CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Also known as Resource Exhaustion.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- vllmvLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool6.5 Medium
- zip-rs zip2zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size7.5 High
- nocodbNocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources6.3 Medium
libosmocoreDebianlibosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src...7.5 High- smg-project smgsmg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation6.9 Medium
- vllmvLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass8.7 High
- imagemagickImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder6.9 Medium
postal-mimenpmpostal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words7.5 High- labstack echoEcho: Decompress permits unbounded gzip expansion in v48.2 High
- labstack echoEcho: BodyDump captures request and response bodies without size limits in v48.2 High
- twistedTwisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer7.5 High
- twistedTwisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer7.5 High
- twistedTwisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree8.7 High
- twistedTwisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH4.9 Medium
- py-pdf pypdfpypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)7.1 High
- py-pdf pypdfpypdf: Possible long runtimes for repeated references to the same missing object7.1 High
- part-db part-db-serverPart-DB: Attachment Size Limit Bypass via API Base64 Upload5.3 Medium
- part-db part-db-serverPart-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads5.3 Medium
- No product listede-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption...7.5 High
- lepture mistuneMistune before 3.3.0 Quadratic-Time DoS via parse_link_text8.7 High
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-107.5 High
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-87.5 High
- phpoffice phpspreadsheetPhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)8.7 High
- py-pdf fpdf2fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'6.5 Medium
- graphql-python graphql-coreGraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule7.5 High
- graphql-python graphql-coreGraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit7.5 High
- open-telemetry opentelemetry-pythonOpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api5.3 Medium
- zip-rs zip2zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction7.5 High
- splunk, splunk enterprise +1 moreDenial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise7.5 High
- splunk, splunk enterprise +1 moreDenial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise7.5 High
- python pillowPillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)6.5 Medium
- python pillowPillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS7.1 High
- python pillowPillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode6.5 Medium
- binarymuse toml-nodetoml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()7.5 High
- encode django-rest-frameworkDjango REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation7.5 High
- apache software foundation traffic serverApache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout6.9 Medium
- apache software foundation traffic serverApache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service8.7 High
- apache software foundation traffic serverApache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion7.7 High
- flarum frameworkSession Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 88.7 High
- cisco cyber vision, open source snort3, secure firewall threat defense (ftd) software +1 more +3 moreMultiple Cisco Products Snort 3 Software Hardening Release: October 20267.5 High
- py-pdf pypdfpypdf: Possible large memory usage for streams with multiple filters6.0 Medium
- py-pdf pypdfpypdf: Possible large memory usage when parsing content streams6.0 Medium
- py-pdf pypdfpypdf: Possible large memory usage when parsing arrays and dictionaries6.0 Medium
- py-pdf pypdfpypdf: Possible long runtimes/large memory usage when retrieving form fields6.0 Medium
- apache software foundation brpcApache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof7.5 High
- apache software foundation brpcApache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request7.5 High
- apache software foundation brpcApache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path7.5 High
- apache software foundation brpcApache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits7.5 High
- apache software foundation iotdb jdbc driverApache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver7.5 High
- python pillowPillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion8.2 High
- Show moreLoading…