cve.bz

CWE-400: Uncontrolled Resource Consumption, page 50

Filter

The product does not properly control the allocation and maintenance of a limited resource.

What the weakness is: CWE-400 at MITRE

Ask an AI about CWE-400

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-400: Uncontrolled Resource Consumption and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/400.html and https://cve.bz/cve/cwe/400?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2023-39219EPSS 0.7%

    PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests

  2. 4.4CVE-2022-3698EPSS 0.2%

    A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and  Lenovo Diagnostics versions prior to 4.45 that could allow a local user with administrative access to trigger a system cr…

  3. 4.4CVE-2022-0353EPSS 0.2%

    A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and  Lenovo Diagnostics versions prior to 4.45 that could allow a local user with administrative access to trigger a system cr…

  4. 7.5CVE-2023-43622EPSS 69%

    An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well …

  5. 7.5CVE-2023-45810EPSS 0.6%

    OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in so…

  6. 4.3CVE-2023-5522EPSS 0.4%

    Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile app of users when viewing that particular channel.

  7. 4.4CVE-2022-43893EPSS 0.5%

    IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload. IBM X-Force ID: 240634.

  8. 7.5CVE-2023-44388EPSS 0.6%

    Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable…

  9. 4.3CVE-2023-45150EPSS 0.5%

    Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually mak…

  10. 7.5CVE-2023-40180EPSS 1.1%

    silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly aff…

  11. 5.5CVE-2023-5595EPSS 0.3%

    Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV.

  12. 7.5CVE-2022-43740EPSS 1.0%

    IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238921.

  13. 5.3CVE-2023-38251EPSS 0.8%

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-s…

  14. 7.5CVE-2023-36841EPSS 0.6%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows a unauthenticated network-based attacker to cause an infinite loop, resulting in a…

  15. 7.5CVE-2023-27314EPSS 0.9%

    ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to cause a crash of the HTTP service.

  16. 7.5CVE-2023-25774EPSS 0.8%

    A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connections can lead to denial of service. An attacker can send a sequence of malicious pa…

  17. 7.5CVE-2023-36703EPSS 2.5%

    DHCP Server Service Denial of Service Vulnerability

  18. 7.5CVE-2023-36606EPSS 69%

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

  19. 7.5CVE-2023-36579EPSS 2.5%

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

  20. 7.5CVE-2023-36435EPSS 5.7%

    Microsoft QUIC Denial of Service Vulnerability

  21. 7.5CVE-2023-36431EPSS 2.5%

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

  22. 7.5CVE-2023-36478EPSS 4.8%

    Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to ex…

  23. 7.5CVE-2023-44487KEVExploitEPSS >99.9%

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  24. 5.5CVE-2023-43786EPSS 0.5%

    A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.

  25. 4.4CVE-2023-37195EPSS 0.2%

    A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 1628 (All versions). Affected devices insufficiently control …

  26. 6.5CVE-2023-5333EPSS 0.6%

    Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specially crafted request to /api/v4/users/ids with multiple identical IDs.

  27. 7.5CVE-2023-5330EPSS 0.6%

    Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4/opengraph filling the cache and turning the server unavailable.

  28. 5.5CVE-2023-21253EPSS 0.1%

    In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for expl…

  29. 7.5CVE-2023-43810EPSS 0.8%

    OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box …

  30. 7.5CVE-2023-20259EPSS 0.8%

    A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could impact access to the web-based management interface and cause d…

  31. 5.3CVE-2023-3153EPSS 1.0%

    A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.

  32. 7.5CVE-2023-33026EPSS 0.4%

    Transient DOS in WLAN Firmware while parsing a NAN management frame.

  33. 7.5CVE-2023-26151EPSS 1.2%

    Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.

  34. 6.5CVE-2023-5196EPSS 0.7%

    Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop resulting in the server consuming an abnormal quantity of computing resources and poss…

  35. 4.7CVE-2023-20268EPSS 0.3%

    A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resources on an affected device.  This vulnerability is due to insufficient man…

  36. 8.6CVE-2023-20176EPSS 0.9%

    A vulnerability in the networking component of Cisco access point (AP) software could allow an unauthenticated, remote attacker to cause a temporary disruption of service. This vulnerability is due to overuse of AP resources. An attacke…

  37. 7.5CVE-2023-5157EPSS 2.3%

    A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.

  38. 5.3CVE-2023-43775EPSS 0.8%

    Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue co…

  39. 7.5CVE-2023-43646EPSS 1.4%

    get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denia…

  40. 3.3CVE-2023-41310EPSS 0.2%

    Keep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation of this vulnerability may cause malicious apps to run continuously in the background.

  41. 6.5CVE-2023-40441EPSS 1.1%

    A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to a denial-of-service.

  42. 9.8CVE-2023-41294EPSS 0.5%

    The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services.

  43. 5.5CVE-2023-43771EPSS 0.2%

    In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program.

  44. 7.5CVE-2023-43767EPSS 0.6%

    Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Pro…

  45. 7.5CVE-2023-42457EPSS 1.0%

    plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling …

  46. 5.3CVE-2023-26144EPSS 1.5%

    Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an att…

  47. 5.5CVE-2020-24089EPSS 0.3%

    An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a denial of service (DoS).

  48. 6.5CVE-2022-47556EPSS 0.6%

    Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of ser…

  49. 7.5CVE-2023-42523EPSS 0.6%

    Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpo…

  50. 7.5CVE-2023-42522EPSS 0.6%

    Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, With…