CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- nettyNetty: Memory Exhaustion in SctpMessageCompletionHandler7.5 High
- andialbrecht sqlparsesqlparse: Quadratic O(n²) DoS in group_comments8.7 High
- quantumnous new-apiNew API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging7.5 High
mini-httpdDebianAn issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service...7.5 High- stoatchatstoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service8.7 High
- @fastify/multipart, fastify fastify-multipart +1 more@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit7.5 High
- apache strutsApache Struts: Unbounded read of a Content Security Policy violation report7.5 High
- c-aresc-ares: Memory-amplification denial of service via unvalidated DNS header record counts5.3 Medium
- trendnet tew-816drmTRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources6.9 Medium
- apache strutsApache Struts: Unbounded read of a JSON request body7.5 High
- go standard library encoding/asn1Enforce maximum recursion depth in encoding/asn17.5 High
- ibm iIBM i is Affected By A Denial of Service Vulnerability in DRDA / DDM []5.3 Medium
- vllmvLLM: Completion prompt lists fan out into unbounded engine requests6.5 Medium
- vllmvLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-555745.3 Medium
- samsung rlottieUncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive...6.5 Medium
- encode django-rest-frameworkDjango REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`5.3 Medium
- coturncoturn: mobility disconnects bypass allocation quotas and exhaust relay capacity6.5 Medium
- coturnThe coturn server can end in a state where it does not accept more requests with "even-port" enabled.7.1 High
- coturncoturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS8.2 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows DHCP Client Denial of Service Vulnerability6.5 Medium
- adobe c2pa, c2pa-web, c2patool +3 more +5 moreCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)6.2 Medium
- adobe c2pa, c2pa-web, c2patool +3 more +5 moreCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)6.2 Medium
- adobe c2pa, c2pa-web, c2patool +3 more +5 moreCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)7.5 High
- intel proset\/wireless wifiUncontrolled resource consumption for some Intel(R) PROSet/Wireless WiFi Software for Windows...6.9 Medium
- gchq cyberchefCyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL4.3 Medium
- linuxIB/mad: Drop unmatched RMPP responses before reassembly7.1 High
- linuxgve: fix Rx queue stall on alloc failure7.5 High
- apache software foundation iotdbApache IoTDB: RPC service denial of service via unchecked Thrift string length7.5 High
- flippercode wp maps proWP Maps Pro < 6.1.3 - Unauthenticated Denial of Service7.5 High
- jupyterhubJupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login5.3 Medium
- hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.validation +2 more +4 moreHAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service7.5 High
- hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.validation +2 more +4 moreHAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service7.5 High
- py-pdf pypdfpypdf: Possible large memory usage for large /ToUnicode streams4.8 Medium
- hashicorp consul, consul enterprise +1 moreUnauthenticated denial of service via unbounded request body processing5.3 Medium
- gopacketgopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser7.5 High
- unknown wp mapsWP Maps < 4.9.7 - Subscriber+ Denial of Service6.5 Medium
- No product listedIn sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling...7.5 High
- thephpleague commonmarkLeague CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass5.3 Medium
- apache cxfApache CXF: Denial of service via message header attachments7.5 High
- apache cxfApache CXF: No default restriction on the amount of form parameters per message7.5 High
- @clerk nuxtNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering7.5 High
- rclonerclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory5.9 Medium
- hewlett packard enterprise (hpe) hpe integrated lights-out 6 (ilo 6), hpe integrated lights-out 6 firmware +1 moreA potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior...6.5 Medium
- apache answerApache Answer: Denial of service via crafted Accept-Language header parsing7.5 High
- No product listedAn issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the...7.5 High
open62541DebianAn issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service...7.5 High- openwebui open webui, open-webui +1 moreOpen WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing6.5 Medium
- nodeca js-yamljs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources7.5 High
- eclipse miloIn Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception...6.9 Medium
open62541Debianopen62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src...7.5 High- Show moreLoading…