Do Son Jenkins patched nine flaws: a High-severity unauthenticated DoS (CVE-2025-67635) via HTTP CLI and XSS via Coverage Plugin. Build tokens are now encrypted. Update to v2.541 immediately.
dos
A High-severity flaw (CVE-2025-13654) in the Duc disk usage tool risks DoS and information leaks. An integer underflow in buffer.c allows out-of-bounds memory read. Update to v1.4.6 immediately.
A Critical DoS flaw (CVE-2025-66418) in urllib3 allows malicious servers to crash client apps via an unbounded decompression chain. A streaming flaw also risks memory exhaustion. Update to v2.6.0.
NVIDIA patched two high-severity DoS flaws in Triton Inference Server (CVE-2025-33211, CVE-2025-33201). Attackers can crash the server by sending malformed or excessively large payloads. Update to r25.10 immediately.
Apache patched a Critical DoS flaw (CVE-2025-64775) in Struts. The bug causes a temporary file leak during multipart requests, allowing unauthenticated attackers to fill the disk and crash the server. Update now.
A Critical DoS flaw (CVE-2025-65015) in joserfc allows unauthenticated attackers to overwhelm log/SIEM systems by injecting massive JWT payloads into exception messages.
Palo Alto patched a DoS flaw (CVE-2025-4619) in PAN-OS. An unauthenticated attacker can remotely reboot the firewall if URL proxy or decryption policies are enabled.
The Brash exploit leverages a missing rate limit on Chromium's document.title API to trigger a Denial-of-Service attack, crashing browsers in seconds.
Progress patched a High-severity DoS flaw (CVE-2025-10932) in MOVEit Transfer’s AS2 module. The vulnerability allows unauthenticated attackers to exhaust server resources. Patch to v2025.0.3 immediately.
GitLab patched a critical runner hijacking flaw (CVE-2025-11702) allowing authenticated users to compromise CI/CD pipelines, plus three unauthenticated DoS vulnerabilities.
Cisco released updates for its Desk and IP Phone series, fixing a High-severity DoS flaw (CVE-2025-20350) from buffer overflow and a Medium XSS flaw (CVE-2025-20351).
A Critical flaw (CVE-2025-11230) in HAProxy’s mjson number parser allows unauthenticated attackers to cause a Denial of Service with a single crafted JSON payload. Update immediately.
Argo CD patches multiple High-severity DoS flaws. A single unauthenticated webhook request can crash the entire argocd-server process via improper JSON handling.
Rack patches CVE-2025-59830 (CVSS 7.5), a flaw where attackers could use semicolon separators to bypass the parameter count limit and trigger DoS attacks.
GitLab urges immediate upgrade to patch versions 18.4.1+ for high-severity DoS flaws that allowed unauthenticated attackers to crash self-managed instances.
Jenkins has patched multiple flaws, including a high-severity DoS vulnerability in its bundled Jetty server that could allow unauthenticated attackers to crash the service.
A new Linux kernel flaw, CVE-2025-38501, exposes KSMBD servers to unauthenticated remote DoS attacks. A public PoC is available now.
A new vulnerability (CVE-2025-58754) in the Axios library could allow attackers to crash Node.js processes via crafted data: URIs, leading to a denial-of-service.
A high-severity DoS flaw (CVE-2025-8696) in Stork UI allows unauthenticated attackers to crash the server with excessive data, leading to resource exhaustion.
A critical RCE flaw (CVSS 10.0) in the DeepDiff Python library allows for arbitrary code execution via class pollution. A PoC is public, and patching is urgent.
The Envoy Project has patched two new vulnerabilities: a use-after-free bug that can lead to DoS (CVE-2025-54588) and a session-hijacking flaw in its OAuth2 filter.
A new Linux kernel flaw (CVE-2025-38617) in the af_packet subsystem can cause a kernel panic. A PoC has been released, and admins are urged to update patched kernels.