cve.bz

CWE-400: Uncontrolled Resource Consumption, page 39

Filter

The product does not properly control the allocation and maintenance of a limited resource.

What the weakness is: CWE-400 at MITRE

Ask an AI about CWE-400

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-400: Uncontrolled Resource Consumption and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/400.html and https://cve.bz/cve/cwe/400?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2025-21352EPSS 1.0%

    Internet Connection Sharing (ICS) Denial of Service Vulnerability

  2. 7.5CVE-2025-21351EPSS 2.5%

    Windows Active Directory Domain Services API Denial of Service Vulnerability

  3. 7.5CVE-2025-21181EPSS 3.5%

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

  4. 6.9CVE-2024-23814EPSS 0.6%

    The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment re-assembly. This could allow an unauthenticated …

  5. 5.5CVE-2025-25193EPSS 0.4%

    Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded …

  6. 6.5CVE-2024-54658EPSS 0.5%

    The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing web content may lead to a denial-of-service.

  7. 6.5CVE-2025-25186EPSS 0.6%

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-…

  8. 5.5CVE-2024-57673EPSS 0.2%

    An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module and Linkdiscovery module

  9. 5.5CVE-2024-57672EPSS 0.1%

    An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topologylnstance module, Routing module.

  10. 7.5CVE-2024-45626EPSS 0.8%

    Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, w…

  11. 7.5CVE-2024-57085EPSS 0.4%

    A prototype pollution in the function deepMerge of @stryker-mutator/util v8.6.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

  12. 6.5CVE-2024-57082EPSS 0.3%

    A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

  13. 7.5CVE-2024-57081EPSS 0.5%

    A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

  14. 7.5CVE-2024-57079EPSS 0.4%

    A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

  15. 7.5CVE-2024-57076EPSS 0.5%

    A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

  16. 7.5CVE-2024-57075EPSS 0.6%

    A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

  17. 7.5CVE-2024-57074EPSS 0.4%

    A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

  18. 8.9CVE-2025-21087EPSS 0.4%

    When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reach…

  19. 8.9CVE-2025-20058EPSS 0.4%

    When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

  20. 6.5CVE-2024-53851EPSS 0.5%

    Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs wasn't enforcing limits on the number of URLs that it accepted, allowing a malicious user to inflict d…

  21. 7.5CVE-2024-56921EPSS 0.5%

    An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of gmm_state_exception() function upon receipt of the Nausf_UEAuthentication_Authentica…

  22. 7.5CVE-2024-57519EPSS 0.7%

    An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file.

  23. 5.5CVE-2025-24151EPSS 0.2%

    The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to cause unexpected system termination or corrupt kernel memory.

  24. 7.3CVE-2025-24126EPSS 1.4%

    An input validation issue was addressed. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on the local network may be able to corrupt proce…

  25. 6.7CVE-2024-12345EPSS 0.3%

    A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx of the component Daily Huddle Site. The manipulation of the argument s leads to r…

  26. 6.9CVE-2025-0704EPSS 0.7%

    A vulnerability, which was classified as problematic, was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. Affected is the function qrCode of the file src/main/java/io/github/controller/QrCodeController.java. The…

  27. 6.5CVE-2024-53299EPSS 1.5%

    The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.

  28. 6.5CVE-2024-57724EPSS 0.4%

    lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.

  29. 7.5CVE-2023-37022EPSS 0.8%

    Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID` field causes Open5gs to crash; an attacker may repeatedly send such packets to …

  30. 7.5CVE-2023-37014EPSS 0.8%

    Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Release Request` message missing a required `MME_UE_S1AP_ID` field …

  31. 6.5CVE-2024-43763EPSS 0.1%

    In build_read_multi_rsp of gatt_sr.cc, there is a possible denial of service due to a logic error in the code. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction…

  32. 7.5CVE-2024-24424EPSS 0.4%

    A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.

  33. 7.5CVE-2025-21549EPSS 0.6%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access…

  34. 6.4CVE-2025-21548EPSS 0.5%

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access vi…

  35. 9.1CVE-2025-21547EPSS 0.6%

    Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.20, 5.6.25.8, 5.6.26.6 and 5.6.27.1. Easily exploitable vulnerability …

  36. 7.5CVE-2025-21545EPSS 0.5%

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Supported versions that are affected are 8.60 and 8.61. Easily exploitable vulnerability allows unauthenticated attacker with ne…

  37. 4.9CVE-2025-21529EPSS 1.1%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows hi…

  38. 7.5CVE-2025-23184EPSS 2.2%

    A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file…

  39. 5.5CVE-2018-9447EPSS 0.09%

    In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible way to crash the emergency callback mode due to a missing null check. This could lead to local denial of service with no additional execution privileges needed. User …

  40. 7.5CVE-2024-50953EPSS 0.4%

    An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message.

  41. 7.5CVE-2024-54730EPSS 0.5%

    Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function.

  42. 7.5CVE-2025-21389EPSS 2.0%

    Uncontrolled resource consumption in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to deny service over a network.

  43. 7.5CVE-2025-21330EPSS 2.1%

    Windows Remote Desktop Services Denial of Service Vulnerability

  44. 7.5CVE-2025-21300EPSS 2.6%

    Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability

  45. 7.5CVE-2025-21290EPSS 2.4%

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

  46. 7.5CVE-2025-21289EPSS 2.4%

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

  47. 7.5CVE-2025-21270EPSS 2.4%

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

  48. 7.5CVE-2025-21251EPSS 2.6%

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

  49. 7.5CVE-2025-21231EPSS 2.6%

    IP Helper Denial of Service Vulnerability

  50. 7.5CVE-2025-21230EPSS 2.7%

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability