By weakness (CWE)

CWE-770: related vulnerabilities

CVEs classified under CWE-770. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

87 published vulnerabilities

• CVE-2025-7737HIGH 8.6

  A denial-of-service vulnerability exists in the 10G iSCSI interface component of multiple Hitachi Virtual Storage Platform models. An unauthenticated attacker on the network can trigger a condition that exhausts system resources, causing the iSCSI interface to become unavailable and disrupting storage access for dependent systems. No authentication is required, and the vulnerability can be triggered with minimal complexity, making it relatively straightforward to exploit once network access to the iSCSI interface is established.

• CVE-2026-44697HIGH 8.6

  Klever-Go versions prior to 1.7.17 contain a remote denial-of-service flaw that allows any network participant to crash validator nodes by sending a single, small network message (under 50 KB). The vulnerable code mishandles decompression of batched data, causing the receiving node to allocate multiple gigabytes of memory unexpectedly, leading to out-of-memory crashes. Because validators are critical to blockchain operation, an attacker can disrupt the entire Klever network's ability to process transactions and reach consensus. The attack requires no authentication and can be executed from any peer on the network.

• CVE-2026-28299HIGH 8.2

  SolarWinds Web Help Desk contains a denial-of-service vulnerability that allows attackers to crash the server by exhausting memory resources. No authentication or user interaction is required—an attacker on the network can trigger this condition remotely, making it straightforward to exploit. While the vulnerability does not expose sensitive data or allow unauthorized changes to the system, the ability to take down your help desk platform creates immediate business disruption.

• CVE-2026-56324HIGH 8.2

  Capgo versions prior to 12.128.2 contain a vulnerability that bypasses rate limits on the channel_self endpoint. An attacker can exploit this by repeatedly changing a device identifier (device_id) to send numerous requests in quick succession—effectively circumventing the API's built-in protections against abuse. This allows them to flood the database with entries and exhaust resources, potentially degrading or disrupting service availability.

• CVE-2023-54365HIGH 7.5

  Traefik, a widely-used API gateway and reverse proxy, is vulnerable to a denial-of-service attack that allows remote attackers to disable the service without authentication. The vulnerability stems from how Traefik handles HTTP/2 connections—attackers can rapidly open and close streams to overwhelm server resources. This flaw was inherited from Go's standard HTTP/2 library and affects Traefik versions before 2.10.5 and 3.0.0-beta4. No special privileges or interaction is required; an attacker on the network can trigger the issue simply by sending crafted HTTP/2 requests.

• CVE-2025-46638HIGH 7.5

  Dell BSAFE SSL-J contains a resource exhaustion vulnerability that allows an unauthenticated attacker on the network to overwhelm the application by allocating unbounded resources without limits or throttling mechanisms. This causes a denial of service condition, rendering the service unavailable to legitimate users. No authentication is required to trigger the flaw, making it accessible to any remote attacker.

• CVE-2025-61028HIGH 7.5

  OpenLink Virtuoso Open Source version 7.2.11 contains a vulnerability in its time_t_to_dt component that allows remote attackers to crash the database server by sending specially crafted SQL statements. No authentication is required to trigger the issue, and successful exploitation results in a denial of service condition affecting database availability.

• CVE-2026-12151HIGH 7.5

  The undici WebSocket client, a widely-used library in Node.js applications, has a vulnerability that allows a malicious or compromised WebSocket server to exhaust memory on the client side. The issue stems from the library's failure to limit the number of WebSocket message fragments—even though each fragment individually respects size limits, an attacker can send hundreds or thousands of small fragments to accumulate unbounded memory usage. This causes the client process to crash due to memory exhaustion, creating a denial-of-service condition. Any application that connects to untrusted WebSocket endpoints is at risk.

• CVE-2026-34077HIGH 7.5

  React Router versions 7.7.0 through 7.13.1 contain a client-side Cross-Site Scripting (XSS) vulnerability when using the unstable React Server Components (RSC) APIs. If an application accepts redirect parameters from untrusted sources and processes them through React Router's RSC redirect handling, an attacker could inject malicious scripts that execute in users' browsers. The vulnerability does not affect applications that do not use the unstable RSC APIs. Shopify's React Router package released patch version 7.13.2 to address this issue.

• CVE-2026-40983HIGH 7.5

  Micrometer, a popular metrics and monitoring library, contains a vulnerability that allows unauthenticated attackers to send specially crafted gRPC requests that overwhelm and crash affected services. An attacker needs only network access to the affected system—no credentials or user interaction required. This is a denial-of-service (DoS) issue affecting specific versions of the library that organizations commonly embed in their Java microservices and cloud-native applications.

• CVE-2026-40984HIGH 7.5

  Micrometer, a popular metrics collection library, contains a vulnerability that allows attackers to trigger denial-of-service conditions by sending specially crafted HTTP requests. An unauthenticated attacker on the network can exploit this weakness to make applications unresponsive or crash. The vulnerability affects multiple versions across the micrometer-core and jetty-specific modules. No authentication or user interaction is required to launch an attack.

