Denial of Service
Denial of Service (DoS) vulnerabilities allow attackers to make a system or service unavailable to legitimate users by overwhelming resources or exploiting flaws that cause crashes.
35
MEDIUM
General
Understanding Denial of Service
Detailed information about this vulnerability type.
How to Identify
- •Review security advisories
- •Perform regular security testing
Prevention Best Practices
- ✓Follow security best practices
- ✓Keep systems updated
Denial of Service CVEs (35)
| Description | Vendor / Product | Exploit Status | |||
|---|---|---|---|---|---|
| CVE-2026-23943 | 6.9 | An attacker can exploit this vulnerability to overwhelm a server's memory, causing it to crash and become unavailable, which is known as a Denial of Service (DoS) attack. This can happen before the user is even authenticated, as the server accepts specially crafted compressed data that inflates to a massive size, rapidly consuming resources. | Unknown | Exploit Available | 25 days agoMar 13, 2026 |
| CVE-2025-14769 | 7.5 | An attacker can send specially crafted packets that may crash the system, causing a Denial of Service (DoS) by exploiting a flaw in how certain network rules handle packet data. This issue occurs when the system processes these packets without properly stopping the rules, allowing the traffic to go through even after the necessary data has been removed. | Unknown | Exploit Available | 29 days agoMar 9, 2026 |
| CVE-2018-25172 | 8.8 | This vulnerability allows attackers to run harmful SQL commands on the database without needing to log in, simply by sending specially crafted requests to a specific endpoint. By exploiting this flaw, they can access sensitive information from the database, such as its structure and the names of its tables. | Unknown | Exploit Available | about 1 month agoMar 6, 2026 |
| CVE-2026-29062 | 8.7 | This vulnerability allows an attacker to crash an application by sending a JSON document that is too deeply nested, which can overwhelm the system and cause it to stop working. It affects versions of the jackson-core library from 3.0.0 up to, but not including, 3.1.0, so updating to the latest version is essential to prevent this issue. | fasterxmljackson-core | Theoretical | about 1 month agoMar 6, 2026 |
| CVE-2026-1876 | 8.7 | This vulnerability allows an attacker to crash the Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module by flooding it with UDP packets, causing it to become unresponsive. To recover the device, a system reset is necessary, making it a significant risk for systems relying on this equipment. | Unknown | Exploit Available | about 1 month agoMar 3, 2026 |
| CVE-2026-1875 | 8.7 | This vulnerability allows a remote attacker to crash Mitsubishi Electric's FX5-EIP EtherNet/IP Module by flooding it with UDP packets, leading to a denial-of-service situation where the device stops functioning. To recover, the affected system must be manually reset, making it vulnerable to disruption if targeted. | Unknown | Exploit Available | about 1 month agoMar 3, 2026 |
| CVE-2026-1874 | 8.7 | This vulnerability allows an attacker to crash Mitsubishi Electric's FX5-ENET/IP and FX5-EIP modules by flooding them with UDP packets, leading to a denial-of-service condition. To recover from this, the affected device must be manually reset, making it temporarily unusable during the attack. | Unknown | Exploit Available | about 1 month agoMar 3, 2026 |
| CVE-2026-3304 | 8.7 | An attacker can exploit a flaw in Multer to overwhelm the server by sending poorly formatted requests, leading to a Denial of Service (DoS) that makes the application unavailable. This issue affects versions before 2.1.0, so it's crucial to upgrade to the latest version to prevent this problem. | Unknown | Exploit Available | about 1 month agoFeb 27, 2026 |
| CVE-2026-2359 | 8.7 | An attacker can cause a Denial of Service (DoS) by interrupting a file upload, which can overwhelm the server and make it unable to respond to legitimate requests. This vulnerability affects versions of Multer before 2.1.0, so it's crucial to upgrade to the latest version to protect against this issue. | Unknown | Exploit Available | about 1 month agoFeb 27, 2026 |
