CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- patrickjuchli basic-ftpbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering7.5 High
@vitejs/plugin-rscnpm@vitejs/plugin-rsc has a Denial of Service with React Server Components7.5 High- apache activemq, activemq broker, apache software foundation activemq all +10 more +12 moreApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM7.5 High
- zod jsvideourlparserZod jsVideoUrlParser util.js getTime redos6.9 Medium
- openclawOpenClaw < 2026.4.4 - Rate-Limit Bypass via Concurrent Async Authentication Attempts6.3 Medium
- tmds tmds.dbus, tmds.dbus.protocol +1 moreTmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service7.1 High
- meta react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack +1 more +3 moreReact Server Components have a Denial of Service Vulnerability7.5 High
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to Denial of Service6.5 Medium
github.com/platform-mesh/kubernetes-graphql-gatewayGokubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution6.5 Medium- harttle liquidjsLiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter3.7 Low
- axiosAxios HTTP/2 Session Cleanup State Corruption Vulnerability5.9 Medium
skilletonnpmskilleton has improper input handling in repository/path processing6.9 Medium- linuxfoundation podman desktop, podman-desktop, red hat build of podman desktop +2 more +4 morePodman Desktop WebView Server Exposed8.2 High
- containers aardvark-dnsAardvark-dns has incorrect error handling for malformed tcp packets6.2 Medium
- open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +7 more +9 moreOpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)7.5 High
- kagi fastfeedparserFastFeedParser has an infinite redirect loop DoS via meta-refresh chain7.5 High
- apache cassandraApache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing6.5 Medium
- pmmp pocketmine-mpPocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket7.1 High
- pmmp pocketmine-mpPocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData8.7 High
- strawberry graphql, strawberry-graphql strawberry +1 moreStrawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions7.5 High
- @fedify fedify, vocab-runtime, fedify fedify\/fedify +1 more +3 moreFedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution7.5 High
- samsung exynos 1080 firmware, exynos 1280 firmware, exynos 1330 firmware +17 more +19 moreAn issue was discovered in USIM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos...7.5 High
- samsung exynos 1080 firmware, exynos 1280 firmware, exynos 1330 firmware +17 more +19 moreAn issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos...9.1 Critical
- samsung exynos 1080 firmware, exynos 1280 firmware, exynos 1330 firmware +17 more +19 moreAn issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos...7.5 High
directusnpmDirectus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver7.5 High- directusDirectus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits6.5 Medium
- mesop-dev mesopMesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service7.5 High
- openclawOpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-call6.9 Medium
- openclawOpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing8.7 High
- dokuwikiAn issue in Dokuwiki v.2025-05-14b 'Librarian' allows a remote attacker to cause a denial of...4.3 Medium
- belden hirschmann eaglesdv, beldan eaglesdv firmware +1 moreHirschmann EagleSDV Denial of Service via TLS8.7 High
- belden hirschmann eaglesdvHirschmann EagleSDV Denial of Service via TLS8.7 High
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack: Algorithmic-Complexity DoS in Rack::Multipart::Parser7.5 High
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack: Denial of Service via Unbounded Multipart File Upload Without Content-Length7.5 High
- rackRack: Unbounded Range Count in get_byte_ranges Enables DoS5.3 Medium
- rackRack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header5.3 Medium
- nothings stb, stb vorbis.c +1 moreNothings stb stb_vorbis.c setup_free allocation of resources5.3 Medium
- aio-libs aiohttpAIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers6.9 Medium
- linuxfoundation onnxONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.8.6 High
- ash-hq ash framework, ash-project ash +1 moreAsh Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash8.2 High
- google androidIn onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service...6.2 Medium
- openclawOpenClaw < 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket Upgrades8.7 High
- nuxt og image, nuxt-modules og-image +1 moreNuxt OG Image vulnerable to DoS via image generation6.9 Medium
- openclawOpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing6.9 Medium
- openclawOpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request Parsing6.9 Medium
- yahoo serialize, serialize-javascript +1 moreSerialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects5.9 Medium
- grafanaQuery resampling can cause unbounded memory allocations6.5 Medium
- grafanaGrafana Testdata datasource can issue unbounded memory allocations6.5 Medium
- oisf suricataSuricata http2: unbounded resource consumption7.5 High
- dovecot, open-xchange gmbh ox dovecot pro +1 moreA mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too...5.3 Medium
- Show moreLoading…