authentication.

• CVE-2026-30041HIGH 7.5

  FastStone Image Viewer version 8.3 contains a flaw in how it processes PSD (Photoshop) files that can be exploited by sending a specially crafted file. This flaw stems from an integer overflow—a programming error where a number calculation exceeds its maximum allowed value—in the image parser. An attacker can leverage this to either crash the application (denial of service) or potentially execute malicious code on the affected system, depending on exploitation techniques.

• CVE-2026-33382HIGH 7.5

  Grafana contains a flaw in its API request handling that allows attackers to send extremely large payloads to certain endpoints without proper size validation. Some of these endpoints don't require authentication, making them accessible to unauthenticated users. When large payloads are processed, the application allocates excessive memory, which can eventually exhaust available system resources and crash the Grafana instance, creating a denial of service condition.

• CVE-2026-34713HIGH 7.5

  CAI Content Credentials, Adobe's tooling for embedding verifiable credential information in digital media, contains a flaw that allows attackers to overwhelm affected systems with resource requests. An attacker can trigger a denial-of-service condition without needing to interact with a user or authenticate first. The vulnerability affects c2pa-web version 0.7.1 and c2pa version 0.80.1 and earlier.

• CVE-2026-36478HIGH 7.5

  Technitium DNS Server versions 14.3 and earlier contain a vulnerability that allows remote attackers to crash the DNS service without authentication. An attacker can send specially crafted requests to the DNS server, causing it to become unavailable and disrupting DNS resolution services for all dependent systems and users. The vulnerability requires no special privileges or user interaction to exploit.

• CVE-2026-38637HIGH 7.5

  A vulnerability exists in relibc's pthread_rwlockattr_setpshared() function that allows remote attackers to crash or disable services by sending specially crafted input. The vulnerability requires no authentication or user interaction, making it accessible to any network-connected attacker. The flaw does not compromise data confidentiality or integrity—it purely disrupts availability.

• CVE-2026-38640HIGH 7.5

  CVE-2026-38640 is a denial-of-service vulnerability in relibc, an open-source C standard library implementation. The issue stems from an unsafe unwrap operation in the assertion failure handler that can be triggered by a maliciously crafted string, causing the application to crash. This is a remote, unauthenticated attack that requires no user interaction, making it a practical threat for services that process untrusted input.

• CVE-2026-39244HIGH 7.5

  The adm-zip library before version 0.5.18 contains a memory exhaustion vulnerability triggered by specially crafted ZIP files. When a malicious ZIP file declares an extremely large uncompressed size in its header—while the actual file is tiny—the library allocates huge amounts of memory without checking whether that size is reasonable. A 120-byte malicious ZIP file can trick the library into attempting to allocate 4GB of memory, crashing the application. This happens automatically during any attempt to read or extract the ZIP file, and occurs before the library can validate the file's integrity.

• CVE-2026-40007HIGH 7.5

  Apache IoTDB has a remotely exploitable denial-of-service flaw in its AirGap receiver component. When the AirGap receiver feature is enabled, an attacker can send specially crafted network messages that trigger unlimited recursive calls within the receiver's thread, eventually crashing the service by exhausting the Java Virtual Machine's stack memory. No authentication is required to exploit this vulnerability.

• CVE-2026-40140HIGH 7.5

  BeyondTrust Remote Support and Privileged Remote Access contain a pre-authentication denial-of-service vulnerability in their network communication layer. An unauthenticated attacker can send specially crafted input to crash or degrade appliance availability without needing valid credentials. The vulnerability stems from insufficient validation of client-supplied data before processing. This affects both products across versions prior to vendor patches.

• CVE-2026-40983HIGH 7.5

  Micrometer, a popular metrics and monitoring library, contains a vulnerability that allows unauthenticated attackers to send specially crafted gRPC requests that overwhelm and crash affected services. An attacker needs only network access to the affected system—no credentials or user interaction required. This is a denial-of-service (DoS) issue affecting specific versions of the library that organizations commonly embed in their Java microservices and cloud-native applications.

• CVE-2026-40984HIGH 7.5

  Micrometer, a popular metrics collection library, contains a vulnerability that allows attackers to trigger denial-of-service conditions by sending specially crafted HTTP requests. An unauthenticated attacker on the network can exploit this weakness to make applications unresponsive or crash. The vulnerability affects multiple versions across the micrometer-core and jetty-specific modules. No authentication or user interaction is required to launch an attack.

• CVE-2026-40988HIGH 7.5

  Spring Security's SAML 2.0 login and logout functionality has a flaw in how it handles compressed SAML messages sent via the REDIRECT binding. An attacker can send a specially crafted compressed payload that, when decompressed by the application, consumes excessive memory and causes the application to become unavailable. This is a denial-of-service attack that requires no authentication and can be triggered remotely by anyone with network access to the affected application.

• CVE-2026-41695HIGH 7.5

  Spring Data Commons, a widely-used Java framework component, contains a denial-of-service vulnerability in how it processes property path strings. An attacker can send specially crafted requests that cause the application to exhaust system resources (CPU, memory) during property resolution, making the service unavailable to legitimate users. This affects versions 3.4.0 through 3.4.14, 3.5.0 through 3.5.11, and 4.0.0 through 4.0.5.

• CVE-2026-41708HIGH 7.5

  Spring Cloud Sleuth versions 3.1.0 through 3.1.13 contain a denial-of-service vulnerability that allows unauthenticated network-based attackers to crash or severely degrade applications. The flaw resides in the transaction instrumentation layer and can be triggered by specially crafted API calls. Organizations using affected versions with Spring TX instrumentation enabled are at risk.

• CVE-2026-41842HIGH 7.5

  Spring Framework versions 5.3 through 7.0 contain a denial-of-service vulnerability in their static resource resolution code. An unauthenticated attacker can craft requests that cause Spring MVC and WebFlux applications to consume excessive resources, potentially rendering the application unavailable. No user interaction is required, and the attack works over the network. The vulnerability affects a wide range of Spring versions released over several years, making it relevant to many production deployments.

• CVE-2026-42127HIGH 7.5

  A vulnerability in Grafana's public dashboard query endpoint allows attackers to crash the service by sending extremely large requests without needing any credentials. The vulnerability stems from missing request size validation, which permits an attacker to force the server to allocate unbounded memory until it runs out of resources. This is a straightforward denial-of-service attack that requires only network access to an exposed Grafana instance.

• CVE-2026-42342HIGH 7.5

  React Router and Remix applications using Framework Mode are vulnerable to a denial-of-service attack via crafted requests that exploit unbounded path expansion in the __manifest endpoint. An unauthenticated attacker can send specially constructed requests that cause the server to consume excessive resources, slowing response times or rendering the application unavailable to legitimate users. This does not affect applications built with Declarative Mode or Data Mode routing patterns.

• CVE-2026-44250HIGH 7.5

  Netty's Redis codec library has a denial-of-service vulnerability where attackers can craft specially formed Redis messages with deeply nested array structures. When processed, these payloads force the affected server to create and hold vast numbers of internal state objects, consuming memory until the application crashes with an OutOfMemoryError. This impacts applications using Netty's Redis protocol handling before specific patch versions.

• CVE-2026-44496HIGH 7.5

  Axios, a widely-used HTTP client library for JavaScript applications, contains a vulnerability in how it processes XSRF (cross-site request forgery) cookie names. When building a security check, the library doesn't properly escape special characters used in regular expressions, allowing an attacker to craft a malicious cookie name that triggers expensive computational operations. In browser environments, this causes the application to freeze or become unresponsive while processing requests. The vulnerability does not affect Node.js server applications, React Native, or web workers. Versions 0.32.0 and later on the 0.x line and 1.16.0 and later on the 1.x line resolve this issue.

• CVE-2026-44890HIGH 7.5

  Netty's Redis codec (the component that reads and interprets Redis protocol messages) has a memory exhaustion vulnerability. An attacker can send malformed Redis messages across many connections to deliberately exhaust the server's direct memory buffer pool, causing an OutOfDirectMemoryError. This denies service to legitimate users. The flaw exists in Netty versions before 4.1.135.Final and 4.2.15.Final, which include fixes.

• CVE-2026-44892HIGH 7.5

  Netty, a widely-used Java framework for building network applications, has a flaw in its HTTP/3 implementation that fails to enforce limits on the size of request headers. An attacker can exploit this by sending an extremely large number of headers, causing the affected application to consume excessive memory and crash. This denial-of-service vulnerability affects versions prior to 4.2.15.Final and has a CVSS score of 7.5 (HIGH). The fix is available in version 4.2.15.Final and later.

• CVE-2026-45357HIGH 7.5

  LiquidJS, a JavaScript template engine compatible with Shopify and GitHub Pages, has a denial-of-service vulnerability in versions 10.25.7 and earlier. The date filter's strftime implementation fails to validate width specifiers (e.g., %5000000d), allowing attackers to craft small templates that generate enormous amounts of output and consume excessive memory and CPU. The vulnerability bypasses built-in resource limits that documentation claims should prevent this type of attack. A single malicious template can trigger out-of-memory crashes or make applications unresponsive.

• CVE-2026-45591HIGH 7.5

  CVE-2026-45591 is a denial-of-service vulnerability in ASP.NET Core that allows attackers on a network to exhaust system resources and crash or degrade application availability. An attacker can send specially crafted requests that consume excessive CPU, memory, or other finite resources without needing to authenticate or interact with users. The vulnerability stems from insufficient input validation or rate-limiting in the framework's request-handling pipeline.

• CVE-2026-45783HIGH 7.5

  A vulnerability in libp2p (a JavaScript networking library) before version 16.2.6 allows any unauthenticated attacker on the network to crash kad-dht nodes running in server mode by flooding them with specially crafted messages. The attacker doesn't need valid credentials or an established connection—they can simply send a stream of PUT_VALUE messages with keys designed to bypass content validation. These messages accumulate on the target node's disk until storage is exhausted, rendering the node unavailable. The attack is trivial to execute and requires no special network position or protocol manipulation beyond crafting the malicious keys.

• CVE-2026-46374HIGH 7.5

  SQLFluff, a widely-used SQL linter and formatter, contains a denial-of-service vulnerability affecting versions prior to 4.2.0. An attacker who can submit SQL queries to an application using SQLFluff's parser can trigger resource exhaustion by crafting an exceptionally long query, causing the service to become unavailable. This risk is most acute in environments where untrusted users have direct access to linting functionality—such as shared development platforms, online SQL validators, or multi-tenant SaaS tools.

• CVE-2026-46385HIGH 7.5

  A vulnerability in the iskorotkov/avro Go library allows an attacker to crash applications processing Avro-encoded data. By sending a specially crafted message that declares an extremely large block of array or map elements (up to 9.2 quintillion), an attacker can force the decoder into a loop that consumes CPU resources indefinitely until the application runs out of memory or is forcibly terminated. The attack requires no authentication and can be triggered over the network with a single malicious payload.

• CVE-2026-46522HIGH 7.5

  ImageMagick, a widely-used image processing library, contains a flaw in its MIFF file decoder that can be triggered by a specially crafted image file. When processed, the vulnerability causes the application to enter an infinite loop, consuming CPU resources until the process is manually stopped or times out. An attacker can exploit this remotely without authentication to degrade or disable image processing services. The vulnerability affects ImageMagick versions prior to 7.1.2.23 (for the 7.x branch) and 6.9.13-48 (for the 6.x branch).

• CVE-2026-46679HIGH 7.5

  A flaw in the @libp2p/gossipsub library allows a single attacker to remotely crash any gossipsub node running the default configuration by exhausting its heap memory. No authentication is required—the attacker needs only network access to the target node. This denial-of-service attack exploits three related implementation gaps that compound to trigger excessive memory allocation. The vulnerability affects libp2p versions prior to 15.0.23 and has been patched.

• CVE-2026-46829HIGH 7.5

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a flaw in the Mongoapi component that allows anyone on the network to crash the service without needing to log in. An attacker can send specially crafted requests over HTTPS to trigger a denial-of-service condition—either a complete hang or repeated crashes—that disrupts availability. No authentication, credentials, or special access is required; the attack works from across the network.

• CVE-2026-46834HIGH 7.5

  A denial-of-service vulnerability exists in Oracle Database Server's Net Service component that allows an unauthenticated attacker on the network to crash or hang the service repeatedly. The attacker needs only network access and can exploit this over TLS without providing credentials or user interaction. The vulnerability affects versions 23.4.0 through 23.26.2 of Oracle Database Server.

• CVE-2026-46835HIGH 7.5

  A flaw in Oracle Database Server's Net Service component allows attackers on the network to remotely crash or hang the service without needing valid credentials. The vulnerability affects versions 23.4.0 through 23.26.2 and is triggered via TLS connections, making it accessible to any attacker with network connectivity to the affected database service.