| CVE-2025-10990 | 7.5 | An attacker can exploit a flaw in REXML to create specially crafted XML documents that cause the system to slow down or crash, leading to a denial of service. This vulnerability arises when the system processes certain hex character references, and it requires the attacker to send malicious XML data to the affected component. | Unknown | Exploit Available | about 1 month agoFeb 27, 2026 |
| CVE-2026-3118 | 6.5 | An attacker can crash the Red Hat Developer Hub application by sending specially crafted input through API requests, causing a Denial of Service that temporarily locks out all legitimate users. This vulnerability requires the attacker to be an authenticated user, meaning they already have access to the system. | redhatdeveloper hub | Exploit Available | about 1 month agoFeb 25, 2026 |
| CVE-2025-70327 | 9.8 | This vulnerability allows an attacker with access to the device to inject harmful commands into the system's ping utility, which can lead to the device becoming unresponsive or overloaded. The attacker can exploit this by sending specially crafted input that the device does not properly check, making it a serious risk for devices running the affected firmware. | totolinkx5000r firmware | Theoretical | about 1 month agoFeb 23, 2026 |
| CVE-2025-14905 | 7.2 | An attacker can exploit a flaw in the 389-ds-base server to potentially take control of the system or crash it, especially when processing a large number of alias strings. This happens because the server miscalculates memory size, leading to a situation where it can be tricked into running harmful code or becoming unresponsive. | Unknown | Exploit Available | about 1 month agoFeb 23, 2026 |
| CVE-2026-2882 | 7.4 | This vulnerability allows an attacker to remotely execute malicious code on the D-Link DWR-M960 router by exploiting a flaw in its firmware that leads to a stack-based buffer overflow. The attacker needs to manipulate a specific URL parameter, and since the exploit is publicly available, it poses a significant risk to users who haven't updated their devices. | dlinkdwr-m960 firmware | Exploit Available | about 1 month agoFeb 21, 2026 |
| CVE-2025-66676 | 6.2 | This vulnerability allows an attacker to crash the IObit Unlocker software by sending a specially crafted request, which can disrupt its normal operation. To exploit this, the attacker needs to have the ability to send requests to the software, potentially affecting users who rely on it for file management. | Unknown | Exploit Available | about 2 months agoFeb 13, 2026 |
| CVE-2026-2026 | 5.4 | This vulnerability allows an attacker to gain unauthorized access to the Nessus Agent directory on Windows systems, which could lead to Denial of Service (DoS) attacks that disrupt service. It occurs due to weak file permissions, meaning if an attacker can reach that directory, they could exploit it to cause problems. | Unknown | Exploit Available | about 2 months agoFeb 13, 2026 |
| CVE-2025-67433 | 0.0 | An attacker can send a specially crafted DATA packet to the Open TFTP Server, causing it to crash and become unavailable, resulting in a Denial of Service. This vulnerability occurs when the server processes requests and does not handle certain data correctly, but it requires the attacker to have network access to the server. | Unknown | Theoretical | about 2 months agoFeb 12, 2026 |
| CVE-2025-67432 | 7.5 | This vulnerability allows attackers to crash the system by sending specially crafted input to the ZBarcode_Encode function in the MBS DynaPDF Plugin. To exploit this, the attacker needs access to the application using the plugin, which means they could potentially disrupt services for users. | Unknown | Theoretical | about 2 months agoFeb 12, 2026 |
| CVE-2023-43000 | 8.8 | This vulnerability allows an attacker to potentially execute harmful code on a user's device by tricking them into viewing specially crafted web content. It primarily affects users of Safari on specific versions of macOS and iOS, and requires the victim to visit a malicious website for the attack to succeed. | applesafari | Exploit Available | 5 months agoNov 5, 2025 |
| CVE-2025-43424 | 6.5 | An attacker can use a malicious human interface device (like a keyboard or mouse) to crash processes on iPads running specific versions of the operating system. This requires the attacker to physically connect their harmful device to the iPad, making it a localized threat. | appleipados | Exploit Available | 5 months agoNov 4, 2025 |