CVE-2026-81285
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
CVSS
7.5
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Aug 28, 2026 · Last modified: Aug 28, 2026 · CWE-770
Not enough EPSS history yet.
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-36866.2 MED—
———IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources.8hCVE-2026-547887.5 HIG—
———dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.10hCVE-2026-58107——
———CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size.
An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.10hCVE-2026-377367.5 HIG—
———An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.10hCVE-2026-801795.9 MED—
——0A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.10hCVE-2026-593033.1 LOW—
——0Dynamic destination cache size is not properly bound in Spring Cloud Stream.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4.2.67h