CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- hickory-dns Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification 8.7 High
- hickory-dns Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals 8.7 High
- hickory-dns Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records 6.9 Medium
- hickory-dns Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts 8.7 High
- sveltejs devalue Devalue before 5.9.3 CPU Amplification Denial of Service via uneval 8.7 High
- sveltejs devalue Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval 8.7 High
- go-vikunja vikunja Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter 8.7 High
- go-vikunja vikunja Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion 5.3 Medium
- go-vikunja vikunja Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes 7.1 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- stleary json-java JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoS 5.9 Medium
- grobidorg grobid GROBID: Unauthenticated `/api/modelTraining` Endpoint Allows Unbounded Thread Pool Creation (DoS) 7.5 High
- hapijs content Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API 7.5 High
- chenyme grok2api chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption 5.3 Medium
- dlclark regexp2 Regexp2: Unbounded memory amplification via large `{m}` quantifier on a zero-width subexpression 7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 more Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing 7.5 High
- tinyhumansai openhuman OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth 7.7 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 more Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache 7.5 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 more Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing 7.5 High
- apache software foundation ofbiz Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode No score
- samsung exynos 1280, exynos 1330, exynos 1380 +12 more +14 more In the LTE RRC component, improper handling of messages before authentication triggers a data... No score
- kyverno Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Cost 8.2 High
-
python-laspyDebian laspy LAS File lasreader.py memory allocation 5.3 Medium - @contentful mcp-server, tsparticles +1 more tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients 6.9 Medium
- @contentful mcp-server, tsparticles +1 more tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS 7.5 High
- ibm db2 genius hub Multiple vulnerabilities that affects IBM Db2 Genius Hub 3.3 Low
- seppmail ag secure email gateway (seg) Pre-authentication upload parsing permits resource exhaustion 8.7 High
- tanium discover Tanium addressed an uncontrolled resource consumption vulnerability in Discover. 4.3 Medium
- isomorphic-git isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS) 4.3 Medium
- darylldoyle svg-sanitizer svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph 8.7 High
- lepture mistune Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing 6.9 Medium
- freerdp FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA 7.1 High
- openkruise kruise-manager CVE-2026-120656 7.5 High
- @fastify/multipart @fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers 5.9 Medium
- huawei harmonyos DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability... 5.7 Medium
- huawei harmonyos DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability... 6.5 Medium
- No product listed A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header... 7.5 High
- No product listed A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure... 7.5 High
- ag-ui-protocol ag-ui ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumption 5.3 Medium
- ag-ui-protocol ag-ui ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption 5.3 Medium
- ag-ui-protocol ag-ui ag-ui-protocol ag-ui HTTP Transport e.text resource consumption 5.3 Medium
- gitea Gitea Helm chart upload decompression denial of service No score
- delgan loguru Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos 5.3 Medium
- google android In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via... 6.2 Medium
-
github.com/imgproxy/imgproxyGo,github.com/imgproxy/imgproxy/v2Go,github.com/imgproxy/imgproxy/v3Go +1 more +3 more imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field 7.5 High - hackerone aedes Aedes has Uncaught Exception and Uncontrolled Resource Consumption 7.5 High
- libredwg LibreDWG: unbounded allocation in pre-R13 DWG entity decoding 5.5 Medium
- libredwg LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing 5.5 Medium
- filecoin-project filecoin-pin Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources 6.5 Medium
- pistacheio pistache Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs) 5.9 Medium
- Show olderLoading…