BIT-TOMCAT-2020-11996

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0 to 10.0.0, 9.0.0 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-034)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-034 advisory. Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happ...

F5 BIG-IP Security Vulnerabilities

F5 BIG-IP is an application delivery platform from F5 Corporation that integrates network traffic management, application security management, load balancing, and other features. A security vulnerability exists in F5 BIG-IP that stems from an undisclosed request that may result in increased CPU...

php: DoS vulnerability when parsing multipart request body

A vulnerability was found in PHP. This security flaw occurs when the request body parsing in PHP allows any unauthenticated attacker to consume a large amount of CPU time and trigger excessive logging. A large amount of CPU time required for processing requests can block all available worker...

GHSA-8R5V-VM4M-4G25 Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

An attacker with an HTTP/2 connection to an affected endpoint can send a steady stream of invalid frames to force the generation of reset frames on the victim endpoint. By closing their recv window, the attacker could then force these resets to be queued in an unbounded fashion, resulting in Out ...

RUSTSEC-2024-0003 Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

An attacker with an HTTP/2 connection to an affected endpoint can send a steady stream of invalid frames to force the generation of reset frames on the victim endpoint. By closing their recv window, the attacker could then force these resets to be queued in an unbounded fashion, resulting in Out ...

PT-2026-20360

Name of the Vulnerable Software and Affected Versions zlib versions prior to 1.3.2 Description The software contains an issue where CPU consumption can occur through the crc32 combine64 and crc32 combine gen64 functions. This is due to the x2nmodp function potentially performing right shifts with...

Algorithmic Complexity

Overview PeterO.Cbor is a C implementation of Concise Binary Object Representation CBOR. Affected versions of this package are vulnerable to Algorithmic Complexity due to use of an inefficient algorithm in the DecodeFromBytes or other decoding mechanisms. An attacker can cause a denial of service...

GitLab 10.7 < 15.1.5 / 15.2 < 15.2.3 / 15.3 < 15.3.1 (CVE-2022-2908)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1...

Default configuration

Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions...

GHSA-HRFV-MQP8-Q5RW Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

Werkzeug multipart data parser needs to find a boundary that may be between consecutive chunks. That's why parsing is based on looking for newline characters. Unfortunately, code looking for partial boundary in the buffer is written inefficiently, so if we upload a file that starts with CR or LF...

UBUNTU-CVE-2023-5632

In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS resulting in a MsQuic server application or process crash. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other...

CVE-2023-20259

A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could impact access to the web-based management interface and cause delays with call processing. This API is not used for devic...

Cisco Multiple Product Security Vulnerabilities

Cisco Unity Connection UC and others are products of Cisco USA.Cisco Unity Connection is a voice messaging platform.Cisco Unified Communications Manager CUCM, Unified CM. Cisco Unified Communications Manager CUCM, Unified CM, CallManager is a call processing component of a unified communications...

wfshell.exe consumes high CPU

While the ICA session is closed, Citrix WinFrame Shell wfshell.exe process doesn't exit. This process consumes high CPU in Task Manager...

High CPU utilization on the WEM Server

Norskale Broker Service.exe 1912 utilizes High CPU...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. The vulnerability exists when stripping EXIF data from specific images, leading to high CPU usage and an application crash...

Google Golang Resource Management Error Vulnerability

Google Golang is a static, strongly typed, compiled language from Google.The syntax of Go is close to C, but with differences in variable declarations.Go supports garbage collection.Go's parallel model is based on Tony Hall's Communicating Sequential Processes CSP, and other languages with a...

Important: kernel

Issue Overview: An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with certain traffic patterns. CVE-2023-1206 Affected Packages: kernel Issue Correction: Run dnf update kernel --releasever 2023.1.20230629 or dnf update --advisory...