• CVE-2026-41007HIGH 7.5

  Spring HATEOAS, a widely used library for building REST APIs with hypermedia support, contains a denial-of-service vulnerability stemming from an unbound cache. Attackers can exploit this by sending specially crafted requests that cause the application to accumulate StringLinkRelation objects indefinitely, eventually exhausting memory and crashing the service. The vulnerability affects multiple versions across the 1.5, 2.3, 2.4, 2.5, and 3.0 release lines.

• CVE-2026-41716HIGH 7.5

  Spring Data Commons contains a vulnerability in how it caches internal property lookups. An attacker can exploit this by sending specially crafted requests that cause the cache to store attacker-controlled strings as permanent cache keys. Because these keys are never cleaned up, repeated requests will gradually consume all available heap memory, eventually crashing the application. This is a denial-of-service attack that requires no authentication and can be triggered from the network.

• CVE-2026-42127HIGH 7.5

  A vulnerability in Grafana's public dashboard query endpoint allows attackers to crash the service by sending extremely large requests without needing any credentials. The vulnerability stems from missing request size validation, which permits an attacker to force the server to allocate unbounded memory until it runs out of resources. This is a straightforward denial-of-service attack that requires only network access to an exposed Grafana instance.

• CVE-2026-42570HIGH 7.5

  Svelte devalue is a widely-used JavaScript library for serializing complex data structures. Versions 5.6.3 through 5.8.0 contain a flaw in the deserialization function (devalue.parse) that allows an attacker to trigger excessive memory allocation by sending specially crafted sparse array payloads. Depending on JavaScript engine implementation quirks, this can exhaust available memory and crash applications that depend on devalue. The issue does not affect confidentiality or integrity—only availability. It has been resolved in version 5.8.1.

• CVE-2026-44250HIGH 7.5

  Netty's Redis codec library has a denial-of-service vulnerability where attackers can craft specially formed Redis messages with deeply nested array structures. When processed, these payloads force the affected server to create and hold vast numbers of internal state objects, consuming memory until the application crashes with an OutOfMemoryError. This impacts applications using Netty's Redis protocol handling before specific patch versions.

• CVE-2026-44488HIGH 7.5

  Axios, a widely-used HTTP client library for JavaScript applications, contains a vulnerability in versions 1.7.0 through 1.15.x that bypasses size limits when using the fetch adapter. When developers configure maxContentLength or maxBodyLength to restrict how much data can be sent or received, those limits are ignored if the fetch adapter is active. An attacker or compromised server can exploit this to send oversized responses that exhaust application resources, or an application forwarding untrusted request bodies may inadvertently process larger payloads than intended. The vulnerability is resolved in Axios 0.32.0 and 1.16.0.

• CVE-2026-44890HIGH 7.5

  Netty's Redis codec (the component that reads and interprets Redis protocol messages) has a memory exhaustion vulnerability. An attacker can send malformed Redis messages across many connections to deliberately exhaust the server's direct memory buffer pool, causing an OutOfDirectMemoryError. This denies service to legitimate users. The flaw exists in Netty versions before 4.1.135.Final and 4.2.15.Final, which include fixes.

• CVE-2026-45290HIGH 7.5

  Cloudburst Network is a library used by many projects to handle networking tasks. A flaw in versions before 1.0.0.CR3-20260417.085727-30 allows attackers on the network to crash the core event loop that handles network communications, making affected applications unresponsive. Any software using the vulnerable Cloudburst Network library should upgrade immediately; there is no safe workaround.

• CVE-2026-45416HIGH 7.5

  Netty, a widely-used Java framework for building network applications, contains a memory exhaustion vulnerability in its TLS handshake handler. When processing incoming TLS ClientHello messages, the framework can be tricked into allocating extremely large buffers—up to 16 megabytes or more—without proper validation. An attacker sending specially crafted TLS requests can exhaust server memory and cause denial of service. The issue affects Netty versions before 4.1.135.Final and 4.2.15.Final and is most dangerous when the framework is used with common SNI (Server Name Indication) handler configurations that disable safeguards by default.

• CVE-2026-45591HIGH 7.5

  CVE-2026-45591 is a denial-of-service vulnerability in ASP.NET Core that allows attackers on a network to exhaust system resources and crash or degrade application availability. An attacker can send specially crafted requests that consume excessive CPU, memory, or other finite resources without needing to authenticate or interact with users. The vulnerability stems from insufficient input validation or rate-limiting in the framework's request-handling pipeline.

• CVE-2026-46340HIGH 7.5

  Netty is a widely-used Java framework for building networked applications. A flaw in the SCTP (Stream Control Transmission Protocol) transport component allows a remote attacker to exhaust a server's memory by sending fragmented messages that never complete. Rather than consolidating fragments efficiently, the code creates an exponentially deeper chain of buffer wrappers for each new piece, and there's no limit on how many fragments or how many separate data streams an attacker can use. This lets someone crash or severely degrade a Netty-based SCTP server with relatively small amounts of traffic.

