CWE-770
CVEs classified under CWE-770, newest first.
1172 CVEsRSS
CVE-2026-64646High· 7.5next: Next.js: Denial of Service via excessive memory consumption in Server Actions (CVE-2026-64646)
A flaw was found in Next.js. An attacker sending specially crafted requests to a Next.js application utilizing the App Router with Server Actions configured to use the Edge runtime can cause excessive memory consumption. This can lead to a…
GHSA-6vch-q96h-7gc3Highetcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
GHSA-7ppr-r889-mcf2High· 7.5blaze: Unbounded WebSocket message aggregation in http4s-blaze-server
blaze: Unbounded WebSocket message aggregation in http4s-blaze-server
GHSA-fp43-vj7g-pg92High· 7.5OmniFaces: Forged combined-resource IDs and related output/push boundaries
OmniFaces: Forged combined-resource IDs and related output/push boundaries
CVE-2026-16756High· 7.5Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
CVE-2026-44907High· 7.5react-server-dom: Denial of Service in Server Functions
react-server-dom: Denial of Service in Server Functions
CVE-2026-55575HighLiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
GHSA-4w2j-m93h-cj5jHigh· 7.5Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
GHSA-rvhp-75f6-9jqhLow· 3.3ImageMagick: Policy Bypass possible with matrix-backed operations
ImageMagick: Policy Bypass possible with matrix-backed operations
CVE-2026-14257High· 7.5brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) b…
CVE-2026-25800High· 7.5quinn: Quinn: Remote memory exhaustion via malformed QUIC stream fragments (CVE-2026-25800)
A flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in t…
CVE-2026-32665High· 7.5unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC client length (CVE-2026-32665)
A flaw was found in Unbound when DNS-over-QUIC (DoQ) is enabled. An attacker could exploit improper validation of client-provided data length, leading to excessive memory allocation. This can cause the system to exceed its configured memor…
CVE-2026-59942MediumDompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
CVE-2026-47013Medium· 5.3Vulnerability in Oracle Java SE (component: JavaFX)
Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compro…
CVE-2026-55851High· 7.5io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851)
A flaw was found in Netty's codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a…
CVE-2026-56816High· 7.5io.netty:netty-codec-http3: Netty: Denial of Service due to uncontrolled memory buffering in HTTP/3 (CVE-2026-56816)
A flaw was found in Netty. An unauthenticated remote attacker can exploit a vulnerability in Netty's `Http3FrameCodec` by sending specially crafted HTTP/3 reserved frames with excessive payload lengths. This can lead to uncontrolled memory…
GHSA-r7wm-3cxj-wff9Highjackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
GHSA-hrxh-6v49-42gfHighgRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
GHSA-9mqv-5hh9-4cggMedium· 5.3Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
CVE-2026-59763MediumGitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
CVE-2026-42931Medium· 6.5Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
CVE-2026-15588Medium· 5.3PoCA denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib
A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticat…
CVE-2026-55831High· 7.5io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831)
A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing…
CVE-2026-50651High· 7.5Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
GHSA-f283-ghqc-fg79Medium· 5.3Guzzle: Unbounded response cookies risk denial of service
Guzzle: Unbounded response cookies risk denial of service
GHSA-jqh4-m9w3-8hp9MediumAxios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
GHSA-pmv8-rq9r-6j72MediumAxios: Deep formToJSON Key Recursion Can Cause Denial of Service
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
CVE-2025-71396Medium· 6.5⚖ disputedSurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or -…
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or -…
CVE-2026-50274High· 7.5github.com/DataDog/dd-trace-go: Datadog dd-trace-go: Denial of Service via malicious baggage headers (CVE-2026-50274)
A flaw was found in Datadog dd-trace-go, a Go client library. A remote, unauthenticated attacker can exploit this vulnerability by sending a request with a specially crafted baggage header containing an arbitrarily large number of key-valu…
CVE-2026-44891High· 7.5io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder (CVE-2026-44891)
A flaw was found in Netty, a network application framework, specifically within the StompSubframeDecoder component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a large number of small headers. …