CWE-404 vulnerabilities

CVE-2026-45090 is a race condition vulnerability in hahwul dalfox versions prior to 2.13.0. The issue arises because two sequential worker stages write to the same results channel, which is closed after the first stage, causing the second stage to write to a closed channel. This triggers a Go runtime panic that crashes the dalfox process. In server mode, this crash can be remotely triggered by unauthenticated callers via the REST API if the default configuration is used without an API key and the attacker supplies POST-body data that is reflected by the target. The vulnerability is fixed in version 2.13.0.

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-8745 is a medium severity vulnerability in Open5GS versions up to 2.7.7. It affects the ogs_timer_add function within the AUSF component, specifically in the /src/ausf/nausf-handler.c library. The vulnerability allows a remote attacker to cause a denial of service by manipulating this function. Although an exploit is publicly available, there are no known exploits in the wild at this time. The Open5GS project has been informed but has not yet responded or provided a patch.

CVE-2026-40136 is a vulnerability in SAP Financial Consolidation (version FINANCE 1010) that allows an authenticated attacker to temporarily disconnect other users by terminating their sessions. This results in a temporary denial of service for those users but does not compromise the application itself. There is no impact on data confidentiality or integrity. The overall impact on availability is low, and the vulnerability has a medium severity rating with a CVSS score of 4.3.

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.21 is able to resolve this issue. Upgrading the affected component is advised. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.

Netmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. This allows any user to repeatedly shut down the server, causing cyclic denial of service with approximately 3-second restart intervals. This issue has been patched in version 1.2.0.

Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.

Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.

Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules). This issue affects KrakenD-CE: before 2.13.1; KrakenD-EE: before 2.12.5.

A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.

An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on Transaction Layer Packet (TLP) ordering and tag uniqueness may allow encrypted packets to be replayed or reordered without detection. This can enable local or physical attackers on the PCIe bus to violate data integrity protections.

CVE-2025-13524 is a medium severity vulnerability in AWS Wickr desktop applications (Windows, macOS, Linux) prior to version 6.62.13. It involves improper resource shutdown during call termination, which may allow a call participant to continue receiving audio input from another user after closing their call window under certain user actions. This issue does not affect confidentiality beyond audio exposure, nor does it impact integrity or availability. AWS has released version 6.62.13 to address this vulnerability.

CVE-2025-36006 is a medium severity vulnerability in IBM Db2 versions 10.5.0 through 12.1.3 that allows an authenticated user to cause a denial of service by improper resource shutdown or release. The flaw arises from the improper handling of resources after use, leading to potential resource exhaustion. Exploitation requires network access with low complexity and no user interaction, but does require authentication. The vulnerability impacts availability without affecting confidentiality or integrity. No known exploits are currently reported in the wild. European organizations using affected IBM Db2 versions should prioritize patching once available and monitor for unusual resource usage patterns.

Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.

When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability allows an unauthenticated attacker to perform a denial-of-service attack by exhausting all available device sessions in the Remote PLC application.

An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability allows an unauthenticated attacker to perform a denial-of-service attack by exhausting all available device sessions of the Click Programming Software.