Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM
HackerOneMonero2026-10-28
Web3
High
BUG BOUNTY WRITEUPS
Denial of service writeups
Crashing or exhausting a service: ReDoS, resource limits, memory blow-ups and protocol edge cases.
143 reports and writeups from 2024 to 2026. 108 carry a severity from the disclosing platform, 33 of them rated High or Critical. Last updated 2026-10-30.
Latest Denial of service reports
Search and filter all writeupsUnauthenticated Persistent Denial-of-Service via Federated Share Injection
HackerOneNextcloud2026-10-27
Web, Cloud
High
passive FTPS data connection handshake blocks curl_multi_perform() with no timeout (regression in 8.19.0)
HackerOnecurl2026-10-23
Web
Low
curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode)
HackerOnecurl2026-10-23
Web
Medium
IBC2 Entry Points Skip SetupContractCost - Systematic Gas Underpricing
HackerOneCosmos2026-10-19
Web
Medium
Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()`
HackerOneWeblate2026-10-16
Web
Medium
Uncaught RecursionError crash in translation-finder (deep directory tree DoS)
HackerOneWeblate2026-10-14
Web
Low
r2dbc-mariadb Parsec auth: server-controlled PBKDF2 iteration count causes CPU-exhaustion DoS ( regression from b7766de )
HackerOneMariaDB2026-10-12
Web
Medium
Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE_TYPE=DOS tables
HackerOneMariaDB2026-10-12
Binary
Not rated
Server crash (stack-overflow DoS) via unbounded recursion in MariaDB WKB GEOMETRYCOLLECTION parser
HackerOneMariaDB2026-10-11
Web
Medium
MariaDB HandlerSocket Improper Request Field-Count Validation Causes Server Crash
HackerOneMariaDB2026-10-07
Web
Medium
MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service
HackerOneMariaDB2026-10-07
Web
Medium
Possible DoS in NumberHelpers
HackerOneRuby on Rails2026-10-06
Web
Medium
Client-Side Denial of Service (DoS) via Memory Exhaustion on Password Reset Endpoint
HackerOneKhan Academy2026-10-05
Web, API
High
Connector/J: malicious server crashes client JVM via unbounded result-set field-count allocation in ClientMessage.readPacket
HackerOneMariaDB2026-09-30
Web
Medium
Improper input validation in emoji field leads to sidebar UI denial of service
HackerOneNextcloud2026-09-20
Web, Cloud
Low
ZMQ get_output_distribution duplicate amount DoS
HackerOneMonero2026-09-17
Web3
Medium
Tor onion service INTRODUCE2 invalid-MAC cells permanently grow service replay cache
HackerOneTor2026-09-10
Web
Low
Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate
HackerOneWeblate2026-09-04
Web
High
Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server
HackerOneMariaDB2026-09-03
Web
Medium
Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)
HackerOneNode.js2026-08-28
Web, API
Medium
HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion
HackerOneNode.js2026-08-28
Web
High
dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records
HackerOneNode.js2026-08-28
Web
Medium
Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity
HackerOneBasecamp2026-07-04
Web
Medium
Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint
HackerOneDiscourse2026-06-30$1,024 bounty
Web, API
High
Remote node DOS
HackerOneMonero2026-06-29
Web3
Medium
Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames
HackerOneNode.js2026-06-25
Web
Medium
Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)
HackerOneNode.js2026-06-25
Web
High
CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop
HackerOnecurl2026-06-24
Web
Low
HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors
HackerOneNode.js2026-06-18
Web
Medium
Malicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After Teardown
HackerOneTor2026-06-16$100 bounty
Web, API
Low
Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions
HackerOneNode.js2026-06-12
Web
High
Action Text ReDoS (Ruby 3.1 or lower)
HackerOneRuby on Rails2026-06-09
Web
Low
V1Plugin.Decrypt panics on empty ciphertext (Remote DoS)
HackerOneAWS VDP2026-05-28
Web, Cloud
Medium
V2Plugin.Decrypt panics on empty ciphertext (Remote DoS)