• CVE-2026-46862HIGH 7.5

  A denial-of-service vulnerability exists in Oracle MySQL Router versions 8.4.0–8.4.9 and 9.0.0–9.7.0. An attacker on the network can send specially crafted TLS traffic to cause the Router service to hang or crash repeatedly, disrupting database connectivity for applications that depend on it. No authentication is required, and the attack can be repeated reliably. The vulnerability does not expose data or allow unauthorized access to databases themselves, but prevents legitimate clients from connecting through the affected Router instance.

• CVE-2026-46863HIGH 7.5

  A vulnerability in Oracle MySQL Server and MySQL Cluster allows an unauthenticated attacker on the network to crash or hang the database service without authentication. The vulnerability affects multiple recent versions across both products and requires only network access—no special configuration or user interaction. Successful exploitation results in a complete denial of service.

• CVE-2026-48619HIGH 7.5

  Node.js has a vulnerability in how it handles HTTP/2 connections where a malicious server can overwhelm a client by sending an excessive number of ORIGIN frames, causing the client process to consume memory until it crashes. This is a denial-of-service flaw that affects all three currently supported Node.js release lines: versions 22, 24, and 26.

• CVE-2026-48779HIGH 7.5

  The ws library, a widely-used WebSocket implementation for Node.js, contains a denial-of-service vulnerability that allows a remote attacker to crash an application by sending a carefully crafted stream of tiny data fragments. Despite the small individual packets, the server allocates internal memory structures for each fragment that far exceed the advertised message-size limits, eventually exhausting available memory and terminating the process. No authentication is required, and the attack traffic is modest, making this a practical threat for exposed WebSocket services.

• CVE-2026-49160HIGH 7.5

  A flaw in how Windows handles HTTP/2 network traffic allows an attacker to overwhelm and crash services by sending specially crafted requests that consume excessive system resources. The attacker does not need credentials or user interaction; they can trigger the problem remotely across a network. This is a denial-of-service vulnerability affecting multiple versions of Windows 10, Windows 11, and Windows Server products.

• CVE-2026-49293HIGH 7.5

  js-toml is a JavaScript library that parses TOML configuration files. Versions up to 1.1.0 contain a performance flaw that allows attackers to freeze your application by submitting specially crafted TOML files with very large hexadecimal, octal, or binary numbers. A malicious actor could submit a ~500 KB hex number that would pin your CPU for roughly 40 seconds—enough to cause a denial of service. Any system accepting TOML uploads or parsing untrusted TOML is at risk.

• CVE-2026-49361HIGH 7.5

  Apache Fluss, a distributed stream processing engine still in incubation at the Apache Software Foundation, contains a critical flaw in how it handles network traffic. Versions 0.8.0 and 0.9.0 allow attackers on the network to send specially crafted data packets that trick the system into consuming massive amounts of memory, causing the service to crash. No authentication is required—an attacker can do this from anywhere on the network without logging in. This is a denial-of-service vulnerability that impacts both the TabletServer and CoordinatorServer components.

• CVE-2026-49842HIGH 7.5

  FreeSWITCH, an open-source telecom platform, contains a flaw in its WebSocket handling that allows unauthenticated attackers to trigger massive outbound data transfers. An attacker can send a specially crafted speed-test protocol message that causes the server to send back approximately 20 GB of data per request, effectively amplifying a small request into a large bandwidth-consuming response. This vulnerability exists before patching and requires no authentication or user interaction—any network-connected FreeSWITCH instance is at risk.

• CVE-2026-49851HIGH 7.5

  Mistune, a popular Python library for converting Markdown to HTML, contains a performance flaw that allows attackers to exhaust server CPU resources with minimal effort. The vulnerability stems from inefficient parsing logic when handling multiple consecutive opening brackets in Markdown input. By sending specially crafted Markdown documents, an attacker can force the parser to consume excessive CPU cycles, potentially causing service degradation or denial of service. This affects Mistune versions prior to 3.3.0.

• CVE-2026-50011HIGH 7.5

  Netty, a widely-used network framework, contains a memory exhaustion vulnerability in its Redis protocol handler. When processing incoming Redis array messages, the framework pre-allocates memory based on a count declared in the message header before validating the actual content. An attacker can send a malicious message claiming an extremely large array size, forcing the application to reserve massive amounts of memory with minimal network traffic. This causes the application to consume excessive RAM and potentially crash, denying service to legitimate users.

• CVE-2026-50193HIGH 7.5

  Jackson-databind, a widely-used Java library for converting JSON to objects and vice versa, has a denial-of-service vulnerability in versions 2.13.0 through 2.13.x. When a service uses the library to read deeply nested JSON structures (thousands of levels deep) and then serializes them back to text, an attacker can exhaust server resources by sending relatively small payloads—for example, 1000 nested arrays consume only 2 kilobytes but trigger expensive processing. The issue is fixed in version 2.14.0 and later.