• CVE-2026-46599HIGH 7.5

  CVE-2026-46599 is a denial-of-service vulnerability in TIFF image decoders that affects how they handle PackBits-compressed image data. An attacker can craft a specially-designed image file that appears small on disk but, when decoded, forces the decoder to expand and process far larger amounts of data than expected. This resource exhaustion can crash applications or services that attempt to process the malicious image, making it a practical availability threat in environments that automatically process untrusted images.

• CVE-2026-46673HIGH 7.5

  Russh, a Rust-based SSH library used for building secure communication clients and servers, contains a critical memory management flaw in its CryptoVec component—a cryptographic buffer used internally for sensitive data. The vulnerability stems from unsafe buffer operations that don't properly validate size calculations before allocating or locking memory. Depending on the version, local SSH agents or remote attackers could exploit this by sending malformed frame lengths that trigger uncontrolled memory growth, leading to denial of service. The flaw has been fixed in version 0.60.3.

• CVE-2026-46702HIGH 7.5

  Russh, a Rust-based SSH client and server library, contains a vulnerability affecting versions 0.34.0 through 0.61.0 that allows attackers to cause denial-of-service by exploiting SSH compression. When compression is enabled, the library fails to properly validate the decompressed size of packets, allowing an attacker to send compressed data that passes initial size checks but expands to excessively large packets after decompression. This exhausts server resources and disrupts availability. The vulnerability is patched in version 0.61.1.

• CVE-2026-47774HIGH 7.5

  Envoy, a widely-deployed HTTP/2 proxy for cloud applications, contains a memory exhaustion vulnerability that allows attackers to crash the service without authentication. The flaw stems from inadequate header size validation: cookie headers bypass size checks, and compressed header blocks can decompress to enormous sizes that aren't capped. An attacker can exploit this combination to force Envoy to allocate excessive memory, triggering out-of-memory errors and service downtime. Affected versions are older than 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

• CVE-2026-48510HIGH 7.5

  MessagePack for C# has a denial-of-service vulnerability in how it handles compressed data. When decompressing LZ4-compressed payloads, the library allocates memory based on a size value claimed by the incoming data before checking whether that claim is legitimate. An attacker can send a small malicious file that declares itself to be enormous, forcing the application to reserve huge amounts of memory. This exhausts system resources and crashes the service. The flaw affects versions before 2.5.301 and 3.1.7, and patches are now available.

• CVE-2026-48514HIGH 7.5

  MessagePack for C# contains a vulnerability in its deserialization logic that allows an attacker to trigger excessive memory allocation with minimal network traffic. When deserializing specially crafted MessagePack data, the library reads a size value from the data stream and allocates memory for an array without properly validating that the claimed size matches the actual available data. An attacker can send a tiny payload claiming to contain a massive array, forcing the application to allocate gigabytes of RAM—potentially exhausting system resources and causing the application to crash.

• CVE-2026-48515HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a denial-of-service vulnerability in how they deserialize multi-dimensional arrays. When processing serialized data, the library allocates memory for arrays based on dimension sizes claimed in the payload before checking whether those dimensions are consistent with the actual array data. An attacker can craft a small malicious message that declares enormous array dimensions, triggering a massive memory allocation on the target system even though the message contains little actual data. This causes the application to consume excessive heap memory and can crash the service.

• CVE-2026-48748HIGH 7.5

  Netty, a widely-used Java framework for building network applications, contains a vulnerability in its HTTP/3 codec that can be exploited to exhaust server memory. An attacker can trigger the creation of an unlimited number of blocked streams, causing the affected application to run out of memory and crash. This denial-of-service condition requires no authentication and can be triggered remotely over the network. Netty versions prior to 4.2.15.Final are vulnerable.

• CVE-2026-48779HIGH 7.5

  The ws library, a widely-used WebSocket implementation for Node.js, contains a denial-of-service vulnerability that allows a remote attacker to crash an application by sending a carefully crafted stream of tiny data fragments. Despite the small individual packets, the server allocates internal memory structures for each fragment that far exceed the advertised message-size limits, eventually exhausting available memory and terminating the process. No authentication is required, and the attack traffic is modest, making this a practical threat for exposed WebSocket services.

• CVE-2026-49361HIGH 7.5

  Apache Fluss, a distributed stream processing engine still in incubation at the Apache Software Foundation, contains a critical flaw in how it handles network traffic. Versions 0.8.0 and 0.9.0 allow attackers on the network to send specially crafted data packets that trick the system into consuming massive amounts of memory, causing the service to crash. No authentication is required—an attacker can do this from anywhere on the network without logging in. This is a denial-of-service vulnerability that impacts both the TabletServer and CoordinatorServer components.