HackerOneAWS VDP2026-05-28
Web, Cloud
Medium
Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node Paralysis
HackerOneMonero2026-05-06
Web3
Critical
Potential Resource Leak in tool_parsecfg.c at line 279 during fileerror
HackerOnecurl2026-05-05
Web
Low
Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumption
HackerOnePortSwigger Web Security2026-05-05$200 bounty
Web, API
Low
Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS
HackerOneNode.js2026-04-23
Web
High
DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API
HackerOneHackerOne2026-04-16
Web, API
Not rated
Memory leak in gem decode logic can allow attacker to take down Rubygems.org application
HackerOneRubyGems2026-04-09
Web
Medium
Reported Denial of Service
HackerOneMonero2026-04-06
Web3
Not rated
HTTP/2 PUSH_PROMISE header loss on OOM bypasses scheme validation (regression of 2e8c922a89)
HackerOnecurl2026-03-31
Web
Medium
Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)
HackerOneNode.js2026-03-30
Web
High
Potential DoS due to PasswordPoliciesNotMet in errors.go
HackerOnepasshash2026-03-27
Web
Low
Server-side ReDoS via user-controlled regex in OIDC Access Policy
HackerOneRubyGems2026-03-26
Web
Not rated
NULL Pointer Dereference (DoS) in libcurl SFTP QUOTE command parsing due to missing return statement
HackerOnecurl2026-03-11
Web
Medium
DoS via Unbounded Memory Allocation in sendWebStream on Fastify v5.7.0+ leads to OOM crash when backpressure is ignored
HackerOneFastify2026-03-05
Web
Not rated
Memory leak that enables remote Denial of Service against applications processing TLS client certificates
HackerOneNode.js2026-02-12
Web
Medium
TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak
HackerOneNode.js2026-02-12
Web
Medium
ASGIRequest header concatenation quadratic CPU DoS on Django via repeated headers leads to worker exhaustion
HackerOneDjango2026-02-09
Web
Not rated
Memory Exhaustion in CometBFT v1.0.1 via malicious ProposalMessage leads to network-wide denial of service
HackerOneCosmos2026-01-20
Web
Not rated
MQTT: Missing upper bound on incoming Remaining Length allows server-controlled long wait
HackerOnecurl2026-01-06
Web
Low
WebSocket Logic Error: Control Frame (PING/PONG) Starvation causes Connection Drop (DoS) during large transfers
HackerOnecurl2025-12-28
Web
Medium
Unbounded memory consumption via compressed HTTP responses (gzip/brotli/zstd)
HackerOnecurl2025-12-21
Web
Medium
Economic DoS (Griefing) on IBC Relayers via `memo` Callback Gas Exploitation
HackerOneCosmos2025-12-18
Web
High
Denial of Service (DoS) vulnerability in dedotdotify() URL path normalization
HackerOnecurl2025-12-13
Web
High
High resource consumption by insufficient sanitization of forum threads pagination
HackerOneFlickr2025-11-24$479 bounty
Web
Medium
Improper sanitisation of input in the settings could cause DoS
HackerOneRevive Adserver2025-11-19
Web
Low
libcurl MQTT `CURLOPT_POSTFIELDSIZE_LARGE` overflow leads to immediate DoS
HackerOnecurl2025-11-10
Web
Medium
Memory leak in Curl_auth_create_ntlm_type3_message
HackerOnecurl2025-10-28
Web
Low
Application Level DoS - Large Markdown Payload in Reply Section Leading to Resource Exhaustion
HackerOneDiscourse2025-10-18
Web
High
OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients)
HackerOnecurl2025-10-08
Web
Low
Curl parse_connect_to_string Heap-Overread Leading to Denial of Service via CURLOPT_CONNECT_TO
HackerOnecurl2025-08-20
Binary
Medium
WebSocket Fragmentation DoS on Curl Client
HackerOnecurl2025-08-19
Web
High
Sample report: Denial of service
HackerOneGitHub2025-08-07
Web
Not rated
Disk Space Exhaustion leading to a Denial of Service (DoS)
HackerOnecurl2025-07-14
Web
Medium
ReDoS in Psych
HackerOneRuby2025-07-08
Web
Not rated
ReDoS in IPAddr
HackerOneRuby2025-07-08
iOS
Not rated
curl_easy_header runs at O(N) or worse and can be abused to use minute(s) of CPU time
HackerOnecurl2025-07-01
Web
Not rated
Crafted smart contract can take 8 minutes to execute due to bug in modexp precompile.