• CVE-2026-50196HIGH 7.5

  Steeltoe is a framework for building cloud-native applications on .NET, and it includes a service discovery component called Steeltoe.Discovery.Eureka. This component reads service registry information from Eureka servers—a common way microservices find each other. A bug in older versions causes the application to reject a valid service type called 'Netflix' data center, which is legitimately defined in the Eureka specification. When this happens, the registry deserialization fails silently during periodic refresh cycles, leaving your local service registry empty or out of date. This can break service-to-service communication in production environments. Updating to version 4.2.0 (or 3.4.0 for older release lines) fixes the issue.

• CVE-2026-50645HIGH 7.5

  Apache CXF, a popular web services framework, does not limit the number of attachment headers it accepts when processing incoming messages. An attacker can exploit this by sending messages with an extremely large number of attachments, forcing the application to consume excessive memory and CPU resources, resulting in a denial-of-service condition. The vulnerability affects message deserialization—the process of converting data from network format back into usable objects—making it a network-level attack that requires no authentication or user interaction.

• CVE-2026-50750HIGH 7.5

  Apache ActiveMQ has a denial-of-service vulnerability where an unauthenticated attacker can crash the message broker by sending repeated BrokerInfo commands without establishing a proper connection. This flaw emerged as a regression after a fix for an earlier vulnerability, allowing attackers to exhaust server memory until the broker becomes unavailable. The issue affects multiple recent versions of ActiveMQ across 5.19.x and 6.2.x release lines.

• CVE-2026-5079HIGH 7.5

  A vulnerability in the multer file upload library affects versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1. Attackers can craft a single HTTP request with deeply nested field names in form data to trigger excessive CPU and memory consumption, crashing or severely degrading the affected application. The issue stems from the append-field dependency parsing bracket notation without enforcing nesting limits. No user interaction or authentication is required to exploit this.

• CVE-2026-50878HIGH 7.5

  Feuerhamster MailForm version 1.1.0 contains a vulnerability in how it handles file attachments. An attacker can send a specially crafted request to the application that causes it to become unresponsive or crash, denying legitimate users access to the service. No authentication is required to trigger this issue, and it can be exploited over the network.

• CVE-2026-50879HIGH 7.5

  A vulnerability in the uploadPostHandler component of linx-server v2.3.8 allows remote attackers to disrupt service availability by sending specially crafted POST requests. No authentication is required, and the attack can be executed over the network from any location. The vulnerability does not expose sensitive data or enable unauthorized modifications; its primary impact is preventing legitimate users from accessing the service.

• CVE-2026-50882HIGH 7.5

  CVE-2026-50882 is a Denial of Service vulnerability in anna-is-cute paste v0.1.1 affecting the /api/v0/pastes endpoint. An attacker can send a specially crafted POST request to crash or severely degrade the service, rendering it unavailable to legitimate users. No authentication is required, and the attack can be launched over the network from anywhere. The vulnerability does not compromise data confidentiality or integrity—only availability.

• CVE-2026-50889HIGH 7.5

  LLDAP version 0.6.2 contains a vulnerability in how it processes HTTP refresh tokens. An attacker can send a specially crafted refresh-token header that causes the application to stop responding, effectively taking it offline. No authentication is required—anyone with network access can attempt this attack. The vulnerability does not expose data or allow unauthorized access, but it can disrupt service availability.

• CVE-2026-51535HIGH 7.5

  OpENer 2.3.0 contains a resource exhaustion vulnerability in its network message processing loop that allows an unauthenticated attacker to send specially crafted network packets and exhaust server resources, causing a denial of service. An attacker can trigger this flaw from the network without authentication, making it accessible to anyone with network access to an affected system.

• CVE-2026-51600HIGH 7.5

  Tenda CP3 V3.0 devices running firmware V31.1.9.91 contain a flaw in how they process streaming protocol requests. When a malicious or misconfigured client sends an RTSP request (used for media streaming) with a Content-Length header but no actual data following it, the device gets stuck waiting for that data indefinitely. The connection never closes, consuming resources on the device until all available connections are exhausted. An attacker on the network can exploit this without credentials to render the device unresponsive to legitimate requests.

