CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- juliangruber brace-expansionbrace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion7.5 High
- juliangruber brace-expansionbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service5.3 Medium
- juliangruber brace-expansionbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion7.5 High
- beaugunderson ip-addressip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process6.3 Medium
- axiosAxios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location8.2 High
- axiosAxios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization8.2 High
- ag-ui-protocol ag-uiag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption5.3 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to denial of service4.9 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to denial of service6.5 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to denial of service6.5 Medium
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to denial of service6.5 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to denial of service6.5 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to denial of service6.5 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service6.5 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service6.5 Medium
- nettyNetty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS8.7 High
- nettyNetty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation8.7 High
- vllmvllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass7.1 High
- vllmvLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization7.1 High
- vllmvllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding6.9 Medium
- openclawOpenClaw before 2026.8.1 Denial of Service via Rate Limit6.9 Medium
- openclawOpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass6.9 Medium
- openclawOpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade8.7 High
- openclawOpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz22.3 Low
- openclawOpenClaw before 2026.8.2 Denial of Service via Browser Relay6.9 Medium
- zammadZammad: Denial of Service via OTRS Import Controller8.7 High
- containerdContainerd has image-pull DoS via crafted OCI index graph amplification6.9 Medium
- gerritRegular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review8.7 High
- gerritDenial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review8.7 High
- docmostDocmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service6.5 Medium
- zbateson mail-mime-parserzbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME7.5 High
- bytecodealliance wasmtimeWasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS6.9 Medium
- bytecodealliance wasmtimeWasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write6.9 Medium
- kvcache-ai mooncakekvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources5.3 Medium
- fasterxml jackson-corejackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service7.5 High
- fasterxml jackson-dataformats-binaryjackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service7.5 High
- fasterxml jackson-dataformats-binaryjackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service7.5 High
plone-app-contenttypesPyPIplone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length6.5 Medium- typelevel jawn, org.typelevel jawn-parser 2.12, jawn-parser 2.13 +1 more +3 moreJawn: Quadratic parsing effort in AsyncParser7.5 High
- red hat enterprise linux 10, enterprise linux 10.2 extended update support, enterprise linux 8 +2 more +4 moreGnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline7.5 High
pgbouncerAzure LinuxUnbounded SCRAM iteration count causes CPU exhaustion in PgBouncer5.9 Medium- brechtvds wp recipe makerWP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion8.2 High
- unknown divi-dashDivi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing8.2 High
- fasterxml jackson-databindjackson-databind: quadratic forward-reference completion in Collection and Map deserializers7.5 High
- fasterxml jackson-databindjackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID7.5 High
- fasterxml jackson-corejackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth7.5 High
- plone plone.app.contenttypes, plone.app.dexterity +1 moreplone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length6.5 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software6.5 Medium
- collective icalendaricalendar: Denial of service via unbounded VALARM REPEAT expansion6.5 Medium
- adobe c2pa, c2patool, content credentials command-line tool +1 more +3 moreCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)7.5 High
- Show moreLoading…