HackerOneRootstock Labs2025-06-13
Web3
High
DOS of RSKJ server
HackerOneRootstock Labs2025-06-13$5,000 bounty
Web
High
Crafted smart contract can take 1.5 minutes to execute due to inefficient CODESIZE implementation
HackerOneRootstock Labs2025-06-12
Web3
Medium
Crafted smart contract can take ~23 seconds to execute due to immense error string construction
HackerOneRootstock Labs2025-06-12
Web3
Medium
DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.com
HackerOneShopify2025-06-04$3,800 bounty
Web
Medium
Dynamic fee algorithm doesn't check for zero fee
HackerOneMonero2025-05-23
Web3
Low
RPC service DOS
HackerOneMonero2025-05-23
Web3
Medium
[Xenoblade Chronicles X: Definitive Edition] Buffer overflow in string escape function, multiplayer DoS
HackerOneNintendo2025-05-15
Binary
High
[Xenoblade Chronicles X: Definitive Edition] Unrestricted RPCs allow DoS and writing arbitrary flags remotely
HackerOneNintendo2025-05-15
Web
Critical
Weak Rate Limiting Controls in the (LOGIN) page Expose System to Brute Force and DoS Attacks
HackerOneLichess2025-05-15
Web
Critical
[CVE-2025-27220] ReDoS in CGI::Util#escapeElement
HackerOneInternet Bug Bounty2025-04-30
Web
High
Denial of Service by memory exhaustion in net/imap
HackerOneInternet Bug Bounty2025-04-27
Web
Medium
CVE-2024-43398: DoS vulnerability in REXML
HackerOneInternet Bug Bounty2025-04-27$505 bounty
Web
Low
Possible DoS by memory exhaustion in net/imap
HackerOneInternet Bug Bounty2025-04-27
Web
Medium
[CVE-2025-27219] Denial of Service in CGI::Cookie.parse
HackerOneInternet Bug Bounty2025-04-27
Web
Medium
Spamming highly nested JSON RPC requests cause node to disconnect from p2p network
HackerOneMonero2025-04-23
Web3
Not rated
Remote memory exhaustion in Epee RPC stack under zero Receive Window
HackerOneMonero2025-04-23
Web3
High
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
HackerOneInternet Bug Bounty2025-03-07
Web
Medium
Unsufficent input verification leads to DoS and resource consumption
HackerOneSorare2025-02-26$300 bounty
Web
Low
Uncontrolled Resource Consumption when parsing maliciously crafted XML with REXML
HackerOneRuby2025-02-20
Web
Medium
GOAWAY HTTP/2 frames cause memory leak outside heap
HackerOneNode.js2025-02-06
Binary
Medium
CVE-2024-49761: ReDoS vulnerability in REXML
HackerOneInternet Bug Bounty2024-11-30
Web
Medium
[CVE-2024-47888] Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text
HackerOneInternet Bug Bounty2024-11-28$505 bounty
Web
Low
ReDoS Vulnerability in HTTP Accept Headers Parsing
HackerOneInternet Bug Bounty2024-10-30$2,642 bounty
Web
Medium
Unauthenticated WordPress Database Repair DoS
HackerOneWordPress2024-10-18
Web
High
Circular based introspetion Query leading to single request denial of service and cost consumption and query cost on api.sorare.com/graphql
HackerOneSorare2024-10-17
Web, API
Medium
DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server
HackerOneGitLab2024-10-09$2,300 bounty
Web
Medium
ReDoS due to device-detector parsing user agents
HackerOneGitLab2024-10-08
Web
Medium
Possible DoS Vulnerability with Range Header in Rack
HackerOneInternet Bug Bounty2024-09-25$5,420 bounty
Web
High
CVE-2024-41989: Denial-Of-Service vulnerability in the floatformat template filter when input string contains a big exponent in scientific notation
HackerOneInternet Bug Bounty2024-09-22$2,142 bounty
Web
Medium
CVE-2018-0296 Cisco ASA Denial of Service & Path Traversal vulnerable on [mtn.co.ug]
HackerOneMTN Group2024-08-30
Web
Critical
[CVE-2024-35176] DoS vulnerability in REXML
HackerOneInternet Bug Bounty2024-08-23$2,142 bounty
Web
Medium
CVE-2024-38875: Denial-Of-Service through uncontrolled resource consumption caused by poor time complexity of strip_punctuation .
HackerOneInternet Bug Bounty2024-08-23$2,142 bounty
Web
Medium
Vulnerabilities in NodeJS C/C++ add-on extensions
Researcher blogNode.js third-party modules2024-08-14
Source Code, Binary
Not rated
Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources
Researcher blogAWS2024-08-09
Web, Cloud
Not rated
Canary Token OSS Security Audit Report (Q2 2024)
Researcher blogThinkst (OSS Canary Tokens)2024-07-23
Web
Not rated
important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
HackerOneInternet Bug Bounty2024-07-13$4,920 bounty
Web
High
Sorry, ChatGPT Is Under Maintenance: Persistent Denial of Service through Prompt Injection and Memory Attacks
Researcher blogOpenAI (ChatGPT)2024-07-08
Web, AI
Not rated
Plormbing Your Prisma ORM With Time-based Attacks
Researcher blog2024-07-08
Web
Not rated
CVE-2024-34750 Apache Tomcat DoS vulnerability in HTTP/2 connector
HackerOneInternet Bug Bounty2024-07-05$4,920 bounty
Web
High
How I Discovered Authentication Bypass That Blocks Users from Accessing the Website ?
