cve.bz

CWE-400: Uncontrolled Resource Consumption, page 52

Filter

The product does not properly control the allocation and maintenance of a limited resource.

What the weakness is: CWE-400 at MITRE

Ask an AI about CWE-400

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-400: Uncontrolled Resource Consumption and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/400.html and https://cve.bz/cve/cwe/400?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2023-38210EPSS 0.4%

    Adobe XMP Toolkit versions 2022.06 is affected by a Uncontrolled Resource Consumption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current us…

  2. 7.5CVE-2023-38180KEVEPSS 14%

    .NET and Visual Studio Denial of Service Vulnerability

  3. 7.5CVE-2023-38178EPSS 2.6%

    .NET Core and Visual Studio Denial of Service Vulnerability

  4. 5.3CVE-2023-29409EPSS 1.6%

    Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of …

  5. 7.5CVE-2023-3825EPSS 0.8%

    PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can b…

  6. 5.5CVE-2023-34872EPSS 0.9%

    A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.

  7. 6.5CVE-2023-38498EPSS 0.7%

    Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can prevent the defer queue from proceeding promptly on site…

  8. 2.7CVE-2023-37900EPSS 0.6%

    Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image contain…

  9. 6.5CVE-2023-3637EPSS 1.3%

    An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the us…

  10. 7.5CVE-2023-38200EPSS 1.4%

    A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.

  11. 5.9CVE-2023-3782EPSS 0.7%

    DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response

  12. 5.5CVE-2023-37143EPSS 0.8%

    ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp().

  13. 5.5CVE-2023-37142EPSS 0.8%

    ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees().

  14. 5.5CVE-2023-37141EPSS 0.8%

    ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray().

  15. 5.5CVE-2023-37140EPSS 0.8%

    ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount().

  16. 7.5CVE-2023-37788EPSS 1.0%

    goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.

  17. 4.9CVE-2023-37481EPSS 0.7%

    Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upl…

  18. 4.9CVE-2023-37480EPSS 0.7%

    Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connect…

  19. 7.5CVE-2023-2263EPSS 1.2%

    The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing.  The new ENIP connections cannot be established if impacted by this vulnerability,  which prohibits operational capabilities of the device resu…

  20. 6.5CVE-2022-30858EPSS 0.6%

    An issue was discovered in ngiflib 0.4. There is SEGV in SDL_LoadAnimatedGif when use SDLaffgif. poc : ./SDLaffgif CA_file2_0

  21. 7.5CVE-2023-37475EPSS 1.0%

    Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of memory` wh…

  22. 3.3CVE-2023-3614EPSS 0.4%

    Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsive for an extended period of time by linking to specially crafted image file.

  23. 6.5CVE-2023-3593EPSS 0.6%

    Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.

  24. 4.3CVE-2023-3585EPSS 0.5%

    Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.

  25. 7.5CVE-2022-4952EPSS 0.9%

    A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function CreateSerializerSettings of the file src/JsonRpc/Serialization/SerializerBase.c…

  26. 7.5CVE-2023-36818EPSS 0.7%

    Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit `52b003d915`. Users are advised to upgrade. The…

  27. 7.5CVE-2023-35945EPSS 1.7%

    Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In n…

  28. 7.5CVE-2023-37463EPSS 0.7%

    cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and sub…

  29. 5.3CVE-2023-34458EPSS 1.3%

    mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonc…

  30. 7.5CVE-2023-26597EPSS 0.6%

    Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. See Honeywell Security Notification for r…

  31. 4.9CVE-2023-29449EPSS 1.2%

    JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superad…

  32. 5.5CVE-2023-21240EPSS 0.09%

    In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

  33. 7.5CVE-2020-20021EPSS 1.0%

    An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.

  34. 7.5CVE-2023-35339EPSS 1.9%

    Windows CryptoAPI Denial of Service Vulnerability

  35. 6.5CVE-2023-35329EPSS 1.8%

    Windows Authentication Denial of Service Vulnerability

  36. 7.5CVE-2023-35298EPSS 1.8%

    HTTP.sys Denial of Service Vulnerability

  37. 4.7CVE-2023-3108EPSS 0.2%

    A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipher_recvmsg of crypto/algif_skcipher.c function. This flaw allows a local user to crash the system.

  38. 7.5CVE-2023-35921EPSS 0.9%

    A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3…

  39. 7.5CVE-2023-35920EPSS 0.9%

    A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3…

  40. 7.5CVE-2023-26509EPSS 1.1%

    AnyDesk 7.0.8 allows remote Denial of Service.

  41. 5.7CVE-2023-1206EPSS 0.6%

    A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can incr…

  42. 4.4CVE-2023-21176EPSS 0.09%

    In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploit…

  43. 7.5CVE-2023-3398EPSS 1.0%

    Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.

  44. 5.5CVE-2023-35925EPSS 0.3%

    FastAsyncWorldEdit (FAWE) is designed for efficient world editing. This vulnerability enables the attacker to select a region with the `Infinity` keyword (case-sensitive!) and executes any operation. This has a possibility of bringing the …

  45. 7.5CVE-2023-33141EPSS 2.2%

    Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

  46. 6.5CVE-2023-34462EPSS 2.5%

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handsha…

  47. 7.5CVE-2023-2990EPSS 0.9%

    Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service

  48. 4.3CVE-2023-26434EPSS 1.1%

    When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually …

  49. 4.3CVE-2023-26433EPSS 1.1%

    When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP service could trigger requests that lead to excessive resource usage and eventually …

  50. 4.3CVE-2023-26432EPSS 1.1%

    When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP service could trigger requests that lead to excessive resource usage and eventually …