Security incidents tagged DoS. Newest first.
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
UnrealIRCd released 6.2.7.1 and a no-restart hot-patch (bundle-20261107) on Nov 7 2026 fixing 9 security issues found in an AI-assisted internal audit. The critical one, CVE-2026-114713, is in the labeled-response module, which does not escape the IRCv3 "label" message tag when echoing it into replies; on a network with two or more linked servers any ordinary user can inject server-to-server commands that run with server or IRCOp authority (KILL, GLINE and more). Maintainer Syzop calls it the most critical issue found in UnrealIRCd in the past 15 years. The other 8 fixes cover two IP-address leaks (including "decloaking" another user), a blacklist-recheck hang, a user-triggerable crash on CHGIDENT from Services, a counting error that can lock out all new connections with "This server is full", no cap on how many bans Services can set (now 2x set::maxbans), a TLS renegotiation flood issue and a possible whowasdb crash. UnrealIRCd 5 (end of life since 2023) is also affected by the critical bug. Apply the SPAMFILTER workaround first, then hot-patch or upgrade.
UnrealIRCdSince Nov 7, 2026
LINE's Armeria 1.43.0 security release patches three High issues published Nov 6 2026: GHSA-xqhm-4ph4-423v / CVE-2026-121823 lets attackers bypass path-scoped decorators (for example decoratorUnder("/admin", auth)) by inserting a '.' path segment that FileService, TomcatService and JettyService still resolve; GHSA-2pfv-5p52-crjm / CVE-2026-121824 lets a reachable Thrift endpoint allocate attacker-controlled heap from malformed TBinary/TCompact length fields before the body is verified; and GHSA-6hgp-j5h7-33m3 / CVE-2026-121820 lets an unauthenticated HTTP-Redirect SAMLRequest/SAMLResponse inflate into an unbounded buffer in armeria-saml before any signature check. The same release also fixes Moderate CORS any-origin route ignore (GHSA-386q-mrg6-jfj8 / CVE-2026-121821), Low FileService stored XSS (GHSA-x9vf-hjgg-cq25 / CVE-2026-121822), and Moderate armeria-xds symlink SDS confinement bypass (GHSA-m64h-m6r5-6jrx / CVE-2026-121819). Upgrade to 1.43.0.
Armeria (LINE)Since Nov 6, 2026
Bitdefender Labs disclosed GhostMap, an unpatched Android flaw in how the OS reads ZIP entries inside an APK. libziparchive only checks an entry's declared uncompressed size when the entry is marked stored, while libandroidfw maps any entry that is not marked deflated at that declared size. An entry with a third compression-method value passes both, so Android maps far more memory than the file has, and the first read past the real end of the file kills the reading process with a SIGBUS. If the malformed file is a resource that system_server reads, installing the app (no permissions, no code, never opened) leaves the phone in a boot crash loop that continues in safe mode; recovery takes a factory reset, or ADB only if USB debugging was already on. The same trick can crash the installer, the launcher and Settings screens used to uninstall an app, or security scanners. Bitdefender reproduced it on a Pixel 10 running Android 17 with the August 5, 2026 patch and says Android 10 and later are affected. Google closed the first report as Won't Fix (Not Reproducible) and called the second, with a working PoC, outside the scope of a security fix, passing it to a feature team. There is no CVE, and Bitdefender has not seen it used in the wild; the investigation began with a packed banking dropper that only crashed the installer.
Android (AOSP libziparchive / libandroidfw APK parsing)Since Nov 5, 2026
imgproxy's ICO loader (vips/icoload.c) has three related flaws reachable with a crafted image. GHSA-hff9-5pqw-6w9f is a critical unauthenticated integer overflow: an attacker-controlled 32-bit data_size wraps when BMP_FILE_HEADER_LEN is added, so the process allocates a few bytes then writes far past the buffer — GitHub rates it CVSS 3.1 9.8 and says the heap overflow can cause denial of service or remote code execution. GHSA-mmq5-xm89-9pfg (high, CVSS 7.5) passes the same data_size to VIPS_MALLOC without a bound, so a tiny ICO can force a multi-gigabyte allocation. GHSA-494m-4556-wf5p (high, CVSS 7.5) reconstructs a BMP header from unvalidated fields and can write out of bounds, crashing the worker. Fixed in v4.0.16 (overflow + unbounded alloc) and v4.0.17 (OOB heap R/W). Also tracked as GO-2026-6897, GO-2026-6898 and GO-2026-6895, and since Nov 8 as CVE-2026-123614, CVE-2026-123616 and CVE-2026-123615.
