CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
open62541DebianAn issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service...7.5 Highopen62541DebianAn issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service...7.5 Highopen62541Debianopen62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow...7.5 High- moby sysgithub.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files5.5 Medium
- pyca cryptographypython-cryptography: Duplicate self-signed intermediates can cause exponential path-building8.7 High
- aio-libs aiohttpAIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)7.1 High
- juliangruber brace-expansionbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation7.5 High
- No product listedAn issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of...7.5 High
- No product listedAn integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2...7.5 High
- No product listedThe Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user...7.5 High
- No product listedAn issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of...7.5 High
- thumborThumbor proportion filter allows unbounded post-transform resize leading to remote DoS7.5 High
- thumborThumbor has Regex Denial of Service (ReDoS) in `convolution` filter7.5 High
- pterodactyl wingsWings: Maliciously crafted packet during SFTP connection handshake causes denial of service7.5 High
- pterodactyl wingsWings: Maliciously or erroneously created parsed config files can cause wings process to OOM5.5 Medium
- gnome gnome-remote-desktop, red hat enterprise linux 10, enterprise linux 10.0 extended update support +2 more +4 moreGnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service7.5 High
- nodejs nodeA flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in...6.2 Medium
- nodejs nodeA flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response...5.9 Medium
- nodejs nodeA flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory...7.5 High
- ibm engineering requirements management doors and doors web access, engineering requirements management doors web access +1 moreIBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities7.5 High
- ibm db2IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries6.2 Medium
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities7.5 High
- olivetinOliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)7.5 High
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)6.2 Medium
- No product listedKong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision7.1 High
- No product listedKong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision7.1 High
- apache traffic serverApache Traffic Server: ts_lua plugin has initialization and resource-handling errors8.2 High
- apache traffic serverApache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion8.2 High
- apache traffic serverApache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server8.7 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities7.5 High
- quiet-terminal-interactive qtineonQTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding8.6 High
- apache tomcatApache Tomcat: DoS via WebSocket chat example5.3 Medium
- pivotickPivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data8.2 High
- xenx86 shadow paging is deprecated7.5 High
- lookylooZip Bomb in Lookyloo Capture Upload Allows Denial of Service6.9 Medium
- apple ipados, macos, safari +3 more +5 moreThis issue was addressed through improved state management. This issue is fixed in Safari 26.6,...6.5 Medium
- apple macosA logic issue existed resulting in memory corruption. This was addressed with improved state...5.5 Medium
- apple macosThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreThe issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS...5.5 Medium
- apple macosA denial of service issue was addressed by removing the vulnerable code. This issue is fixed in...5.5 Medium
- ggml-org llama.cppggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion6.9 Medium
opensbiDebian,qemuAzure Linux +1 moreAn issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via...7.5 High- libp2p py-libp2ppy-libp2p: yamux connection DoS via oversized data frame7.5 High
- ericcornelissen shescapeShescape: Quadratic-time denial of service in flag-protection8.7 High
- anephenix hubHub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion7.5 High
org.openidentityplatform.opendj:opendj-dsml-servletMavenOpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway9.4 Critical- cloudreveCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)6.5 Medium
- nodeca js-yamljs-yaml: Exponential parsing time in the flow collections leads to denial of service7.5 High
- isaacs node-tarnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection7.5 High
- svelte sveltekit, sveltejs kit +1 moreSvelteKit before 2.69.1 Denial of Service via Remote Form6.9 Medium
- Show moreLoading…