CWE-405: Asymmetric Resource Consumption (Amplification)
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- py-pdf pypdf pypdf: Possible large memory usage for exceptions in strict mode 7.1 High
- isaacs minimatch minimatch: potential denial of service via globparts amplification 6.9 Medium
- No product listed Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key 7.5 High
- angular Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) 8.2 High
-
libcpanel-json-xs-perlDebian,perl-Cpanel-JSON-XSAzure Linux +1 more Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum 7.5 High - nodejs undici undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering 5.9 Medium
- microsoft visual studio 2022 version 17.14, visual studio 2026 version 18.10, system.security.cryptography.pkcs +2 more .NET Denial of Service Vulnerability 5.9 Medium
- misskey-dev misskey Misskey: Lack of rate limiting and size restrictions in RSS fetching API 8.7 High
- microsoft .net, .net framework, .net framework 3.5 +8 more +10 more .NET Denial of Service Vulnerability 7.5 High
- go standard library crypto/tls Reject malformed ECH outer extension references in crypto/tls 7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 more Excessive CPU consumption from repeated initial window changes in net/http 7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 more HTTP/2 server memory exhaustion due to Trailer headers in net/http 7.5 High
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 more IBM DataPower Gateway Denial of Service 7.5 High
- wolfssh wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion 6.9 Medium
- apache struts Apache Struts: Disproportionate response size when rendering BigDecimal request parameters 7.5 High
- zcashfoundation zebra Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification 8.7 High
- zcashfoundation zebra Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions 6.9 Medium
- zcashfoundation zebra Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification 8.7 High
- apache software foundation directory ldap api Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords 7.5 High
- isc bind 9 Message parser retains every identical singleton RDATA, enabling wire-to-work amplification 5.3 Medium
- concrete cms cms Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search 2.1 Low
- openwebui open webui, open-webui +1 more Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout 7.5 High
- thephpleague commonmark commonmark 2.0.0 before 2.8.4 Denial of Service via XML 6.9 Medium
- No product listed Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries 4.3 Medium
- py-pdf pypdf pypdf: Possible long runtimes/large memory usage when retrieving outlines 4.8 Medium
- openssl Excessive Memory Use Buffering DTLS Records for a Future Epoch 7.5 High
- zabbix Frontend DoS via the validate.api.exists action 5.1 Medium
- zabbix Frontend DoS via the popup.testtriggerexpr action 5.3 Medium
- mastodon Mastodon: Exhausting data by an unauthenticated request to the admin retention API 7.5 High
- thephpleague commonmark League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass 5.3 Medium
- thephpleague commonmark league/commonmark: Quadratic-time denial of service when parsing crafted Markdown 7.5 High
- thephpleague commonmark league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes 6.1 Medium
- samverschueren decode-uri-component decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input 6.6 Medium
- significant-gravitas autogpt AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock 5.3 Medium
- ubb systems ubb.threads Denial of Service in UBB.threads 7.1 High
- envoyproxy envoy, red hat openshift service mesh 2.6, openshift service mesh 3.0 +4 more +6 more Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification 7.5 High
- nezumi text::linefold Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters 6.2 Medium
-
Nerdbank.MessagePackNuGet Nerdbank.MessagePack has a memory amplification DoS in collection deserialization 5.3 Medium - synology dns server Technitium DNS Server excessive DNSSEC requests 6.9 Medium
- deskflow Deskflow: TLS multiplexer DoS on failed `SSL_accept` 7.5 High
- openclaw OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing 6.9 Medium
- openclaw OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook 6.9 Medium
- bitcoin core Bitcoin Core through 29.0 allows a denial of service via a crafted transaction. 5.3 Medium
- mongodb inc server, mongodb, inc. mongodb server +1 more Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server 8.7 High
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (admintools) +1 more Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools) 6.5 Medium
- sap se businessobjects bi platform, sap businessobjects business intelligence platform +1 more Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform 7.5 High
- svelte devalue, red hat build of podman desktop - tech preview, trusted artifact signer 1.2 +1 more +3 more devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse 7.5 High
- svelte devalue, red hat build of podman desktop - tech preview, trusted artifact signer 1.2 +1 more +3 more devalue vulnerable to denial of service due to memory exhaustion in devalue.parse 7.5 High
- marshmallow-code marshmallow Marshmallow has DoS in Schema.load(many) 5.3 Medium
- sap se s/4 hana private cloud (financials general ledger) Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger) 7.1 High
- Show olderLoading…