Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the process is restarted.
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly validated before use. Processing the request causes unbounded memory growth in the Kibana process, which is terminated by the host once available memory is exhausted. Kibana then becomes unavailable to all users until the service is restarted.
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature causes Kibana to perform an unbounded amount of concurrent work. This can exhaust the memory available to the Kibana process and make Kibana unavailable to all users until it is restarted. The severity of the outcome depends on the resources allocated to the deployment; on well-provisioned deployments a single request may cause degraded performance and elevated memory pressure rather than a full outage, but the request is inexpensive to repeat.
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.
A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.
A memory leak vulnerability exists in honojs node-server versions prior to 2.0.10. When a WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header is sent to an upgradeWebSocket route, the IncomingMessage object is retained indefinitely due to a missing cleanup path. This allows an unauthenticated attacker to cause unbounded memory growth and potentially make the service unavailable. The issue is fixed in version 2.0.10.
CVE-2026-42931 is a denial of service vulnerability in the Gitea Open Source Git Server affecting versions from 0 up to and including 1.24. The issue arises from unbounded use of io.ReadAll in the NPM package tag endpoint, which can cause resource exhaustion. This vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily affecting availability.
A denial of service vulnerability exists in rsync daemon versions 2.0.0 through 3.4.4. Unauthenticated remote attackers can exhaust all daemon connection slots by stalling the handshake process either before or after module selection without triggering I/O timeouts. This allows attackers to consume resources and deny service to legitimate clients.
Rsync versions 3.4.2 through 3.4.4 contain a denial of service vulnerability due to unbounded resource allocation. A remote attacker can exploit the --zt option (alias for --compress-threads) to spawn excessive Zstandard worker threads, exhausting system thread and memory resources. This bypasses the refuse options directive's string matching on long option names, allowing the attack to succeed without authentication or user interaction.
CVE-2026-14456 is a vulnerability in OpenSSL's QUIC server implementation introduced in version 3.5. The server allocates resources for new QUIC connections without enforcing limits, allowing an attacker to cause unbounded memory growth by sending many valid Initial packets with unknown connection IDs. This can lead to denial of service by exhausting memory resources. The issue is fixed by introducing a default limit of 256 pending connections, configurable by the application.
CVE-2026-48702 is a high-severity vulnerability in sigstore's Rekor software supply chain transparency log affecting versions from 0.3.0 up to but not including 1.5.2. The vulnerability arises from unbounded decompression of gzip streams in the Package.Unmarshal() function, which can lead to excessive memory consumption and cause the server to crash due to out-of-memory errors. This flaw can be triggered via unauthenticated endpoints by submitting crafted payloads that decompress to very large sizes, bypassing existing size checks. Version 1.5.2 includes a patch that fixes this issue. There is no effective workaround, as limiting request body size only partially mitigates the risk due to the high compression ratio of the attack payloads.
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.