A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.
Coraza WAF versions from 3.0.0 up to but not including 3.8.1 have a protection mechanism failure where arguments exceeding the SecArgumentsLimit are silently dropped in some internal processing, while others do not enforce this limit. This allows unauthenticated attackers to bypass WAF rules by flooding requests with excessive arguments, causing some arguments to be omitted before inspection. Additionally, processing of urlencoded and JSON bodies can consume excessive memory, potentially degrading service. The issue is fixed in version 3.8.1.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a vulnerability that can lead to denial of service when inserting data into tables with XML columns under specific conditions. This issue is due to allocation of resources without limits or throttling. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-96618 is a low severity vulnerability in hexpm hex affecting versions from 0.11.2 up to but not including 2.5.2. It involves improper handling of highly compressed data that can lead to excessive memory or disk space consumption when using commands like mix deps.get, mix deps.update, mix hex.package fetch, or mix hex.docs fetch. The vulnerability arises because hex processes untrusted mirrors without limiting the size of compressed or decompressed data, allowing a malicious mirror to cause resource exhaustion. This affects registry, package, docs, and API responses, with some paths lacking size limits or checksum verification. No known exploits are reported, and no official patch information is provided in the input data.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
CVE-2026-87110 is a medium severity vulnerability in MongoDB Ops Manager that allows an unauthenticated network attacker to repeatedly request costly monitoring endpoints without rate limiting. This can cause temporary slowdowns of other traffic served by the same process.
CVE-2026-107885 is a resource-exhaustion vulnerability in OpenPrinting CUPS versions up to 2.4.20. It arises from improper handling of submission timeouts in the cupsdCheckJobs() function. The scheduler suppresses timeout processing for all pending jobs if any client connection has an ongoing Send-Document operation, regardless of job association. This allows a client to hold incomplete HTTP requests, preventing unrelated jobs from timing out. As a result, incomplete jobs can accumulate until the MaxJobs limit is reached, causing denial of service by rejecting new print submissions.
CVE-2026-94440 is a high-severity vulnerability in the Go standard library net/textproto package. It involves allocation of resources without limits or throttling when parsing multipart forms. Specifically, the vulnerability allows bypassing memory limits and reading an arbitrarily long line into memory if the remaining limit at the start of a part is less than 400 bytes. This can lead to excessive memory consumption and potential denial of service.
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3 contain a vulnerability where an authenticated user can cause a denial of service by exploiting improper allocation of system resources via a specially crafted HTTP query. This vulnerability does not impact confidentiality or integrity but can disrupt availability.
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame's protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0.
A resource allocation vulnerability exists in darylldoyle svg-sanitizer versions prior to 1.0.0. The issue arises from a crafted SVG DTD with a #FIXED attribute default that causes a double removal of the same attribute, corrupting libxml state and terminating the PHP worker. This can be exploited by submitting malicious SVG content to degrade or exhaust application availability. The vulnerability is fixed in version 1.0.0.
CVE-2026-107586 is a medium severity vulnerability in Progressive Robot Ltd hMailServer versions 6.2.28 through 6.3.5. It involves uncontrolled eviction in the browser session table of the REST API, allowing a remote authenticated user to forcibly end other users' sessions by filling the session table. This occurs because the session table, shared across all accounts and administrative sessions, evicts the least recently used session when full without limiting the number of sessions per account. The vulnerability can cause denial of service for webmail and administration sessions by repeatedly signing in and filling the session table.
CVE-2026-107585 is a medium severity vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.4 and 6.3.5. It involves uncontrolled eviction in the pending sign-in tables of the REST API, allowing a remote unauthenticated attacker to disrupt other users' OpenID Connect, SAML, and passkey sign-ins. Attackers can repeatedly initiate sign-ins to evict legitimate pending sign-ins, causing denial of single sign-on and passkey authentication for affected users.
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.
CVE-2026-102411 is a resource allocation vulnerability in Elasticsearch where multiple template resources with user-supplied metadata can collectively exhaust heap memory, causing node failure and denial of service. The issue arises because while individual metadata fields have size limits, the total memory used when retrieving multiple such resources together is not limited. This affects Elasticsearch versions 8.0.0 through 8.19.22, 9.0.0 through 9.4.6, and 9.5.0 through 9.5.2. The vulnerability requires the attacker to have the manage_index_templates cluster privilege. The CVSS score is 6.5 (medium severity) with no confidentiality or integrity impact but high availability impact.
Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Service attack.