• CVE-2026-49851HIGH 7.5

  Mistune, a popular Python library for converting Markdown to HTML, contains a performance flaw that allows attackers to exhaust server CPU resources with minimal effort. The vulnerability stems from inefficient parsing logic when handling multiple consecutive opening brackets in Markdown input. By sending specially crafted Markdown documents, an attacker can force the parser to consume excessive CPU cycles, potentially causing service degradation or denial of service. This affects Mistune versions prior to 3.3.0.

• CVE-2026-50011HIGH 7.5

  Netty, a widely-used network framework, contains a memory exhaustion vulnerability in its Redis protocol handler. When processing incoming Redis array messages, the framework pre-allocates memory based on a count declared in the message header before validating the actual content. An attacker can send a malicious message claiming an extremely large array size, forcing the application to reserve massive amounts of memory with minimal network traffic. This causes the application to consume excessive RAM and potentially crash, denying service to legitimate users.

• CVE-2026-53460HIGH 7.5

  ImageMagick, a widely-used open-source image processing library, contains a flaw that allows an attacker to crash applications or services using it by triggering excessive memory allocation. When processing specially crafted image requests, the software fails to validate whether memory requests are reasonable before attempting to fulfill them, leading to out-of-memory conditions. An attacker can exploit this remotely without authentication to deny service to legitimate users.

• CVE-2026-54273HIGH 7.5

  AIOHTTP, a popular Python framework for handling asynchronous web requests, has a flaw in how it manages incoming HTTP requests. Before version 3.14.1, the system did not limit how many requests could be queued up at once. An attacker can exploit this by sending many requests in rapid succession, causing the application to consume excessive memory until it crashes or becomes unresponsive. This is a denial-of-service vulnerability that affects applications relying on older versions of AIOHTTP.

• CVE-2026-54274HIGH 7.5

  AIOHTTP, a popular Python framework for building asynchronous web applications, has a flaw in how it handles websocket connections. An attacker can send specially crafted incomplete websocket frames that are larger than normal to consume excessive memory on the server, potentially causing the application to become unresponsive or crash. This is a denial-of-service issue affecting versions before 3.14.1.

• CVE-2026-54277HIGH 7.5

  AIOHTTP, a widely-used Python framework for building asynchronous HTTP applications, contains a flaw in its C-optimized parser that allows attackers to send HTTP requests with oversized lines that bypass size restrictions. This can cause the parser to consume excessive memory, potentially crashing the service or rendering it unresponsive. The vulnerability affects versions before 3.14.1 when using the default pre-built C parser implementation.

• CVE-2026-54283HIGH 7.5

  Starlette, a popular lightweight Python web framework, has a vulnerability in how it handles form submissions. When developers configure size limits to protect their applications from being overwhelmed by large requests, those limits fail to work for one common type of form submission (URL-encoded forms). An attacker can exploit this by sending an extremely large or complex form to crash or degrade the application's performance, even when administrators thought they had protective limits in place. The issue affects versions 0.4.1 through 1.3.0 and is fixed in version 1.3.1.

• CVE-2026-54297HIGH 7.5

  Faraday, a popular Ruby HTTP client library, contains a denial-of-service vulnerability in its default query parameter parser. When an application accepts and processes user-supplied query strings through Faraday, an attacker can craft a deeply nested parameter structure that exhausts the Ruby interpreter's call stack, crashing the thread or worker handling that request. This affects Faraday versions 1.0.0 through 1.10.5 and 2.x through 2.14.2. The vulnerability has been patched in versions 1.10.6 and 2.14.3.

• CVE-2026-5497HIGH 7.5

  vLLM, an open-source large language model inference engine, contains a denial-of-service vulnerability in how it processes video data. When an attacker sends a specially crafted request containing thousands of JPEG images bundled into a single data URL, the server attempts to decode all of them into memory simultaneously, exhausting available RAM and crashing the service. No authentication is required—the attack works against any exposed vLLM instance running versions 0.8.0 and later. The vulnerability stems from the absence of limits on how many frames the system will process from a single request.

• CVE-2026-7250HIGH 7.5

  GitLab Community Edition and Enterprise Edition contain a vulnerability that allows unauthenticated attackers to disrupt service availability. The issue stems from insufficient validation of API requests in the request parsing middleware. An attacker can send specially crafted requests to trigger a denial-of-service condition without needing authentication or user interaction. This affects multiple version lines, but patches have been released.

• CVE-2026-9675HIGH 7.5

  Undici is a widely-used WebSocket client library for Node.js. A flaw in versions 8.1.0 through 8.4.0 allows a malicious WebSocket server to exhaust memory on the client by sending many small message fragments. While each individual fragment stays within the configured size limit, the attacker can chain fragments together to accumulate data far beyond what the client should accept, eventually forcing the process to run out of memory and crash. This is a denial-of-service vulnerability that affects any application using undici's WebSocket functionality and connecting to a compromised or attacker-controlled server.

• CVE-2024-54178MEDIUM 6.5

  IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data contain a resource allocation flaw that allows authenticated users to trigger a denial of service condition when creating new databases. An attacker with valid credentials can exhaust system resources during database creation, making the service unavailable to legitimate users. This is not a remote unauthenticated attack—the threat actor must first obtain valid authentication credentials.

