Apache Axis2/Java JSON buffer vulnerability (CVE-2026-120367)
Apache Axis2/Java JSON builders buffered full request bodies without limits, enabling unauthenticated memory exhaustion, fixed in 2.0.2.
Stories per day · 30 days
3 RSS
Relatedapache4zookeeper2aero-theme1axis21client-library1denial-of-service1haproxy1http1.11http21ingress-nginx1java1kubernetes1net-snmp1nms1openwire1ubuntu1unmarshalling1windows1
49 stories, newest first · one card per story
Stories tagged #dos
ingress-nginx CVE-2026-116472 allows self-DOS via Ingress creation
User with Ingress creation permission may cause denial of service or redirect traffic in ingress-nginx.
Net-SNMP SMUX module mishandling allows remote denial of service
Unauthenticated remote attackers can block Net-SNMP indefinitely via the SMUX module.
Apache ActiveMQ NMS OpenWire Client Library DoS via unbounded length fields (CVE-2026-103582)
The .NET OpenWire client before 2.3.0 allows remote denial of service by unvalidated frame sizes in unmarshalling.
Apache ZooKeeper vulnerable to unbounded recursion in snapshot serialization (CVE-2026-115448)
A client can cause the server to become unrecoverable by creating znodes due to no depth limit in recursion.
HAProxy allows denial of service via HTTP/2 PING frames (CVE-2026-110353)
Remote attackers can trigger CPU exhaustion and denial of service in HAProxy servers through malformed HTTP/2 PING frames.
Microsoft Windows Aero Theme DoS vulnerability
ZDI-26-868 rated 4.7; local attackers can trigger denial-of-service after obtaining low-privileged code execution.
CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin
Apache Struts REST plugin reads request bodies without a size limit, enabling memory-exhaustion denial of service.
Citrix NetScaler Targeted Via New Zero Day
Citrix NetScaler zero-day CVE-2026-88779 is under targeted attack and was added to CISA's KEV catalog.
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
Citrix NetScaler zero-day CVE-2026-88779 is exploited in the wild against patched appliances, causing DoS with possible RCE; CISA added it to KEV.
CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow
Authenticated WebDAV clients can crash Apache HTTP Server and corrupt property data via CVE-2026-93546.
CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack
Unauthenticated clients can corrupt Apache Digest authentication state via CVE-2026-73637 under specific settings.
CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies
Apache MINA SSHD SFTP clients can be memory-exhausted by unsolicited replies before 2.20.0 and 3.0.0-M6.
One Packet Can Crash OT Servers in Industrial Sectors
A high-severity TDengine zero-day can crash industrial database servers with one packet.
USN-8840-1: libevent vulnerabilities
Ubuntu patched libevent flaws that could allow remote or local denial of service or code execution.
Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
CVE-2026-77791: Apache Tomcat: DoS via busy wait during WebSocket close
Apache Tomcat WebSocket close handling can busy-wait, enabling denial of service across multiple supported versions.
New Windows Defender zero-day blocks Microsoft antivirus updates
New Windows Defender zero-day exploit BigDiskBuster blocks antivirus updates on all supported Windows versions.
CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate
Apache MINA CompressionFilter allows unbounded zlib inflation, enabling a decompression-amplification denial of service.
USN-8788-1: ClamAV vulnerabilities
ClamAV contains multiple denial-of-service vulnerabilities allowing remote crashes via crafted archive and document files.
Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities
CISA added three exploited Linux kernel flaws to its KEV catalog, ordering federal agencies to patch within three days.
The GNU C Library security advisories update for 2026-09-17
GNU C Library advisory describes a DNS stub resolver assertion failure that aborts processes when search domains reach roughly 200 characters in glibc 2.26-2.44.
ISC Patches 14 Vulnerabilities in BIND 9 Security Update
ISC patched 14 BIND 9 vulnerabilities, seven high-severity, all enabling denial-of-service conditions, with no exploitation observed so far.
2
BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
ISC released BIND 9.20.29 and 9.21.26 fixing 14 flaws, including an unauthenticated DoH crash (CVE-2026-77692) and DNSSEC cache poisoning issues; no exploitation reported.
6