Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-606
Weakness type CWE-606 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 31 | 27 | 0 |
Monthly trend
▃▁▁▁▂▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▃▂▅▅▄█▅▁
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 2 · 2026-04 1 · 2026-05 5 · 2026-06 4 · 2026-07 3 · 2026-08 8 · 2026-09 4 · 2026-10 0
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2023-3446 | 5.3 | 93.7 | — | Excessive time spent checking DH keys and parameters |
| CVE-2023-5678 | 5.3 | 91.3 | — | Excessive time spent in DH check / generation with large Q parameter value |
| CVE-2023-3817 | 5.3 | 87.3 | — | Excessive time spent checking DH q parameter value |
| CVE-2023-6237 | 5.9 | 83.0 | — | Excessive time spent checking invalid RSA public keys |
| CVE-2026-1519 | 7.5 | 75.4 | — | Excessive NSEC3 iterations cause high CPU load during insecure delegation validation |
| CVE-2026-62901 | 7.5 | 68.5 | — | .NET Denial of Service Vulnerability |
| CVE-2026-41606 | 5.3 | 65.1 | — | Apache Thrift: c_glib dispatch stack overflow |
| CVE-2026-33891 | 7.5 | 58.9 | — | Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input |
| CVE-2026-42561 | 7.5 | 57.4 | — | Python-Multipart: Denial of Service via unbounded multipart part headers |
| CVE-2026-5950 | 5.3 | 55.7 | — | Unbounded resend loop in BIND 9 resolver |
| CVE-2026-39820 | 7.5 | 55.2 | — | Quadratic string concatentation in consumeComment in net/mail |
| CVE-2026-33814 | 7.5 | 55.1 | — | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/in… |
| CVE-2026-11972 | 8.2 | 52.8 | — | tarfile opened in streaming mode mishandles EOF |
| CVE-2026-44289 | 7.5 | 51.6 | — | protobufjs: Denial of service through unbounded protobuf recursion |
| CVE-2026-66276 | 6.5 | 50.3 | — | Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service |
| CVE-2026-67554 | 6.5 | 50.3 | — | Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of s… |
| CVE-2026-68077 | 6.5 | 50.3 | — | Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service |
| CVE-2026-27145 | 6.5 | 47.2 | — | Inefficient candidate hostname parsing in crypto/x509 |
| CVE-2026-20301 | 8.6 | 46.2 | — | Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of S… |
| CVE-2026-55731 | 6.6 | 44.5 | — | Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 4 |
| openssl | 4 |
| go standard library | 3 |
| isc | 2 |
| wireshark foundation | 2 |
| cisco | 1 |
| dana powers | 1 |
| digitalbazaar | 1 |
| gnu | 1 |
| golang.org/x/net | 1 |
| huawei | 1 |
| juniper networks | 1 |
| kludex | 1 |
| loytec | 1 |
| mermaid-js | 1 |
