Tag: denial of service
34 articles
Next.js Patches Code Execution Flaws in Caching, SVG Processing
Critical security flaws in Next.js have been patched in an out-of-band update, fixing two remote-code-execution bugs and one denial-of-service vulnerability that left applications open to attacks. The severe flaws, rated 9.5 on the CVSS scale, affected React Server Components and SVG processing.
Citrix Warns of Immediate Patching Need for NetScaler RCE Flaw
Citrix is sounding the alarm on a critical vulnerability, CVE-2026-107406, that can lead to remote code execution or a denial-of-service state in NetScaler devices - and it's urging admins to patch immediately.
Cisco Discloses Critical Flaws in Nexus Switches
Cisco has uncovered five critical vulnerabilities in its Nexus switches that could let hackers run malicious code with root access or bring down entire networks, causing major disruptions. This security threat affects Nexus 3000 and 9000 Series switches, putting your network at risk of remote code execution and denial-of-service attacks.
Citrix Unveils Third Exploited NetScaler Zero-Day Vulnerability
Citrix has just revealed a third critical NetScaler zero-day vulnerability, CVE-2026-88779, which can cause a denial of service in SAML-enabled deployments, and security experts warn it's painfully easy to trigger. This high-severity defect is the latest in a string of actively exploited NetScaler vulnerabilities.
Citrix NetScaler Exploited in Active Attacks Amid New 0-Day Reports
Citrix NetScaler is under active attack, with hackers exploiting a newly discovered vulnerability that can cause denial of service with just a single specially crafted request. The flaw, known as CVE-2026-88779, affects certain NetScaler deployments configured for single sign-on authentication.
Citrix Warns of Targeted Attacks Via New Zero-Day Flaw
Citrix is warning of targeted attacks exploiting a newly discovered zero-day flaw, CVE-2026-88779, a high-severity memory buffer issue that could disrupt services for vulnerable NetScaler ADC and NetScaler Gateway customers. The company has urged affected users to act quickly to protect themselves from potential denial-of-service attacks.
Citrix NetScaler Zero-Day Exploited in Targeted Attacks
A critical zero-day vulnerability, CVE-2026-88779, has been exploited in targeted attacks, causing concern for Citrix NetScaler ADC and Gateway users. This memory overflow flaw can lead to denial-of-service attacks when specific deployment conditions are met.
Citrix Disrupts Zero-Day Attacks on NetScaler with Emergency Patches
Citrix has rolled out emergency patches to shield NetScaler from zero-day attacks that can cause Denial of Service chaos, and you should update ASAP to avoid getting caught in the crossfire. The newly discovered vulnerability, CVE-2026-88779, has already been exploited in targeted attacks, earning a scary CVSS score of 8.7.
CISA Warns of Pre-Auth Flaw in MikroTik RouterOS
A critical vulnerability in MikroTik RouterOS, known as CVE-2026-84411, can be exploited with a single crafted request, allowing attackers to execute code with root privileges or cause a denial-of-service condition, even without authentication. This flaw puts your network at risk, and it's essential to take immediate action to protect yourself.
Citrix NetScaler Flaw Exposes Pre-Auth Path to Shellcode Execution
A critical flaw in Citrix NetScaler appliances, tracked as CVE-2026-88772, has been patched after being exploited in the wild, allowing for remote code execution or denial-of-service attacks. This severe vulnerability, with a CVSS score of 9.5, was caused by a memory overflow in Datagram Transport Layer Security (DTLS) protocol handling.
Windows Named Pipes Expose Security Risks
Don't assume that just because a Windows Named Pipe is local, it's private - in reality, it can be a security risk if not properly defended, exposing your system to privilege escalation and other threats. A cybersecurity expert warns that architects must redesign pipes to prioritize identity and access control.
CDNs Exposed to Tsunami Attacks via HTTP/3 Flaw
A newly discovered flaw in HTTP/3 leaves CDNs vulnerable to devastating tsunami attacks, including two denial-of-service techniques called HTTP/3 Bandwidth Amplification and Connection Amplification. By exploiting this weakness, attackers can turn a small amount of malicious traffic into a massive flood that overwhelms its target.
