CWE-400 Uncontrolled Resource Consumption

Docling: Unsafe URI and Path Handling in HTML Backend

containerd: Unpack DoS via repeated opaque whiteouts

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Vikunja: Unbounded CSV row cardinality permits API process termination

Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

Vikunja: Denial of service via decompression bomb in the data import

Duplicate Advisory: Vikunja: Denial of service via decompression bomb in the data import

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Strawberry legacy graphql-ws retains naturally completed subscription slots

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files