• CVE-2026-12760MEDIUM 6.5

  The Tapo C200 v3 camera contains a flaw in how it processes fragmented network traffic that allows an attacker on the same local network to disable the device temporarily. By sending specially crafted packets, an attacker can consume excessive resources on the camera, causing it to stop responding and interrupting video monitoring and recording. No authentication or user interaction is required—the attacker simply needs network adjacency to the device.

• CVE-2026-1500MEDIUM 6.5

  GitLab CE and EE are vulnerable to a denial-of-service attack that can be triggered by authenticated users uploading specially crafted files. When an attacker sends a malicious file, the affected GitLab instance consumes excessive system resources (CPU, memory, disk I/O) without proper limits, potentially making the service unavailable to legitimate users. The vulnerability requires valid login credentials but no special user privileges to exploit.

• CVE-2026-24720MEDIUM 6.5

  File Station 6, a QNAP file management product, contains a resource exhaustion vulnerability that allows authenticated users to consume system resources without limits, potentially starving other applications and processes of critical resources. An attacker with valid credentials could trigger conditions that degrade or block access for legitimate users and services on the same system.

• CVE-2026-36499MEDIUM 6.5

  Open vSwitch v3.6.90 contains a flaw that allows someone with write access to its configuration database to cause the software to allocate an unreasonably large number of worker threads. By requesting more threads than the system can handle, an attacker can exhaust memory and CPU resources, effectively shutting down the switch. The vulnerability requires existing database access, limiting the immediate threat surface, but represents a significant availability risk in environments where OVSDB write permissions are not tightly controlled.

• CVE-2026-39904MEDIUM 6.5

  Gophish version 0.12.1 and earlier contains a denial of service vulnerability accessible to authenticated users with the User role. An attacker can upload a specially crafted Office document as an email template attachment that tricks the server into decompressing a massive file in memory, ultimately crashing the service. This works because the application doesn't limit how much an Office document (which is really a ZIP file) can expand when unpacked.

• CVE-2026-41726MEDIUM 6.5

  Spring for Apache Kafka applications that have enabled DelegatingDeserializer are vulnerable to a resource exhaustion attack where an authenticated attacker can send specially crafted Kafka messages containing random header values. The application will consume increasing amounts of heap memory without releasing it, eventually exhausting available memory and causing the application to crash or become unresponsive.

• CVE-2026-46551MEDIUM 6.5

  NocoDB, a spreadsheet-like database builder, contains a flaw in how it handles file uploads from remote URLs. Authenticated editors and above can trick the server into downloading extremely large files without respecting size limits, which can fill up the disk and crash the service. The vulnerability exists in versions prior to 2026.04.4 and stems from the attachment API not validating remote file sizes before initiating downloads.

• CVE-2026-53522MEDIUM 6.5

  Nezha Monitoring, a self-hosted server monitoring tool, contains a resource exhaustion vulnerability in versions 1.0.0 through 2.1.x. Two API endpoints that establish persistent WebSocket connections to monitored servers fail to implement any limits on how many concurrent connections a single authenticated user can create. An attacker with valid credentials can repeatedly call these endpoints to exhaust server memory and crash the monitoring dashboard, disrupting visibility into your infrastructure.

• CVE-2026-54024MEDIUM 6.5

  LibreChat, a ChatGPT alternative supporting multiple AI providers, contains a file upload vulnerability in its conversation import endpoint. An authenticated user can upload arbitrarily large files to the server, consuming disk space and memory until the service becomes unavailable. This occurs because the import endpoint uses a separate file upload handler that wasn't updated when size limits were added elsewhere in the application, and the default configuration leaves the size check disabled. The vulnerability affects versions prior to 0.8.4-rc1.

• CVE-2026-54037MEDIUM 6.5

  LibreChat, an open-source ChatGPT alternative that integrates multiple AI providers, contains a rate-limiting bypass vulnerability. A previous security fix (CVE-2025-7105) added protections to one conversation-duplication endpoint, but an identical endpoint was overlooked. Authenticated users can exploit the unprotected endpoint to trigger the same resource-exhaustive operations, circumventing the earlier mitigation and potentially causing denial of service.

• CVE-2026-54448MEDIUM 6.5

  Trivy, a widely-used container and artifact security scanner, contains a denial-of-service vulnerability in its Helm chart processing logic. When Trivy scans a malicious Helm chart archive (.tgz file), it decompresses the contents without enforcing memory limits, allowing an attacker to craft a small file that expands to gigabytes in memory. This causes the Trivy process to consume excessive RAM and be killed by the operating system, disrupting security scanning operations. The vulnerability affects versions prior to 0.71.0 and requires the attacker to have the ability to place a malicious .tgz file where Trivy will scan it.

