CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- imagemagickImageMagick before 7.1.2-26 Heap Use-After-Free via XMP6.3 Medium
- imagemagickImageMagick before 7.1.2-26 Memory Allocation Policy Bypass4.8 Medium
credsweeperPyPICredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources5.5 Medium- m2team nanazipNanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields2.4 Low
- m2team nanazipNanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size2.4 Low
- m2team nanazipNanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields2.4 Low
- excelizeExcelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation8.7 High
- grafana, grafana oss +1 morePre-authentication denial of service via the OAuth login route5.3 Medium
- grafana, grafana oss +1 moreDenial of service via unbounded request body size7.5 High
- apache software foundation iotdbApache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError7.5 High
adm-zipnpm,@rootio/adm-zipRoot +1 moreadm-zip: Crafted ZIP file triggers 4GB memory allocation7.5 High- python, python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreIncremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations8.7 High
- hapifhir org.hl7.fhir.coreHAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint7.5 High
- facelessuser soup sieve, soupsieve +1 moreSoup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser7.5 High
- facelessuser soup sieve, soupsieve +1 moreSoup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve7.5 High
phantom-audioPyPIPhantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths7.7 High- pyloadpyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager6.5 Medium
- No product listedTenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP...7.5 High
- libp2p js-libp2plibp2p: CPU DoS via oversized IHAVE and IWANT control message arrays7.5 High
- linuxfoundation nats-serverNATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory7.5 High
- py-pdf pypdfpypdf: Possible infinite loop for not terminated inline images8.7 High
- httplib2httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling7.5 High
- py-pdf pypdfpypdf: Possible long runtimes for repeated malformed cross-reference entries6.9 Medium
- immutable-js immutable, immutable-js +1 moreImmutable.js `List` 32-bit trie overflow → unrecoverable DoS8.7 High
- immutable-js immutable, immutable-js +1 moreImmutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set8.7 High
- nodeca js-yamljs-yaml: YAML merge-key chains can force quadratic CPU consumption7.5 High
- academysoftwarefoundation openexrOpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts6.2 Medium
- No product listedIn OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists...7.5 High
- erweixin ratexratex-parser has unbounded parser recursion that leads to stack overflow (process abort)6.9 Medium
- erweixin ratexratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)8.7 High
- scrapy protegoProtego: Exponential backtracking ReDoS in robots.txt URL wildcard matching7.1 High
- vllmvLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit6.5 Medium
- beyondtrust privileged remote access, remote support +1 moreHigh-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access8.7 High
- red hat advanced cluster security 4, advanced cluster security 4.9, advanced cluster security for kubernetes 4.11 +1 more +3 moreStackrox: stackrox: unbounded graphql query depth allows authenticated denial of service7.7 High
- apache iotdbApache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query7.5 High
- fulgur-rs fulgurFulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service7.5 High
- fulgur-rs fulgurFulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service7.5 High
hdrhistogramDebian,netavarkRed Hat,netavark-testsRed Hat +2 moreHdrHistogram AbstractHistogram.java memory allocation4.8 MediumhdrhistogramDebian,netavarkRed Hat,netavark-testsRed Hat +1 more +3 moreHdrHistogram AbstractHistogram.java memory allocation4.8 Medium- gitea open source git serverGitea git grep search lacks a timeout7.5 High
- simplesamlphp saml2SimpleSAMLphp SAML2: Possible DoS via XPath Transform7.5 High
- erlang otp, erlang\/otp, erlang\/ssh +2 moreSSH SFTP server denial of service via extended channel data infinite loop5.3 Medium
- eclipse foundation parssonIn Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did...7.5 High
- No product listedAn issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of...7.5 High
- linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation +1 moreOpenTelemetry Javaagent RMI context propagation allows resource exhaustion5.3 Medium
- torchbox wagtailWagtail: Denial of service via unbounded filter specs in the image preview4.3 Medium
- imagemagickImageMagick: Infinite Loop in connected-components when providing invalid arguments4.7 Medium
- imagemagickImageMagick: Stack Overflow in MVG decoder due to missing depth check.5.3 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service6.5 Medium
- apache httpcomponents coreApache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK7.5 High
- Show moreLoading…