• CVE-2026-52192HIGH 7.5

  CVE-2026-52192 is a remote denial-of-service vulnerability affecting UTT nv518G devices running firmware version nv518GV3v3.2.7-210919-161313. An unauthenticated attacker on the network can trigger a crash or service outage by sending specially crafted requests to the gohead component, rendering the affected device unavailable until manual intervention restores it.

• CVE-2026-52197HIGH 7.5

  A vulnerability in UTT nv518G firmware version 3.2.7-210919-161313 allows attackers on the network to crash or disable the device by sending specially crafted requests to the gohead web component. No authentication is required, and the attack can be performed remotely. This is a denial-of-service flaw that could interrupt service availability for organizations relying on this equipment.

• CVE-2026-53539HIGH 7.5

  Python-Multipart, a popular library for parsing multipart form data in Python applications, contains a performance flaw that allows attackers to cause denial-of-service by sending specially crafted form submissions. When processing form data that uses semicolons as field separators, the parser inefficiently scans the entire remaining buffer for ampersands before falling back to semicolon detection. An attacker exploiting this flaw can send requests with many semicolon-separated fields that cause the parser to consume excessive CPU time, potentially exhausting server resources and degrading service for legitimate users.

• CVE-2026-54268HIGH 7.5

  Angular's date formatting functionality contains a flaw that allows attackers to trigger excessive CPU and memory consumption on applications using the framework. By sending a specially crafted date format string—particularly one with repeating patterns or extreme length—an attacker can cause the application to slow dramatically or become unresponsive. This affects Angular's formatDate function and the widely-used DatePipe component. The vulnerability requires no authentication and can be exploited remotely, making it a practical denial-of-service vector for any internet-facing Angular application that accepts user-influenced date formatting parameters.

• CVE-2026-54399HIGH 7.5

  Apache HttpComponents Core is a widely-used Java library for building HTTP clients and servers. A vulnerability in its HTTP/1.1 message parser allows attackers to crash services or render them unresponsive by flooding them with requests containing unusually large numbers of headers or extremely long header values. The parser consumes memory without adequate limits, leading to exhaustion and denial of service. This affects versions 5.4.2 and earlier, as well as the 5.5-beta1 release.

• CVE-2026-54428HIGH 7.5

  Apache HttpComponents Core, a widely-used Java library for HTTP communication, contains a denial-of-service vulnerability in its HTTP/2 header decompression handler. An attacker can send specially crafted oversized compressed headers to exhaust server memory before the library's safety limits kick in, crashing the service. This affects versions 5.4.2 and earlier, including the 5.5-beta1 release.

• CVE-2026-54772HIGH 7.5

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a flaw that allows unauthenticated attackers to exhaust server resources by triggering improper end-of-file handling during the connection handshake. An attacker can force a server thread to consume 100% CPU per malicious connection, effectively starving legitimate traffic. The vulnerability affects three transport bindings used for inter-process and network communication and requires no authentication or special privileges to exploit.

• CVE-2026-5497HIGH 7.5

  vLLM, an open-source large language model inference engine, contains a denial-of-service vulnerability in how it processes video data. When an attacker sends a specially crafted request containing thousands of JPEG images bundled into a single data URL, the server attempts to decode all of them into memory simultaneously, exhausting available RAM and crashing the service. No authentication is required—the attack works against any exposed vLLM instance running versions 0.8.0 and later. The vulnerability stems from the absence of limits on how many frames the system will process from a single request.

• CVE-2026-55446HIGH 7.5

  Langflow versions prior to 1.0.19 contain a denial-of-service vulnerability in the file upload endpoint. An attacker can submit a specially crafted upload request with an extremely long multipart form boundary—without needing to authenticate—causing the application to become unresponsive and unusable for all legitimate users. The impact persists until the service is restarted or manually recovered.

• CVE-2026-56018HIGH 7.5

  JavaScript::Minifier::XS is a Perl module that compresses JavaScript code. Versions before 0.16 have a memory leak bug: every time the minify() function runs, it fails to properly free memory used for processing tokens. In server environments where minification happens repeatedly—like web asset pipelines or API endpoints that minify on demand—this leak causes the process to consume more memory with each request. Eventually the server runs out of memory and crashes, disrupting service. The vulnerability requires no authentication or user interaction; an attacker can trigger it by simply making repeated minification requests.

