CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- netdataNetdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreRpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service7.5 High
- radare radare2radare2: Uncontrolled resource consumption in radare2 PEF loader5.5 Medium
- fasterxml jackson-corejackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS7.5 High
- nvidia infrastructure controller, infra controller +1 moreNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause...6.5 Medium
- nvidia infrastructure controller, infra controller +1 moreNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause...6.5 Medium
- apache software foundation tomcatApache Tomcat: DoS via busy wait during WebSocket close7.5 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service5.9 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service7.1 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Atom-table exhaustion via reply-to queue name decoding7.1 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata6.9 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Atom exhaustion: to_atom on runtime-parameter component6.9 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Atom exhaustion: to_atom on global-parameter :name5.9 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list6.9 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client5.9 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: JMS topic exchange erl_scan atom exhaustion6.0 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Atom table exhaustion via management API node field6.0 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Atom table exhaustion via stream `chunk_selector`6.0 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values6.0 Medium
- red hat exploit intelligence, build of apache camel 3.33.4.redhat, build of apache camel 4 for quarkus 3 +4 more +6 moreQuarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service7.5 High
- apache neethiApache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely4.3 Medium
- oisf suricataSuricata smb: some SMB flows can cause resource exhaustion5.9 Medium
- oisf suricataSuricata http1: repeated brotli compression bombs can cause excessive CPU consumption7.5 High
- sveltejs devaluedevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers7.5 High
- internlm lmdeployLMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading8.8 High
- imagemagickImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder6.3 Medium
- imagemagickImageMagick before 7.1.2-31 Policy Bypass via PCD decoder4.8 Medium
- unknown really simple securityReally Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header5.3 Medium
- o-ran-sc smo oamO-RAN-SC SMO OAM VES Collector allocation of resources6.9 Medium
- o-ran-sc smo oamO-RAN-SC SMO OAM VES Collector allocation of resources5.3 Medium
- o-ran-sc smo oamO-RAN-SC SMO OAM VES Collector allocation of resources5.3 Medium
- o-ran-sc smo oamO-RAN-SC SMO OAM VES Collector memory allocation5.3 Medium
- asynchttpclient async-http-clientAsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service5.9 Medium
- asynchttpclient async-http-clientAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service7.5 High
- facelessuser soupsieveSoup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)5.3 Medium
- facelessuser soupsieveSoup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns5.3 Medium
- @libp2p floodsub, libp2p js-libp2p +1 morelibp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS7.5 High
- No product listedvgmstream mus_acm.c parse_mus resource consumption5.3 Medium
- patriksimek vm2vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry8.7 High
- open-telemetry opentelemetry-goOpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full6.3 Medium
- open-telemetry opentelemetry-goOpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation5.1 Medium
- apache software foundation myfacesApache MyFaces: Denial of Service via Unbounded Request Parsing7.5 High
- hapifhir org.hl7.fhir.coreHAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service7.5 High
- hapifhir org.hl7.fhir.coreHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service7.5 High
- vllmvLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation6.5 Medium
- node-opcuanode-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion7.0 High
- red hat build of keycloak 26.4, build of keycloak 26.4.16, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching7.5 High
- modelcontextprotocol rust-sdkRMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service7.5 High
- ag-ui-protocol ag-uiag-ui-protocol ag-ui JSON sse_parser.cpp resource consumption5.3 Medium
- ag-ui-protocol ag-uiag-ui-protocol ag-ui SSE Frame sse.rs resource consumption6.9 Medium
- Show moreLoading…