CVE-2026-24133 is a high-severity vulnerability in jsPDF versions prior to 4.1.0, caused by improper resource allocation when processing user-supplied image data via the addImage and html methods. Attackers can supply malicious BMP files with extremely large dimensions, leading to excessive memory allocation and resulting in denial of service (DoS) through out-of-memory errors. This vulnerability requires no authentication or user interaction and can be exploited remotely via network access. The issue has been fixed in jsPDF version 4.1.0. European organizations using vulnerable jsPDF versions in web applications or services that accept user-generated PDFs are at risk of service disruption. Mitigation involves upgrading to jsPDF 4.
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01726634; Issue ID: MSV-5728.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service when copying large table containing XML data due to improper allocation of system resources.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query.
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default).
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB are also vulnerable. DCERPC/TCP in the default configuration should not be vulnerable as the default stream depth is limited to 1MiB. Versions 8.0.3 and 7.0.14 contain a patch. Some workarounds are available. For DCERPC/UDP, disable the parser. For DCERPC/TCP, the `stream.reassembly.depth` setting will limit the amount of data that can be buffered. For DCERPC/SMB, the `stream.reassembly.depth` can be used as well, but is set to unlimited by default. Imposing a limit here may lead to loss of visibility in SMB.
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
CVE-2026-24006 is a high-severity vulnerability in the lxsmnsyc seroval library versions prior to 1.4.1. The issue arises from the lack of limits on resource allocation during serialization of deeply nested JavaScript objects, leading to potential stack overflow and denial of service. The vulnerability does not impact confidentiality or integrity but can cause application crashes, affecting availability. Exploitation requires no privileges or user interaction and can be triggered remotely by processing crafted input. The vulnerability was addressed in version 1.4.1 by introducing a depthLimit parameter that throws an error when exceeded. European organizations using vulnerable versions of seroval in their software stacks, especially those handling complex data serialization, are at risk.
CVE-2026-23957 is a high-severity vulnerability in the lxsmnsyc seroval library versions prior to 1.4.1. The flaw arises from the allocation of resources without limits or throttling during the deserialization process when an attacker manipulates encoded array lengths to excessively large values. This causes a significant increase in processing time, leading to a denial-of-service (DoS) condition. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires no authentication or user interaction and can be triggered remotely over the network. The issue has been resolved in version 1.4.1.
CVE-2025-68138 is a medium severity vulnerability in the EVerest libocpp library, a C++ implementation of the Open Charge Point Protocol used in EV charging software. The flaw involves a memory leak caused by failure to free memory allocated by strdup calls during connection attempts. This can lead to memory exhaustion and denial of service on affected systems running libocpp versions prior to 0.30.1. Exploitation requires network access but no authentication or user interaction. The vulnerability impacts availability but not confidentiality or integrity. No known exploits are reported in the wild yet. The issue is fixed in libocpp version 0.30.
CVE-2025-68136 is a high-severity vulnerability in the EVerest everest-core EV charging software stack versions prior to 2025.10.0. The flaw arises from improper resource management when handling SDP requests, where new session objects and TCP sockets are created without closing or destroying previous ones. This leads to resource exhaustion and potential null pointer dereferences, causing denial of service. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires network access but no authentication or user interaction, and the vulnerability has a CVSS score of 7.4. The issue was fixed in version 2025.10.
EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new thread is started for each incoming plain TCP or TLS socket connection before any verification occurs, and the verification performed is too permissive. The EVerest processes and all its modules shut down, affecting all EVSE functionality. This issue is fixed in version 2025.10.0.
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu. Additionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings. Version 1.12.0 patches the issue.
An Allocation of Resources Without Limits or Throttling vulnerability in the ANSL-Server component of B&R Automation Runtime versions prior to 6.5 and prior to R4.93 could be exploited by an unauthenti-cated attacker on the network to win a race condition, resulting in permanent denial-of-service (DoS) conditions on affected devices.
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
CVE-2026-22036 is a medium severity vulnerability in the Node.js HTTP client library undici, affecting versions prior to 6.23.0 and between 7.0.0 and 7.18.2. The flaw arises from an unbounded decompression chain during HTTP response processing, allowing a malicious server to trigger excessive CPU and memory consumption by inserting thousands of compression steps. This resource exhaustion can lead to denial of service without requiring authentication or user interaction.
CVE-2026-0531 is a medium severity vulnerability in Elastic Kibana Fleet involving uncontrolled resource allocation. An attacker with low-level viewer privileges can send specially crafted bulk retrieval requests that cause redundant database operations, leading to excessive memory consumption. This results in a denial-of-service (DoS) condition by crashing the Kibana server and making it unavailable to all users. The vulnerability affects multiple Kibana versions from 7.10.0 through 9.2.0. No user interaction is required beyond possessing viewer-level access, and no known exploits are currently in the wild. The vulnerability impacts availability but does not compromise confidentiality or integrity.