CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreAttacker can send a specifically crafted message before authentication that causes managesieve to...7.5 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreSending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory...4.3 Medium
- miraheze tsportalTSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service6.5 Medium
- grafana, grafana oss +1 moreGrafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS6.5 Medium
- openclawOpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook6.9 Medium
- openclawOpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responses6.9 Medium
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groups7.5 High
- juliangruber brace-expansionbrace-expansion: Zero-step sequence causes process hang and memory exhaustion6.5 Medium
- mattermost, mattermost server +1 moreImproper Input Validation in Zoom Plugin Webhook Handler4.9 Medium
- protocol buffers protobuf-php (pecl)Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input7.1 High
- harttle liquidjsLiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern7.5 High
- harttle liquidjsLiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash7.5 High
- mattermost, mattermost server +1 moreDenial of Service via HTTP/2 single packet attack on login endpoint4.3 Medium
- cisco ios xe software, ios xe +1 moreA vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an...8.6 High
- nanoleaf linesNanoleaf Lines unauthenticated firmware file store6.9 Medium
- apple ipados, ios and ipados, iphone os +2 moreThe issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. A...7.5 High
- scribanScriban before 7.0.0 Denial of Service via Unbounded Resource Consumption7.1 High
- scribanScriban before 7.0.0 LoopLimit Bypass via Built-in Operations8.7 High
- pinchtabPinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution6.7 Medium
- parse-community parse-serverParse Server: Denial of service via unindexed database query for unconfigured auth providers8.7 High
- mozilla firefox, thunderbird +1 moreDenial-of-service in the Libraries component in NSS7.5 High
- mozilla firefox, thunderbird +1 moreDenial-of-service in the XML component7.5 High
- mozilla firefox, thunderbird +1 moreDenial-of-service in the WebRTC: Signaling component7.5 High
- concretecms concrete cmsConcreteCMS is vulnerable to Denial of Service During Bulk Downloads6.5 Medium
- free5gcAn issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via...7.5 High
- h3js h3h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie8.7 High
- rubyonrails rails, rails activesupport +1 moreRails Active Support has a possible DoS vulnerability in its number helpers6.6 Medium
- rubyonrails rails, rails activesupport +1 moreRails Active Support has a possible ReDoS vulnerability in number_to_delimited6.9 Medium
pygmentsDebian,python-pygmentsMageia +1 morepygments archetype.py AdlLexer redos4.8 Medium- go-vikunja vikunjaVikunja Affected by DoS via Image Preview Generation6.5 Medium
- microsoft .netASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a...7.5 High
- kelvinmo simplejwtSimpleJWT has an Unauthenticated Denial of Service via JWE header tampering7.5 High
- qluster deepdiffDeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT8.7 High
- py-pdf pypdfpypdf has inefficient decoding of array-based streams5.1 Medium
- aapanelAn issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows...7.5 High
- antchfx xpath, github.com/antchfx/xpath +1 moreInfinite loop in github.com/antchfx/xpath7.5 High
- linuxfoundation tekton pipelines, tektoncd pipeline +1 moreTekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun6.5 Medium
- wazuhWazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware5.3 Medium
- openclawOpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request8.7 High
- hcl aionHCL AION is affected by a improper handling of uploads files Size1.8 Low
- osrg gobgpGoBGP vulnerable to a denial of service via the NEXT_HOP path attribute7.5 High
- No product listedIn Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a...6.5 Medium
- radare2Radare2 Mach-O File mach0.c walk_exports_trie resource consumption4.8 Medium
- sindresorhus file-typefile-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry5.3 Medium
- courtbouillon cairosvgCairoSVG vulnerable to Exponential DoS via recursive <use> element amplification7.5 High
- forceu gokapiGokapi vulnerable to DoS in E2E Metadata Parser6.5 Medium
- freerdpFreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library3.1 Low
- hex hexpmDenial of Service via Oversized Package Upload7.1 High
- No product listedHMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and...7.5 High
- tornadoweb tornadoTornado has a DoS due to too many multipart parts8.7 High
- Show moreLoading…