CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- vllmvLLM before 0.27.0 Denial of Service via DeepStream Backend6.9 Medium
- poppler innodata labsUncontrolled memory usage in Innodata Labs’ Poppler JPX decoder8.7 High
- libp2p js-libp2plibp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion7.5 High
- ransomlookRansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts8.8 High
- No product listedAn integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit...7.5 High
- getkin kin-openapikin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding8.7 High
- bluewave-labs checkmateCheckmate: Pre-auth Denial of Service via File Upload on Registration7.5 High
- misp misp-stixDenial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library8.7 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.5 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS4.4 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.5 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS5.5 Medium
- axllent mailpitMailpit: SMTP command parser buffers unbounded command lines before syntax rejection5.3 Medium
- axllent mailpitMailpit: Thumbnail generation decodes unbounded image dimensions before scaling5.3 Medium
io.netty.incubator:netty-incubator-codec-bhttpMavennetty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding7.5 Highio.netty.incubator:netty-incubator-codec-bhttpMavennetty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields8.7 Highio.netty.incubator:netty-incubator-codec-bhttpMavennetty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary7.5 Highgithub.com/opentofu/opentofuGoOpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers2.6 Low- libeventLibevent: Unbounded memory accumulation in WebSocket server via fragmented frames7.5 High
- apache inlongApache InLong: Ordinary users can create new packages5.3 Medium
- apache inlongApache InLong: Non-template responsible persons can view template information4.3 Medium
- splunk connect for kafkaDenial of Service (DoS) through the REST API in Splunk Connect for Kafka5.9 Medium
- harttle liquidjsLiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process7.5 High
- coturncoturn: Chained mobility resumes allow authenticated remote memory exhaustion6.5 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.5 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.5 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.5 High
- rdk rdk-b webuiRDK WebUI uncontrolled resource consumption7.5 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.5 High
geolensPyPIGeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)No score- modelcontextprotocol php-sdkMCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service6.9 Medium
- inspektor-gadgetInspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS6.9 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS6.5 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.5 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.5 High
- apache tomcatApache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset7.5 High
- python-hyper hpackhpack: Unbounded variable integer decoding can cause run-away computation on malformed input6.3 Medium
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...7.5 High
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...6.0 Medium
- oracle workflowVulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow...7.5 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...7.5 High
- oracle corporation java seVulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle...7.5 High
- mobsf mobile-security-framework-mobsfMobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction4.9 Medium
- sureformsSureForms contains an uncontrolled resource consumption vulnerability7.5 High
- mozilla firefox, thunderbird +1 moreDenial-of-service in the Widget component7.5 High
- siyuan-note siyuanSiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM5.3 Medium
- apple ipados, macos, tvos +4 more +6 moreThe issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1...6.5 Medium
- deskflowDeskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit6.5 Medium
- vllmvLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds4.3 Medium
- hp inc smart tank 210 printer, smart tank 215 printer, smart tank 218 printer +36 more +38 moreCertain HP Smart Tank All in One – Potential Denial of Service6.9 Medium
- Show moreLoading…