CWE-772 Missing Release of Resource after Effective Lifetime

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

undici vulnerable to Denial of Service via orphaned RetryHandler response body

Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

Netty epoll transport denial of service via RST on half-closed TCP connection

opentelemetry-go's Schema ParseFile leaks file descriptors on each parse

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

Wasmtime: Memory leak in C API with `externref` and `anyref` types

Netty: Unix-socket fd receive leaks descriptors when peer sends two at once

Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

Multer vulnerable to Denial of Service via resource exhaustion

Eclipse Vert.x vulnerable to a memory leak in TCP servers

Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion

Hackney fails to properly release HTTP connections to the pool

NiceGUI has Redis connection leak via tab storage causes service degradation

thread-amount Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS

Pleezer resource exhaustion through uncollected hook script processes

golang.org/x/text/language Denial of service via crafted Accept-Language header