• CVE-2026-56248HIGH 7.5

  Capgo versions before 12.128.12 contain a flaw that allows anyone on the internet to crash the application without authentication. The vulnerability exists in how the backend handles access to audit logs through its API. Attackers can repeatedly query a specific endpoint with a publicly available key, causing the database to work so hard that it times out and becomes unresponsive. When this happens under sustained attack, it cascades into failures across the entire application, making legitimate features unavailable to users.

• CVE-2026-57080HIGH 7.5

  Net::BitTorrent, a Perl-based BitTorrent client library, contains a vulnerability that allows any peer in a torrent swarm to crash the downloading application by exhausting its memory. The flaw stems from trusting message-size declarations sent by other peers without validation. An attacker can claim they're sending a massive message (up to 4 GB) and then stream bytes slowly; the vulnerable code keeps buffering data waiting for the promised message to complete, consuming memory until the system runs out. Because BitTorrent swarms are open to any peer, this attack requires no authentication or special access.

• CVE-2026-57081HIGH 7.5

  Net::BitTorrent, a Perl library for BitTorrent protocol handling, contains a memory exhaustion vulnerability affecting versions through 2.1.0. The flaw exists in how the library decodes bencoded data—a binary encoding format used in .torrent files and BitTorrent peer communications. An attacker can craft a specially formatted message with deeply nested structures that forces the decoder into excessive recursion, causing the application to consume gigabytes of memory and crash. A single malicious .torrent file, DHT message, or peer response is sufficient to trigger a denial of service.

• CVE-2026-58210HIGH 7.5

  NATS Server, a widely-used messaging platform for cloud and edge infrastructure, has a vulnerability that allows unauthenticated attackers to trigger a memory exhaustion condition. An attacker can connect to the MQTT interface without credentials and send incomplete connection packets that claim a very large size. The server will hold these packets in memory while waiting for the remainder of the data to arrive, but the attacker never sends it. By opening multiple such connections, an attacker can exhaust the server's available memory, causing the service to become unavailable. This affects NATS Server versions before 2.14.3 and 2.12.12.

• CVE-2026-59879HIGH 7.5

  Immutable.js, a popular JavaScript library for working with immutable data structures, contains a critical flaw in how it handles large array indices and sizes. When developers use certain list operations with indices between roughly 1 billion and 2 billion, the library either freezes indefinitely, consumes all available memory, or silently produces incorrect results. This affects versions before 4.3.9 and 5.1.8. The vulnerability poses a significant availability risk to any application relying on Immutable.js for core data management, particularly those processing user-controlled list operations at scale.

• CVE-2026-59936HIGH 7.5

  A vulnerability in pypdf, a popular open-source Python PDF library, allows an attacker to crash or hang applications that process PDFs. By crafting a malicious PDF with a malformed inline image in the page content, an attacker can trigger an infinite loop when the library tries to extract text or process the page. This causes a denial of service, making the application unresponsive. The flaw affects all versions before 6.14.1 and has been patched in that release.

• CVE-2026-59937HIGH 7.5

  pypdf, a popular open-source Python library for PDF manipulation, contains a denial-of-service vulnerability in versions prior to 6.14.0. An attacker can create a specially crafted PDF file containing repeated malformed cross-reference streams that force pypdf into excessive processing loops while attempting to recover broken table entries. This causes the application to hang or consume CPU resources, effectively denying service to legitimate users. The vulnerability requires no authentication or user interaction—simply opening the malicious PDF triggers the issue.

• CVE-2026-9071HIGH 7.5

  IBM WebSphere Application Server versions 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.6 contain a vulnerability that allows remote attackers to crash or severely degrade server performance by sending specially crafted requests. The vulnerability causes the affected server to consume excessive memory, leading to denial of service. No authentication is required to exploit this issue, and attackers can trigger it over the network.

• CVE-2026-9375HIGH 7.5

  urllib3 2.6.3 contains a flaw that allows remote servers to crash applications by sending specially crafted compressed files. When an application uses urllib3's streaming mode to download data without checking the decompressed size, a malicious server can send a compressed payload that expands into enormous amounts of data in memory, exhausting system resources and causing the application to become unavailable. This affects users of popular Python libraries like `requests` that rely on urllib3 for HTTP communication.

• CVE-2026-9563HIGH 7.5

  Eclipse Parsson, a popular JSON parsing library, contains a denial-of-service vulnerability in versions before 1.1.8. The parser lacks built-in limits on the total number of characters it will consume while processing a single JSON document. An attacker can craft an extremely large JSON payload—whether through massive arrays, deeply nested objects, enormous strings, or other valid JSON structures—that forces affected applications into excessive CPU and memory consumption, effectively freezing or crashing the service. Version 1.1.8 and later introduce a configurable parsing limit (defaulting to 15 million characters) to prevent this attack.