• CVE-2026-8683MEDIUM 6.5

  Mattermost Desktop App versions 6.1 and earlier contain a denial-of-service vulnerability that allows a malicious server owner to crash the application by injecting a script that attempts to open an extremely long URL. The flaw stems from insufficient validation of URL length before passing it to the browser's window.open function, causing the application to fail ungracefully when processing the oversized input.

• CVE-2026-41710MEDIUM 5.9

  Spring Retry, a popular Java retry library used across enterprise applications, contains a vulnerability that allows attackers to disable the retry and circuit-breaker mechanisms that applications depend on for resilience. By sending many crafted requests designed to fail, an attacker can fill the application's retry cache until it stops accepting new entries. Once saturated, the cache becomes permanently unable to process any further retries or circuit-breaker decisions, effectively breaking the fault-tolerance layer of affected applications.

• CVE-2026-40990MEDIUM 5.7

  A resource exhaustion flaw exists in Spring Cloud Function that allows an attacker to trigger out-of-memory (OOM) errors by registering an excessive number of functions in the Function Registry. The vulnerability requires local or adjacent network access and user interaction, making it a medium-severity concern primarily affecting development and hybrid deployment environments. Multiple versions across Spring Cloud Function 3.2 through 5.0 are vulnerable.

• CVE-2026-48187MEDIUM 5.7

  OTRS has a vulnerability in its email handling system that allows authenticated users to trigger excessive resource allocation on the web server, potentially causing it to crash or become unresponsive. An attacker with valid login credentials can exploit this through user interaction to exhaust server resources, resulting in denial of service. This is not a critical vulnerability but poses a meaningful availability risk to organizations relying on OTRS for ticketing operations.

• CVE-2026-28237MEDIUM 5.5

  AMD uProf, a performance profiling tool used by developers and system administrators, contains a flaw in how it allocates system resources. An authenticated local user can trigger excessive resource consumption—such as memory or CPU—causing the application or system to become unresponsive or crash. This is a localized availability issue that does not expose data or allow privilege escalation, but it can disrupt legitimate work on affected machines.

• CVE-2026-45078MEDIUM 5.5

  Synapse, an open-source Matrix homeserver, contains a denial-of-service vulnerability affecting versions prior to 1.152.1. An authenticated local user can craft requests that consume excessive CPU resources, starving other legitimate requests and causing service degradation for other users. The attack requires valid credentials and local system access but does not require user interaction.

• CVE-2026-48735MEDIUM 5.5

  pypdf, a popular open-source Python library for PDF processing, contains a memory exhaustion flaw that allows attackers to craft malicious PDF files triggering excessive memory consumption. The issue stems from how the library parses XMP (Extensible Metadata Platform) metadata within PDFs—an attacker can embed large or unnecessarily complex metadata structures that force the parser to allocate abnormal amounts of RAM. This can degrade system performance or crash applications relying on pypdf to process untrusted PDF documents. The vulnerability affects versions prior to 6.12.1.

• CVE-2026-45023MEDIUM 5.4

  AutoGPT versions before 0.6.59 contain a flaw in their API implementation that allows authenticated users to execute workflow blocks without consuming credits from their account balance. The vulnerability stems from an API endpoint that bypasses the credit-checking logic present elsewhere in the system, enabling users to run unlimited blocks at no cost. This is a business model violation rather than a critical system compromise, but it undermines the platform's monetization and resource management controls.

• CVE-2026-10740MEDIUM 5.3

  AWS's s2n-quic library contains a memory management flaw in its QUIC protocol handler that can be triggered by specially crafted network packets. An unauthenticated attacker can exploit this remotely to degrade service availability by exhausting server memory, without needing credentials or user interaction. The vulnerability affects versions before 1.8.2.

• CVE-2026-40211MEDIUM 5.3

  CVE-2026-40211 is a denial-of-service vulnerability affecting DNS over HTTP/3 (DoH3) implementations. An attacker can craft malicious DoH3 queries that trigger an exception in the server, causing a buffer to remain in memory longer than intended. While the buffer is eventually freed when the QUIC connection closes, an attacker with the ability to open many concurrent DoH3 streams could exhaust server memory and force a denial of service. This is a network-accessible vulnerability requiring no authentication or user interaction.

• CVE-2026-40898MEDIUM 5.3

  quic-go, a Go-based QUIC protocol library, contains a denial-of-service flaw in its HTTP/3 implementation that allows remote attackers to exhaust server and client memory by sending malicious HTTP trailer fields. The vulnerability stems from inadequate validation of decoded trailer sizes—the library checks the compressed frame size but fails to enforce limits on the decompressed result. An attacker can craft QPACK-encoded headers with numerous unique field names or oversized values in the trailer section, forcing unbounded memory allocation and potentially crashing affected services.

• CVE-2026-41851MEDIUM 5.3

  Spring Framework contains a vulnerability in how it handles Spring Expression Language (SpEL) expressions when applications allow user input to be evaluated as SpEL code. An attacker can craft specially designed expressions that cause the framework's internal cache to grow without bounds, consuming memory until the application becomes unresponsive or crashes. This is a denial-of-service (DoS) condition that requires no authentication and can be triggered remotely.

