IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap.
IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images.
This release updates to the latest version.
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in all versions up to, and including, 1.6.11.5. This is due to a publicly accessible REST API endpoint (/wp-json/ssa/v1/async) that calls PHP's sleep() function on a user-supplied delay parameter without any rate limiting. This makes it possible for unauthenticated attackers to exhaust PHP worker processes, denying access to the site to legitimate users.
CVE-2026-48593 is a medium severity uncontrolled resource consumption vulnerability in the oban_web component of oban-bg version 2.12.0. It occurs due to unbounded expansion of cron expression ranges in the Elixir.Oban.Web.CronExpr modules. An attacker with permission to schedule cron jobs can submit a maliciously large range, which causes excessive memory allocation when a user with dashboard access views the cron job list.
IBM HTTP Server versions 8.5.0 and 9.0 contain a vulnerability classified as CWE-400 (Uncontrolled Resource Consumption) that can lead to denial of service. This issue arises in configurations where an attacker has write access to parts of the server configuration, potentially allowing them to exhaust server resources. The vulnerability has a high severity rating with a CVSS score of 7.7. No official patch or remediation guidance is currently provided by IBM, and no known exploits are reported in the wild.
A denial of service vulnerability exists in python-markdown due to malformed HTML-like sequences. This issue is tracked as CVE-2025-69534 and affects certain versions of python-markdown used in Red Hat Enterprise Linux 9. The vulnerability can cause the application to become unresponsive or crash when processing crafted input. Red Hat has issued a security advisory and provided updates to address this issue.
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imposes no upper bound on memory consumption in three code paths. First, read_handshake_response/3 accumulates received bytes into a growing buffer with no size cap; the per-receive timeout resets on every chunk, so a server that streams bytes without ever sending \r\n\r\n causes the buffer to grow until memory is exhausted. Second, parse_payload/9 and parse_active_payload/8 do not validate the declared frame payload length against any limit; because RFC 6455 allows payload lengths up to 2^63-1 bytes, a server that announces a very large frame and dribbles bytes causes the accumulation buffer to grow until OOM. Third, the frag_buffer field in #ws_data{} accumulates continuation frames indefinitely; a server that sends an endless stream of non-final (nofin) fragmented frames without ever sending a final (fin) frame grows frag_buffer without bound.
In all three cases the attacker only needs to control the WebSocket server the hackney client connects to, with no authentication or special client configuration required.
This issue affects hackney: from 2.0.0 before 4.0.1.
CVE-2026-47077 is an uncontrolled resource consumption vulnerability in the benoitc hackney HTTP client library. The vulnerability occurs in the HTTP/3 response handling code, where the response body is accumulated in memory without any size limit. A malicious HTTP/3 server can exploit this by sending small chunks indefinitely, causing the client to consume increasing memory until it exhausts the process heap and crashes. This affects hackney version 2.0.0. The vulnerability has a high severity with a CVSS score of 8.2.
Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller.
This issue affects hackney: from 0.10.0 before 4.0.1.
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g.all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service.
AutoGPT versions 0.4.2 through 0.6.51 contain a vulnerability where the download_agent_file endpoint creates temporary files that are not deleted after use. This allows an unauthenticated attacker to repeatedly invoke this endpoint, causing uncontrolled disk space consumption. The resulting exhaustion of disk space can lead to failures in the database or other system services, causing a denial of service that renders the AutoGPT backend unavailable. The issue is fixed in version 0.6.52.
A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.
CVE-2026-44248 is a denial of service vulnerability in Netty's MQTT 5 decoder where the Properties section of the MQTT header is parsed and buffered without applying message size limits. This causes excessive CPU and memory consumption due to repeated parsing and buffering until completion. The issue affects Netty versions prior to 4.2.13.Final and 4.1.133.Final and is fixed in those versions.
Netty versions prior to 4.2.13.Final and 4.1.133.Final contain a vulnerability in HTTP content decompression where the maxAllocation limit is ignored for Brotli (br), Zstandard (zstd), and Snappy content encodings. This allows an attacker to send specially crafted compressed payloads that cause unbounded memory allocation, leading to an out-of-memory denial of service. The issue affects both HTTP/1.x and HTTP/2 decompression components. The vulnerability is fixed in versions 4.2.13.Final and 4.1.133.Final.