Medium2024-07-04
Web
Not rated
You Can’t Always Win Racing the (Key)cloak
Researcher blogKeycloak2024-07-01
Web
Not rated
17 vulnerabilities in Sharp Multi-Function Printers
GitHubSharp, Toshiba2024-06-27
API, Binary
Not rated
DoS with crafted "Range" header
HackerOneRuby on Rails2024-06-25
Web
High
A Novel DoS Vulnerability affecting WebRTC Media Servers
Researcher blog2024-06-25
Web
Not rated
Plormbing Your Django ORM
Researcher blog2024-06-23
Web
Not rated
New 100$ Bug in My Methodology!
Medium2024-06-23$100 bounty
Web
Not rated
Denial of Service in curl Request - HTTP headers eat all memory
HackerOnecurl2024-06-18
Web
Medium
CVE-2024-31735: LibEvent Library Memory Leak
Researcher blogLibEvent2024-06-06
Web, Source Code
Not rated
Targeting an industrial protocol gateway
Researcher blogHMS Networks2024-05-30
Web
Not rated
[CVE-2024-26146] Header Parsing leads to Possible Denial of Service Vulnerability
HackerOneInternet Bug Bounty2024-05-24
Web
Low
[CVE-2024-26142] ReDoS vulnerability in Accept header parsing in Action Dispatch
HackerOneInternet Bug Bounty2024-05-22
Web
Low
[CVE-2024-25126] Denial of Service Vulnerability in Rack Content-Type Parsing
HackerOneInternet Bug Bounty2024-05-22
Web
Low
Response Filter Denial of Service (RFDoS): shut down a website by triggering WAF rule
Researcher blog2024-05-14$1,200 bounty
Web
Not rated
Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash
HackerOneInternet Bug Bounty2024-04-29$3,645 bounty
Web
High
CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
HackerOneInternet Bug Bounty2024-04-28
Web
Medium
Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
HackerOneInternet Bug Bounty2024-04-24$2,580 bounty
Web
Medium
Denial of Service caused by HTTP/2 CONTINUATION Flood
HackerOneInternet Bug Bounty2024-04-22$4,860 bounty
Web
High
"Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash
HackerOneNode.js2024-04-08
Web
High
Galactical Bug Hunting: How we discovered new issues in CD Projekt Red’s Gaming Platform
Researcher blogGOG2024-04-04
Web
Not rated
HTTP/2 PUSH_PROMISE DoS
HackerOnecurl2024-03-27
Web
Medium
CVE-2024-2398: HTTP/2 push headers memory-leak
HackerOnecurl2024-03-27
Web
Medium
TP-Link TDDP Buffer Overflow Vulnerability
Researcher blogTP-Link2024-03-19
Binary
Not rated
Denial of Service by resource exhaustion in fetch() brotli decoding
HackerOneNode.js2024-03-16
Web
Medium
http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
HackerOneInternet Bug Bounty2024-03-05$3,495 bounty
Web
High
We Hacked Google A.I. for $50,000
Researcher blogGoogle2024-03-04$50,000 bounty
Web, API, AI
Not rated
http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
HackerOneNode.js2024-02-15
Web
High
xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack.
HackerOneNextcloud2024-02-08
Web, Cloud
Not rated
Azure HDInsight: The Sequel – Unveiling 3 New Vulnerabilities That Could Have Led to Privilege Escalations and Denial of Service
Researcher blogMicrosoft (Azure HDInsight)2024-02-06
Web, Cloud, Source Code
Not rated
Break saved option for other users in facebook – From N/A to valid bug
Researcher blogMeta / Facebook2024-01-30
Web
Not rated
Spoofing 802.11 Wireless Beacon Management Frames with Manipulated Power Values Resulting in Denial of Service for Wireless Clients
Researcher blog2024-01-26
Web, Source Code
Not rated
*nix libX11: Uncovering and exploiting a 35-year-old vulnerability – Part 1 of 2
Researcher blogX.Org (libX11)2024-01-17
Web, Source Code
Not rated
HTTP Chunk Extension Processing Vulnerabilities
Researcher blogGolang, Node.js, Hyper (Rust HTTP library)2024-01-08
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.