• CVE-2026-44545MEDIUM 5.3

  Daphne, a popular ASGI application server for Django, contains a configuration flaw that leaves WebSocket connections vulnerable to denial-of-service attacks. Versions before 4.2.2 fail to enforce limits on WebSocket message and frame sizes, allowing unauthenticated attackers to send extremely large messages that consume server memory until the application becomes unresponsive. This occurs because Daphne does not pass payload size constraints to the underlying Autobahn WebSocket library, which defaults to unlimited sizes.

• CVE-2026-45031MEDIUM 5.3

  ImageMagick, a widely-used open-source image processing tool, contains a vulnerability in its PSD (Photoshop) file decoder that allows an attacker to circumvent resource limits designed to prevent denial-of-service attacks. By crafting a malicious PSD file, an attacker can cause excessive resource consumption during image decoding, potentially disrupting services that rely on ImageMagick to process untrusted image uploads. The vulnerability affects versions prior to 6.9.13-47 and 7.1.2-22, and patches are now available.

• CVE-2026-45292MEDIUM 5.3

  OpenTelemetry Java is a popular library used by applications to record performance and diagnostic data. This vulnerability affects how it processes baggage—metadata that flows across service calls in distributed systems. An attacker can send oversized baggage that causes affected services to consume excessive memory and CPU, leading to denial of service. Because baggage is automatically forwarded to downstream services, the impact spreads beyond the initial target, potentially degrading performance across your entire microservices architecture.

• CVE-2026-45352MEDIUM 5.3

  cpp-httplib, a popular C++ HTTP library, contains a flaw in how it processes chunked HTTP transfers. When a malicious client sends a specially crafted HTTP request with a negative chunk size (like '-2'), the library's parsing logic mishandles it. Instead of rejecting the invalid value, it converts it to an extremely large number due to how C's strtoul function treats negative numbers. This causes the server to attempt allocating massive amounts of memory and reading far more data than expected, ultimately crashing the process. Applications using cpp-httplib versions before 0.43.4 are vulnerable.

• CVE-2026-45554MEDIUM 5.3

  NiceGUI, a Python UI framework built on FastAPI, contains a vulnerability in how it handles requests for static assets. Two specific routes can be manipulated to point to directories instead of files. When this happens, the framework throws an error that gets logged with full technical details—and these routes don't require authentication. An attacker can repeatedly trigger these errors to flood the server logs, potentially filling up disk space or overwhelming logging infrastructure. This affects NiceGUI versions before 3.12.0 and has been fixed in version 3.12.0 and later.

• CVE-2026-45664MEDIUM 5.3

  ImageMagick, a widely-used tool for image processing and manipulation, has a vulnerability in its MNG (Multiple-Image Network Graphics) file handler that allows an attacker to bypass resource limits. By crafting a malicious MNG file with more images than the system's policy allows, an attacker can trigger excessive resource consumption—potentially causing performance degradation or denial of service. The vulnerability affects ImageMagick versions before 6.9.13-47 and 7.1.2-22, and has been resolved in those patch versions.

• CVE-2026-48990MEDIUM 5.3

  joserfc, a Python library for handling JSON Web Signatures and Encryption, has a flaw in how it processes unencoded JWS payloads (a feature defined in RFC7797). The library correctly enforces maximum payload size limits for standard JWS formats, but bypasses those same limits when processing JWS tokens marked with b64=false, which signals unencoded payloads. An attacker can exploit this inconsistency by sending an oversized JWS token that passes validation despite exceeding configured size restrictions, potentially exhausting server memory and causing denial of service. The vulnerability affects versions 1.3.4 through 1.6.5 and is resolved in version 1.6.7.

• CVE-2026-49955MEDIUM 5.3

  Hermes WebUI versions before 0.51.270 have a flaw that lets anyone on the internet repeatedly trigger authentication challenges without actually completing the login process. By flooding the authentication endpoint with requests, attackers can exhaust server resources—filling up disk space, consuming CPU cycles, and degrading service availability for legitimate users. No authentication is required to exploit this vulnerability.

• CVE-2026-50560MEDIUM 5.3

  Netty, a widely-used Java framework for building network servers and clients, has a flaw in how it handles HTTP/2 header size limits. When a client specifies a maximum header list size via the HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE parameter, Netty can be forced into a state where it crashes while attempting to send response headers back to the client. An attacker can exploit this to repeatedly trigger these crashes, effectively denying service to legitimate users—similar in impact to the HTTP/2 Rapid Reset attack but using different network-level mechanics. The vulnerability affects Netty versions before 4.1.135.Final and 4.2.15.Final.

• CVE-2026-50589MEDIUM 5.3

  OpenStack Ironic versions 32 through 36 contain a vulnerability that allows unauthenticated attackers to crash the service by sending specially crafted JSON payloads to certain API and JSON-RPC endpoints. An attacker requires only network access to the affected service and no credentials—they can disrupt availability without gaining deeper system access. The vulnerability was patched in version 37.0.0.