imgproxySince Oct 30, 2026
A researcher published a working proof-of-concept for CVE-2026-58882, nicknamed "SMS of Death", a zero-click denial-of-service flaw in Android's telephony framework. Android's WapPushOverSms.decodeWapPdu() reads a WAP Push header length and casts it to a signed 32-bit integer with no range check, so an 8-byte data SMS sent to port 2948 makes it allocate an array of size -2147483648, which throws an uncaught NegativeArraySizeException and kills com.android.phone. That drops cellular service and any active call, including emergency calls, and the message never shows up in the inbox. The researcher reports that about 20 messages can leave a phone unusable, that carrier redelivery and retries on boot keep re-crashing it, and that one Android 12 test phone fell into a recovery-mode reboot loop that needed a factory reset; clearing the queued messages otherwise takes ADB. Google's fix ("Fix remote DoS in decodeWapPdu") shipped in the October 2026 Android security update for Android 14 through 17. It catches the exception and deletes the poison message rather than adding a bounds check. Android 12 and 13 run the same code and get no fix. The flaw is not listed in Google's October bulletin, and exploitation in the wild has not been reported.
Android telephony framework (com.android.phone)Since Oct 29, 2026
Cisco patched CVE-2026-76418 (CVSS 8.6), a denial-of-service bug in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated, remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not needed. Cisco PSIRT became aware of active exploitation in October 2026 and strongly recommends upgrading. Devices are affected when webvpn is enabled on an interface and a tunnel group (including DefaultWEBVPNGroup) uses secondary-authentication-server-group. There is no workaround, but disabling secondary authentication mitigates it. Shadowserver tracks more than 51,000 internet-exposed ASA SSL VPN devices.
Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD)Since Oct 28, 2026
Open Identity Platform's OpenAM 16.1.4 (Oct 22) fixes 18 security advisories, three of them critical and unauthenticated. GHSA-5c3q-hp86-xjr8 (CVSS 10.0, OpenAM 14.0.0–16.1.3): live session tokens are broadcast on the agent notification WebSocket (enabled by default) and the WebSocket's auth check can be bypassed through a legacy Liberty ID-FF endpoint, so an unauthenticated attacker can passively collect every user's session token, including administrators', and reuse it against OpenAM and every SSO-protected app. GHSA-3j2f-qhrc-rjfj (CVSS 9.8): an OpenAM SAML v2.0 service provider can accept unsigned assertions on some bindings (ECP/PAOS consumer advertised and WantAssertionsSigned off, both generated defaults, plus an SP encryption key), allowing unauthenticated account takeover. GHSA-jv8f-m88g-h6mm (CVSS 9.8): self-registration (off by default) doesn't enforce the allowed attribute list, so an anonymous user can join an administrative group. GHSA-hvfc-4v4r-8p9w: built-in demo, anonymous and WS-Security/STS agent identities ship with publicly known passwords and can log in; the advisory says this was reported as the entry point of a real intrusion against an outdated deployment. Other fixes cover unauthenticated deserialisation DoS, OAuth 2.0 device-flow CSRF and PKCE bypass, SSRF, open redirects and XSS. VulnCheck assigned CVE-2026-123536 through CVE-2026-123553 on Nov 8. Upgrade to 16.1.4.
OpenAM (Open Identity Platform)Since Oct 22, 2026
On Oct 21 2026 the Nuxt Content maintainers published three High advisories for the default unauthenticated POST /__nuxt_content/:collection/query endpoint in nuxt/content v3. CVE-2026-102650 (GHSA-xxrh-5hgg-gj4h): assertSafeQuery blocked only a small set of SQL keywords and did not reject expensive SQLite functions (randomblob/zeroblob/hex/length), so an unauthenticated attacker could force large allocations and block the Node event loop (DoS). GHSA-p7p3-px4q-v2rr: quote-escape and FROM-matching bugs in assertSafeQuery enabled unauthenticated boolean-blind SQL injection to read any table the DB user can see. GHSA-wjh8-qcrm-wf29: improper validation allowed unauthenticated cross-table data reads. Affected: nuxt/content >=3.0.0 <3.15.2 (fixed DoS/SQLi class in 3.15.2); further hardening in 3.16.1/3.16.2. Upgrade to >=3.16.2. Fully static prerendered deployments without the API route are not affected. Workaround: block POST /__nuxt_content/*/query at the proxy/WAF or prerender so the endpoint is not deployed.
nuxt/content (Nuxt Content query API)Since Oct 21, 2026
UnrealIRCd 5 is also affected by the critical bug. Other issues go back to 3.2.x. Please understand that running End Of Life versions is a BAD idea. See end of t.co/GWvETmKodm "Note to UnrealIRCd 5 and other EOL versions" and "Final words: the danger of AI is real"
UnrealIRCd 6.2.7.1 and hot-patch released: this fixes 9 security issues, including 1 CRITICAL (CVE-2026-114713). We suggest first deploying the SPAMFILTER workaround and then running the hot-patch command. See t.co/GWvETmKodm for all details. #IRC
🚨 Cisco patches actively exploited ASA and FTD firewall flaw. CVE-2026-76418 (CVSS 8.6) can let unauthenticated attackers remotely crash affected firewalls, causing denial of service. No successful VPN login required. Details + affected versions ↓ t.co/c0xxNRltVP