ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malformed syslog packets.
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1.
request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.
Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling, allowing repeated requests to deny service or cause container restart loops. This issue is fixed in version 3.0.0.
CVE-2026-61544 is a high-severity vulnerability in the rust-libp2p implementation of the libp2p networking stack. Versions prior to 0.13.1 of libp2p-quic can panic during an inbound QUIC handshake if a remote peer presents a valid short-lived TLS certificate that expires before the final TLS 1.3 handshake fragment is received. This causes an uncaught exception due to a repeated certificate validity check, leading to application termination for affected listeners. The issue is fixed in version 0.13.1.
A vulnerability in the asteval Python expression evaluator prior to version 1.0.9 allows certain BaseException subclasses (BaseException, SystemExit, KeyboardInterrupt, GeneratorExit) raised by attacker-controlled expressions to bypass the interpreter's safety handlers. This can cause the consuming application to terminate unexpectedly or disrupt signal and cleanup handling, resulting in denial of service. The issue is fixed in version 1.0.9.
ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_list server-side allow-list in self._sort_fields. The value is resolved with getattr and passed to relationship joins and order_by, allowing requests to sort by columns hidden from column_list and by related-model columns through dotted paths. The resulting row order forms an information-exposure oracle for unexposed values, and reversing ascending and descending order confirms their relative ordering. Pairing sortBy with searchable or filterable columns and pagination can narrow the oracle toward specific values, but exact recovery depends on the application's available fields and data. This issue is fixed in version 0.27.1.
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify calls TrieProofNode::child_index in primitives/src/trie/trie_proof_node.rs, where is_prefix_of accepts equal keys and KeyNibbles::get is called at the key length, returns None, and is unconditionally unwrapped. Untrusted ResponseChunk data reaches commit_chunks, put_chunk, and proof.verify before cryptographic proof validation, so the attacker does not need a valid proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync, and the resulting panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.
CVE-2026-89090 is a vulnerability in the AWS SDK for Go v2 prior to release 2026-03-23. It involves an uncaught panic in the event stream header decoder that can be triggered by a crafted event stream response frame with an invalid header value type. This can cause the consuming application process to terminate unexpectedly. The issue is fixed in version 2026-03-23.
CVE-2026-69839 is a vulnerability in Microsoft Windows 10 Version 1607 and related versions where an uncaught exception in the Windows iSCSI Target Service can be triggered by an authorized attacker to cause a denial of service over the network. The issue affects multiple Windows versions and has been assigned a CVSS v3.1 score of 6.5, indicating a medium severity impact. Microsoft has released official fixes for all affected versions.
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, resulting in an uncaught exception that terminates the server process. This is possible because incoming wire protocol BSON validation does not enforce that array element field names are valid, in-range numeric indices.
Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.
A vulnerability in the ljharb qs library causes qs.stringify to throw a TypeError when serializing objects whose own constructor property has a truthy but non-callable isBuffer member. This occurs because the isBuffer check calls obj.constructor.isBuffer without verifying it is a function. The issue affects versions from 2.2.5 up to but not including 6.16.0 and was fixed in version 6.16.0. An attacker can craft input that triggers this error, causing synchronous exceptions during serialization. In typical Node.js HTTP frameworks, this results in a 500 error response without crashing the process, but in some cases, such as async handlers or background jobs without error boundaries, it can cause process termination.
CVE-2026-81517 is a high-severity vulnerability in the MongoDB BI Connector (mongosqld) where an unauthenticated attacker can cause the service to terminate by exhausting the storage used for logging. When the log storage is full, subsequent log write or rotation failures trigger an unhandled exception that crashes the mongosqld process, disrupting service for all connected SQL clients. The process continues to fail on startup until storage is restored, and no diagnostic message is recorded to explain the failure.
ALOS HTTP, a Go web framework and application server, has a vulnerability where a malformed request path starting with a question mark can cause an out-of-bounds panic. This occurs because the code accesses an array element without checking if the array is empty, leading to server process termination. The issue is fixed in version 0.0.0-20260617230736-314b6783e196.
Starlette-Admin versions prior to 0.16.1 have a vulnerability where the list API does not properly validate user-supplied order_by and structured where field names against allowed sortable and searchable fields. This allows authenticated users with access to list endpoints to bypass UI restrictions and sort or filter on unintended fields, causing limited exposure of sensitive information. Additionally, malformed field names can cause unhandled exceptions and HTTP 500 errors, resulting in limited denial of service. The issue is fixed in version 0.16.1.
Faktory versions prior to 1.10.0 are vulnerable to an unauthenticated denial of service caused by an uncaught exception. Sending a malformed command without the expected payload triggers a Go runtime panic that crashes the entire server process, disconnecting all clients and workers. The vulnerability requires only a connection and a trivial handshake, with no credentials needed if no password is configured. This issue is fixed in version 1.10.0.
Tie::Hash::Regex versions before 2.0.0 for Perl throw exceptions when lookup keys are malformed regular expressions. The FETCH, EXISTS, and DELETE methods compile keys as regex patterns without eval guards, causing the application to die on invalid keys such as unmatched brackets. This affects applications that use externally supplied strings as keys in tied hashes.