CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- ash-project ashMatch regex runs on over-length input in Ash.Type.String, enabling regex denial of service5.9 Medium
- kamailioAn issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via...7.5 High
- kamailioAn issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via...7.5 High
- No product listedAn issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via...7.5 High
- google androidIn add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource...5.5 Medium
- google androidIn parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of...5.5 Medium
- tornadoweb tornadoTornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop7.5 High
- expressjs multermulter vulnerable to Denial of Service via oversized array index in field names7.5 High
- expressjs multermulter vulnerable to Denial of Service via file descriptor leak on aborted uploads7.5 High
- plone plone.app.eventplone.app.event: Denial of service via iCalendar import9.1 Critical
- plone plone.app.portletsplone.app.portlets: Denial of service via RSS feed portlet9.1 Critical
- kubevelaKubeVela Terraform remote loader DoS via unbounded file read8.5 High
- filebrowserfilebrowser through 2.63.23 Denial of Service via named pipes8.2 High
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can select a compression algorithm for the IMAP connection...6.5 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreA host listed as a trusted proxy can send forwarding information containing a NUL byte, which...4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn unauthenticated attacker can send an IMAP ID command with a very large number of parameters...7.5 High
- open-xchange gmbh ox dovecot ceAn unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process...5.9 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that can send mail to a user can craft a message header whose values are chosen to...6.5 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that can send mail to a user can craft a message header that makes the IMAP THREAD...6.5 Medium
- No product listedAn issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to...7.5 High
- No product listedAn issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to...7.5 High
- vllmvLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory...7.5 High
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause...4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn unauthenticated attacker can crash the ManageSieve login process by sending a small malformed...7.5 High
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that can send mail to a user can craft a message whose headers contain a very large...7.5 High
- adobe dimensionDimension Denial-of-Service8.7 High
- triliumnext triliumTrilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature8.1 High
- spring cloud config, vmware spring cloud config +1 moreSpring Cloud Config Monitor Denial of Service5.3 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Denial of Service via Unbounded List Growth in Data Binding7.5 High
- nltkNLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader6.3 Medium
- nltkNLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView6.3 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Denial of Service via KDF8.7 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon26.9 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Denial of Service via KDF8.7 High
- spring framework, vmware spring framework +1 moreSpring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions7.5 High
- broadcom spring batch, spring batch +1 moreDenial of Service in Spring Batch FlatFileItemReader via Malformed Input File5.9 Medium
- eclipse foundation jettyA client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are...8.7 High
- pterodactyl wingsPterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion7.7 High
- weblateorg weblateWeblate Has Uncontrolled Resource Consumption via6.5 Medium
- nlnet labs nsdRemote UDP DoS by sending multiple DNS Cookie options8.2 High
- No product listedAn issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src...9.3 Critical
- No product listedAn issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a...7.5 High
- No product listedAn issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a...7.5 High
- mesop-dev mesopMesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server8.7 High
- deislabs orasORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption6.5 Medium
- collective icalendaricalendar: Algorithmic Complexity in Equality7.5 High
- adobe c2pa, c2pa tool, c2patool +1 more +3 moreCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)7.5 High
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morezipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits2.1 Low
- mervinpraison praisonaiPraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)6.5 Medium
- lin-snow ech0Ech0 before 5.0.1 Denial of Service via Accept-Language8.7 High
- Show moreLoading…