cve.bz

CWE-400: Uncontrolled Resource Consumption, page 3

Filter

The product does not properly control the allocation and maintenance of a limited resource.

What the weakness is: CWE-400 at MITRE

Ask an AI about CWE-400

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-400: Uncontrolled Resource Consumption and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/400.html and https://cve.bz/cve/cwe/400?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.0CVE-2026-113791EPSS 0.4%

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in versio…

  2. 6.0CVE-2026-113790EPSS 0.4%

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version …

  3. 6.0CVE-2026-113789EPSS 0.4%

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version …

  4. 7.5CVE-2026-86147EPSS 0.5%

    External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite file…

  5. 7.5CVE-2026-81755EPSS 0.7%

    Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive num…

  6. 7.5CVE-2026-78058EPSS 0.8%

    Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 fr…

  7. 7.5CVE-2026-61902EPSS 0.5%

    Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affe…

  8. 7.5CVE-2026-41114EPSS 0.6%

    Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.

  9. 7.5CVE-2026-85642EPSS 0.4%

    The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the dail…

  10. 6.9CVE-2026-114103EPSS 0.4%

    adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified…

  11. 8.7CVE-2026-114055EPSS 0.4%

    vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image siz…

  12. 8.6CVE-2026-93441EPSS 0.3%

    IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

  13. 7.5CVE-2026-91664EPSS 0.3%

    Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Succ…

  14. 4.3CVE-2026-91660EPSS 0.3%

    Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Succ…

  15. 3.7CVE-2026-91582EPSS 0.2%

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated atta…

  16. 4.3CVE-2026-91524EPSS 0.3%

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged att…

  17. 6.5CVE-2026-91479EPSS 0.2%

    Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment at…

  18. 6.5CVE-2026-91435EPSS 0.4%

    Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network a…

  19. 5.9CVE-2026-91421EPSS 0.4%

    Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with networ…

  20. 5.3CVE-2026-91418EPSS 0.4%

    Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0…

  21. 5.3CVE-2026-91417EPSS 0.3%

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.1…

  22. 5.3CVE-2026-91410EPSS 0.3%

    Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalV…

  23. 3.7CVE-2026-91409EPSS 0.4%

    Vulnerability in Oracle Java SE (component: Networking). The supported version that is affected is Oracle Java SE: 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compr…

  24. 3.1CVE-2026-91400EPSS 0.3%

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1,…

  25. 5.3CVE-2026-91373EPSS 0.4%

    Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Ent…

  26. 5.3CVE-2026-91352EPSS 0.3%

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated att…

  27. 7.5CVE-2026-91350EPSS 0.4%

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated att…

  28. 7.5CVE-2026-91349EPSS 0.3%

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated att…

  29. 7.5CVE-2026-91345EPSS 0.4%

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated att…

  30. 7.5CVE-2026-91344EPSS 0.4%

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated att…

  31. 4.3CVE-2026-91294EPSS 0.3%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged atta…

  32. 6.5CVE-2026-91284EPSS 0.3%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged a…

  33. 7.1CVE-2026-91256EPSS 0.4%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi…

  34. 7.5CVE-2026-91255EPSS 0.4%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis…

  35. 7.5CVE-2026-91254EPSS 0.4%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis…

  36. 8.2CVE-2026-91252EPSS 0.4%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comprom…

  37. 5.9CVE-2026-91247EPSS 0.3%

    Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated at…

  38. 4.7CVE-2026-91244EPSS 0.1%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where…

  39. 7.1CVE-2026-91238EPSS 0.4%

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with…

  40. 5.1CVE-2026-91208EPSS 0.1%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure wher…

  41. 5.5CVE-2026-87413EPSS 0.1%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure wher…

  42. 5.5CVE-2026-87411EPSS 0.1%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure wher…

  43. 7.5CVE-2026-87398EPSS 0.5%

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with ne…

  44. 7.5CVE-2026-87395EPSS 0.4%

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with ne…

  45. 7.5CVE-2026-87369EPSS 0.4%

    Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with netw…

  46. 5.3CVE-2026-83400EPSS 0.4%

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, …

  47. 4.2CVE-2026-60874EPSS 0.2%

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with netwo…

  48. 7.5CVE-2026-113729EPSS 0.5%

    Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference diges…

  49. 8.3CVE-2026-101593EPSS 0.4%

    Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows l…

  50. 5.3CVE-2026-101587EPSS 0.4%

    Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with …