• CVE-2026-9675HIGH 7.5

  Undici is a widely-used WebSocket client library for Node.js. A flaw in versions 8.1.0 through 8.4.0 allows a malicious WebSocket server to exhaust memory on the client by sending many small message fragments. While each individual fragment stays within the configured size limit, the attacker can chain fragments together to accumulate data far beyond what the client should accept, eventually forcing the process to run out of memory and crash. This is a denial-of-service vulnerability that affects any application using undici's WebSocket functionality and connecting to a compromised or attacker-controlled server.

• CVE-2026-46914HIGH 7.1

  A flaw in Oracle Solaris 11.4's filesystem component allows an authenticated user on the local system to read sensitive data or crash the operating system. An attacker with standard user privileges can exploit this without needing to interact with the system graphically—it happens automatically through the vulnerable code path. The vulnerability is rated HIGH severity and poses a real risk to organizations running Solaris infrastructure, particularly those handling sensitive data or requiring high availability.

• CVE-2026-47214HIGH 7.1

  Docling, a document processing library that converts various file formats and integrates with AI systems, contains a vulnerability in its HTML parser that mishandles URIs and file paths. An attacker can exploit this by crafting a malicious document that, when processed by a user, could leak sensitive information or cause the application to become unavailable. The vulnerability affects versions prior to 2.94.0 and requires user interaction to trigger.

• CVE-2019-25721MEDIUM 6.5

  Dräger Infinity M300 wearable patient monitors running software version VG2.3.1 or earlier are vulnerable to network-based denial-of-service attacks. An attacker positioned on the same network can send specially crafted requests that force the device to reboot repeatedly, effectively taking the monitor offline and disrupting patient monitoring. This is a network-adjacent threat that requires no authentication or user interaction to trigger.

• CVE-2019-25724MEDIUM 6.5

  Dräger Infinity M300 wearable patient monitors running software version VG2.x and earlier are vulnerable to a network-based denial-of-service attack that forces repeated device reboots. An attacker positioned on the hospital network or Infinity Network can trigger these reboots until the monitor enters a failed state, requiring manual intervention to restore function. During this attack window, wireless connectivity drops, patient monitoring capability is interrupted, and alarm functions become unavailable—creating a gap in real-time clinical visibility that could delay detection of patient deterioration.

• CVE-2026-11611MEDIUM 6.5

  A memory leak vulnerability exists in 389 Directory Server's Content Synchronization (sync) feature. When an authenticated user initiates a sync request but stops reading the server's responses without properly closing the connection, the server accumulates data in memory indefinitely, eventually consuming all available resources and crashing the service. The vulnerability also introduces race conditions that can trigger crashes during normal connection cleanup or server shutdown.

• CVE-2026-12319MEDIUM 6.5

  A denial-of-service vulnerability in Firefox and Thunderbird's audio and video playback component allows an unauthenticated attacker to crash the application by sending a malicious media file or crafting a specially designed media resource. The attacker needs only to trick a user into opening or viewing the content—no special privileges or complex interaction is required. While this does not expose data or allow unauthorized access, it can disrupt productivity and user experience.

• CVE-2026-12325MEDIUM 6.5

  A denial-of-service vulnerability exists in Firefox and Thunderbird's image processing component. An attacker can craft a malicious image that, when viewed by a user, causes the application to crash or become unresponsive. The vulnerability requires user interaction—specifically, the user must open or view the malicious image—but no special privileges are needed. This is a localized impact issue affecting availability rather than data confidentiality or integrity.

• CVE-2026-27878MEDIUM 6.5

  A vulnerability in Grafana Tempo allows an authenticated user to crash the service by submitting a specially crafted TraceQL query with an extremely large exemplars hint parameter. The Tempo instance will attempt to allocate excessive memory to process the request, eventually running out of memory and becoming unavailable. This is a denial-of-service attack that requires valid credentials to execute.

• CVE-2026-33464MEDIUM 6.5

  Kibana contains a denial-of-service vulnerability that allows low-privileged authenticated users to crash the service by sending an oversized request to an internal API. When exploited, Kibana becomes unresponsive to all users until manually restarted or the process recovers. This is a resource exhaustion attack that requires valid credentials but no special privileges.