• CVE-2026-54270MEDIUM 5.3

  protobufjs, a popular JavaScript library for working with Protocol Buffers, has a memory exhaustion vulnerability in versions 8.2.0 through 8.4.2. When decoding untrusted protobuf messages, the library automatically stores unknown fields in memory without providing a way to discard them at decode time. An attacker can craft a malicious protobuf payload with many unknown fields that forces the decoded message to consume far more memory than the payload's raw size would suggest, potentially causing denial of service through resource exhaustion. The vulnerability affects applications that decode protobuf data from untrusted sources, particularly those handling user-supplied or network-sourced messages. Version 8.5.0 introduced options to control unknown-field retention, and version 8.6.2 made discarding unknown fields the default behavior.

• CVE-2026-54285MEDIUM 5.3

  OpenTelemetry's JavaScript implementation has a memory exhaustion vulnerability in its baggage header parsing logic. When the library processes inbound HTTP headers containing baggage data, it fails to validate the size of that data. An attacker can send abnormally large or numerous baggage entries, causing the application to allocate memory without limits, potentially degrading performance or crashing the service. The vulnerability exists only in the inbound parsing path; outbound validation was already in place. Version 2.8.0 and later address this issue.

• CVE-2026-55205MEDIUM 5.3

  Hermes WebUI versions before 0.51.468 contain a flaw in an unauthenticated login-flow endpoint that fails to limit how many simultaneous requests it processes. An attacker can repeatedly hit this endpoint to flood the server with memory-consuming state objects and worker threads, eventually exhausting available resources and causing the service to become slow or unresponsive. The endpoint also triggers outbound device-code requests to upstream OAuth providers, so repeated exploitation can trigger cascading load on those services as well.

• CVE-2026-45682MEDIUM 5.1

  OpenTelemetry's eBPF Instrumentation agent for Java contains a memory leak in its TLS connection state tracking. When Java applications handle repeated connection churn (connections opening and closing), the instrumentation fails to properly clean up its internal tracking queue, causing heap memory to grow indefinitely until the application runs out of memory and crashes. This affects long-running production JVMs where connection pools are regularly recycled. The issue is resolved in version 0.9.0.

• CVE-2026-10533MEDIUM 5.0

  A vulnerability in OpenShift Container Platform allows non-privileged users to circumvent resource quota enforcement by creating pods with a never-restart policy. These pods and their associated Kubernetes events are not counted against quota limits, enabling an attacker to flood the cluster's event database (etcd) with activity. The resulting accumulation degrades API server performance across the entire cluster, affecting all users and workloads.

• CVE-2026-49324MEDIUM 4.6

  A vulnerability in the Wireless Control Module of the 2025 Indian Motorcycle Scout Bobber + Tech allows someone with access to the bike's internal network to permanently disable it. By sending a small number of specially crafted wireless messages, an attacker can trigger a lockout on the motorcycle's immobilizer system—the security mechanism that prevents unauthorized starting. Unlike typical lockouts that reset when you power cycle the device, this one persists even after restarting the bike, leaving owners unable to start their motorcycle until they visit a dealer for service.

• CVE-2026-49140MEDIUM 4.3

  Nanobot versions before 0.2.1 have a denial-of-service flaw in how they handle media downloads from Matrix chat rooms. An authenticated user in a room can deliberately send specially crafted media events with missing or wrong size information, causing the system to download large files without properly checking their declared sizes first. By sending many of these malicious requests at once, an attacker can force the Nanobot process to consume excessive memory and bandwidth until the service becomes slow or unresponsive. The attacker must already be a member of the room to exploit this.

• CVE-2026-49337MEDIUM 4.3

  libde265, an open-source H.265 video decoder library, contains a memory management flaw that allows attackers to trigger unbounded memory growth on a victim's system. By sending a specially crafted sequence of video data packets, an attacker can cause the decoder to accumulate slice header data in memory without ever releasing it. This happens during normal video playback and can eventually exhaust available memory (denial of service). The vulnerability requires user interaction—someone must open or play a malicious video file—but does not require any special privileges or network access beyond the ability to deliver the crafted video.

• CVE-2026-53781MEDIUM 4.3

  Summarize, a podcast and media management CLI tool, contains a vulnerability that allows attackers to exhaust a system's disk space. If you use Summarize before version 0.17.0, an attacker who controls a podcast feed or media URL can force the application to download an extremely large (or infinite) file to your disk. The vulnerability exists because Summarize doesn't properly validate file sizes when the server doesn't send proper size headers or uses certain types of data streaming. This can render your system unusable by filling up its storage.

• CVE-2026-56255MEDIUM 4.3

  Capgo versions before 12.128.2 contain a denial of service flaw in the demo application creation endpoint. An authenticated user with organization write permissions can abuse this endpoint to repeatedly create demo applications without any rate limiting. Each request triggers approximately 138 database operations, which can degrade system performance, inflate operational costs, and potentially cause service instability for all users.