CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- apache httpcomponents coreApache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration7.5 High
- hp inc ccx, edge e, trio c60 +2 morePoly Voice Devices (CCX, Trio, Edge E) – Potential Denial of Service8.2 High
- mozilla thunderbirdDenial-of-service via malicious LDAP address-book server5.3 Medium
- py-pdf pypdfpypdf: Missing stream length values ignore defined limits6.9 Medium
- ibm websphere extreme scaleIBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled6.5 Medium
- sanko net::bittorrentNet::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input7.5 High
- sanko net::bittorrentNet::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix7.5 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-492707.5 High
- juliangruber brace-expansionbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups7.7 High
- samverschueren decode-uri-componentdecode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input6.6 Medium
- No product listedAn issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of...7.5 High
- gtermars javascript::minifier::xsJavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth7.5 High
- apache software foundation kerbyApache Kerby: StackOverflow on parsing deeply nested ASN1 structures6.5 Medium
- No product listedAn issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of...7.5 High
- No product listedAn integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to...7.5 High
- aquasec trivyTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser6.9 Medium
- powerdns authoritativeInsufficient input validation of internal web server4.3 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moremptcp: allow subflow rcv wnd to shrink7.5 High
- linux, linux kernel +1 morevsock/virtio: fix potential unbounded skb queue7.1 High
- No product listedA reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows...7.5 High
- No product listedAn issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers...7.5 High
- significant-gravitas autogptAutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features7.7 High
- lepture mistune, red hat migration toolkit for applications 8, openshift ai (rhoai) +3 more +5 moreMistune: Potential DoS via quadratic-time parsing in parse_link_text8.7 High
- fasterxml jackson-databindjackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()6.3 Medium
- gogsGogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)5.5 Medium
- cap-go capgoCapgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy8.7 High
virtuoso-opensourceDebianAn issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers...7.5 Highskillctlcrates.ioskillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgeryNo score- grafana, grafana enterprise, oss +2 morePre-authentication denial of service in the public dashboard query endpoint7.5 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities5.9 Medium
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption7.5 High
- pydantic pydantic-settingsNestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size5.3 Medium
- ihor-sokoliuk mcp-searxngmcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`7.5 High
- langflowLangflow: Unauthenticated DoS through multipart form boundary file upload7.5 High
ultimate-sitemap-parserPyPIUltimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit7.5 High- corewcfCoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake7.5 High
- grafana tempo, enterprise traces (get) +1 moreTempo TraceQL query with exemplar hint could result in unbounded memory usage6.5 Medium
- sunnyadn js-tomlCPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals7.5 High
web-token/jwt-frameworkPackagist,web-token/jwt-libraryPackagist +1 morePHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service8.7 High- nodejs node, node.js +1 moreA flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a...5.3 Medium
- significant-gravitas autogptAutoGPT has a DoS vulnerability in MediaDurationBlock8.7 High
- significant-gravitas autogptAutoGPT has a DoS vulnerability in AddAudioToVideoBlock7.1 High
- significant-gravitas autogptAutoGPT has a DoS vulnerability in ScreenshotWebPageBlock8.7 High
- significant-gravitas autogptAutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock8.7 High
- significant-gravitas autogptAutoGPT has a DoS vulnerability in LoopVideoBlock8.7 High
- jline, jline jline3 +1 moreJLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables7.5 High
- jline, jline jline3 +1 moreJLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry7.5 High
- steeltoeoss steeltoe.discovery.eurekaSteeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch7.5 High
- authlib joserfcjoserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization5.3 Medium
- langflowLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak9.3 Critical
- Show moreLoading…