CVE-2026-121522

A flaw was found in BuildKit. An attacker who provides a crafted build definition can cause a Denial of Service DoS by crashing the BuildKit daemon. This issue occurs when a build definition resolves metadata for the same Git source reference multiple times, triggering an unhandled panic...

CVE-2025-48997

Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service DoS by sending an upload file request with an empty string field name. This request causes ...

CVE-2026-119299

A flaw was found in gopacket. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending specially crafted Stream Control Transmission Protocol SCTP packets. Due to missing validation of declared chunk lengths and field counts in the SCTP decoder, processing these...

CVE-2026-119279

A flaw was found in MariaDB Connector/J. A malicious or compromised database server, or an attacker intercepting network traffic, can cause a Denial of Service DoS by sending crafted responses containing excessively large length values. Because the connector converts these protocol values into...

CVE-2025-70886

CVE-2025-70886 A Proof of Concept PoC exploit for CVE-2025-70886, a persistent denial-of-service vulnerability in Halo CMS v2.22.4 and earlier that allows remote attackers to crash the admin comment interface by submitting malformed payloads. Basic Information Product Vendor: 凌霞软件 Vendor Website:...

Node_CVE-2023-29017

CVE-2023-29017 | Remote Code Execution via vm2 Sandbox Escape WHS 4th Generation, Class 31 - Kim Geon-woo @gunwoo105 Vulnerability Summary vm2 is a Node.js sandbox library for executing untrusted JavaScript in a restricted environment. Under normal circumstances, code inside the sandbox should no...

CVE-2026-119135

A flaw was found in Wasmtime. This vulnerability allows a guest WebAssembly module to cause a Denial of Service DoS by crashing the host application. When the host reads a component model stream that uses a mismatched internal data type, an assertion failure triggers an unhandled panic instead of...

CVE-2026-119052

A flaw was found in llama.cpp. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a specially crafted request with an excessively large message length to the Remote Procedure Call RPC server. Handling this malformed input triggers an unhandled exception, crashing the...

github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

Undici Vulnerable To Denial Of Service Via Unhandled Exception In The Decompress Interceptor

Impact undici's "decompress" interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw. undici's engine converts a synchronous throw from a downstream handler into a per-request failure, but tha...

github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

Server-side Request Forgery (SSRF)

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the validatetoolresult function in src/mcp/client/session.py, where $ref references in a tool's output schema are resolved against external registries rather than...

EUVD-2026-101959

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake...

qs: qs: Denial of Service via unhandled exception during array serialization

A flaw was found in qs. A remote attacker could cause a Denial of Service DoS by supplying specially crafted input to an application that re-serializes data using the comma array format. Because the library fails to safely handle array elements that cannot be converted to a string, an unhandled...