Cisco ASA and FTD Flaw Exploited in Wild, Triggers Remote DoS
A high-severity vulnerability in Cisco Secure Firewall ASA and FTD software, known as CVE-2026-20349, is being actively exploited in the wild, allowing attackers to trigger a remote denial-of-service condition with a simple crafted HTTP request. This flaw, with a CVSS score of 8.6, can cause affected devices to reload, leaving networks vulnerable to disruption.
Cisco Warns of Active Exploitation of VPN Flaw in ASA, FTD Software
Cisco warns that a high-severity VPN flaw, CVE-2026-20349, is being actively exploited, allowing attackers to send crafted HTTP requests that can cause affected devices to reload and disrupt operations. This denial-of-service vulnerability can be triggered remotely without authentication, making it a critical threat.
Cisco Exposes High-Severity Flaws in ClamAV Software
Cisco has uncovered two high-severity flaws in ClamAV's ZIP archive parser that can be exploited by remote attackers to crash the antivirus scanner, with proof-of-concept code already publicly available. These vulnerabilities, tracked as CVE-2026-20337 and CVE-2026-20338, can be triggered by submitting specially crafted ZIP files, causing a denial-of-service condition.
OpenSSL Servers Vulnerable to Memory-Bloating DDoS Attacks
Beware: a simple 11-byte malicious input can cripple OpenSSL servers with a devastating DDoS attack, leaving them permanently bloated and vulnerable. This sneaky exploit, dubbed HollowByte, takes advantage of a weakness in OpenSSL's TLS handshake to drain server resources.
U-Boot Flaws Expose Devices to Stealthy Firmware Attacks
Researchers uncovered six critical vulnerabilities in U-Boot's firmware signature verification code, leaving devices open to stealthy attacks that can execute malicious code at startup. These flaws, ranging from denial of service to arbitrary code execution, highlight a major security risk that needs to be addressed.
Citrix Fixes Flaws in NetScaler Software Exposing Users to File Reads and DoS Attacks
Citrix has patched six high-risk vulnerabilities in its NetScaler software, including flaws that could expose users to file reads and devastating denial-of-service attacks. These critical updates address issues with CVSS scores as high as 8.8, emphasizing the urgent need for users to apply the fixes.
F5 Dispatched Patches for Critical NGINX Flaws
F5 has urgently released patches to fix two critical vulnerabilities in NGINX modules that can be exploited by remote attackers to cause denial-of-service or even execute remote code. Admins are advised to install the updates ASAP to protect NGINX Plus, Open Source, Gateway Fabric, and Instance Manager from potential attacks.
Microsoft Patch Tuesday Disrupts 200 Vulnerabilities, Zero-Day Exploits
Microsoft's June Patch Tuesday update is a doozy, tackling a whopping 200 vulnerabilities, including three zero-day exploits and 33 critical flaws that could lead to remote code execution. This crucial update aims to prevent a range of issues, from denial-of-service attacks to elevation of privilege and information disclosure.
Protobuf.js Vulnerabilities Expose Node.js Apps to Code Execution, DoS
A single malicious protobuf schema could be all it takes to trigger crashes, corrupt runtimes, or even execute code in vulnerable Node.js apps, warns Cyera security researcher Assaf Morag. Six newly identified vulnerabilities in protobuf.js, known as Proto6, carry high severity scores and could put your app at risk.
CISA Flags SolarWinds Serv-U Flaw as Actively Exploited
A critical flaw in SolarWinds Serv-U is being actively exploited, allowing attackers to crash the service with a specially crafted POST request - no authentication required. This denial-of-service vulnerability, tracked as CVE-2026-28318, can be triggered by a simple HTTP POST request with a malicious Content-Encoding header.
Hackers Actively Exploit SolarWinds Serv-U Flaw to Crash Servers
SolarWinds has issued an emergency hotfix to address a critical flaw in its Serv-U file transfer product, which hackers are actively exploiting to crash servers with specially crafted POST requests. A denial-of-service vulnerability, tracked as CVE-2026-28318, can be triggered without authentication, posing a significant threat to users.
Codex Agent Uncovers Lethal HTTP/2 DoS Exploit
A home computer on a typical 100Mbps connection can cripple a vulnerable server in mere seconds with the HTTP/2 Bomb, a potent DoS exploit that combines two decade-old attack techniques. This devastating attack exhausts server memory by sending tiny, compressed HTTP/2 header fragments and holding connections open, taking the service offline.