Every story tagged Denial OF Service, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
5 stories · open in the command center
SnailJob 1.7.0 contains a critical denial of service vulnerability (CVSS 7.1) that allows authenticated users to crash servers through malformed data payloads, potentially causing significant downtime and service disruption for organizations using this job scheduling component. IT leaders must immediately assess whether SnailJob 1.7.0 is deployed in their infrastructure, particularly in systems handling critical batch jobs or task processing, and prioritize upgrading to version 2.0.0 or later to eliminate this unrecoverable memory exhaustion risk. This vulnerability highlights the importance of securing authenticated access controls and implementing robust input validation in serialization/deserialization operations across the enterprise technology stack.
CVE-2026-68494 is a critical denial-of-service vulnerability in Jackson Core (CVSS 8.7) that allows attackers to exhaust JVM heap memory through incomplete number length validation in non-blocking parsers used by reactive frameworks like Spring WebFlux, Quarkus, and Vert.x. Organizations using affected versions (2.15.0-2.18.7, 2.19.0-2.21.3, 2.22.0, and 3.0.0-3.2.0) face heap exhaustion risks when parsing untrusted JSON streams, as attackers can amplify memory consumption by ~20,000x over documented limits through chunked input without terminator bytes. IT organizations must immediately audit reactive Java applications for vulnerable Jackson versions and prioritize upgrades to patched releases to prevent production outages.
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.