CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported...4.9 Medium
- oracle identity manager connectorVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware ...7.5 High
- oracle graalvm, graalvm for jdk, jdk +31 more +33 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...7.5 High
- oracle solarisVulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The...6.5 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...6.6 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication...6.5 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...6.5 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication...6.5 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication...6.5 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...5.3 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...6.5 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...6.5 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported...4.9 Medium
- oracle graalvm, oracle corporation graalvm enterprise edition, java se +2 more +4 moreVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...6.0 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- linuxfoundation tekton pipelines, tektoncd pipeline +1 moreTekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion6.5 Medium
- mozilla firefox, thunderbird +1 moreDenial-of-service in the Audio/Video: Playback component7.5 High
- mozilla firefox, thunderbird +1 moreDenial-of-service in the Audio/Video: Playback component7.5 High
- mozilla firefox, thunderbird +1 moreOther issue in the Networking: DNS component5.3 Medium
- nodejs undiciundici WebSocket client vulnerable to denial of service via cumulative fragment bypass7.5 High
- nodeca js-yamljs-yaml: YAML merge-key chains can force quadratic CPU consumption5.3 Medium
- nodejs node, node.js +1 moreA flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames,...5.3 Medium
- juliangruber brace-expansionbrace-expansion: Large numeric range defeats documented `max` DoS protection6.5 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths7.5 High
- openbaoOpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)3.1 Low
- otrs ag otrsPossible DoS via SQL Box4.5 Medium
- lm-sys fastchatlm-sys fastchat Worker API Endpoint api_generate resource consumption6.9 Medium
- lagom whmcs templateLagom WHMCS Template Datatables resource consumption5.3 Medium
- open-telemetry opentelemetry.exporter.jaeger, opentelemetry, open-telemetry opentelemetry-dotnet +2 moreOpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path5.9 Medium
- openclawOpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime Path8.2 High
Meridian.MappingNuGet,Meridian.MediatorNuGet +1 moreMeridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)7.5 High- patrickjuchli basic-ftpbasic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()7.5 High
- netfoundry zrokzrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing7.5 High
- fastapiexpert python-multipartPython-Multipart affected by Denial of Service via large multipart preamble or epilogue data5.3 Medium
- bosch divar ip 7000 r2, divar ip all-in-one 5000, divar ip all-in-one 7000 +5 more +7 moreUncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows...7.5 High
- legion of the bouncy castle inc. bc-java, red hat openshift developer tools and services, openshift developer tools and services 4.12 +30 more +32 moreUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.8.7 High
- boazsegev facil.io, iodine +1 morefacil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition8.7 High
- jellyfinJellyfin: Potential Application DoS from excessively large SyncPlay group names6.5 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Uncontrolled Resource Consumption (CWE-400)2.4 Low
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Uncontrolled Resource Consumption (CWE-400)2.4 Low
- schneider electric powerchute™ serial shutdown, schneider-electric powerchute serial shutdown +1 moreCWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive...5.3 Medium
- monetrmonetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation8.2 High
- microsoft .net, .net framework, .net 10.0 +15 more +17 more.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability7.5 High
- microsoft .net, powershell 7.6, microsoft .net 10.0 +11 more +13 more.NET Denial of Service Vulnerability7.5 High
- python pillow, red hat lightspeed core, openshift lightspeed +27 more +29 morePillow is vulnerable to a FITS GZIP decompression bomb8.7 High
- ffmpegAn improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of...7.5 High
- Show moreLoading…