cve.bz

CWE-400: Uncontrolled Resource Consumption, page 53

Filter

The product does not properly control the allocation and maintenance of a limited resource.

What the weakness is: CWE-400 at MITRE

Ask an AI about CWE-400

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-400: Uncontrolled Resource Consumption and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/400.html and https://cve.bz/cve/cwe/400?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2023-34166EPSS 0.4%

    Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart.

  2. 6.5CVE-2023-2831EPSS 0.7%

    Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a large number of escaped characters.

  3. 6.5CVE-2023-2793EPSS 0.6%

    Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message.

  4. 4.3CVE-2023-2785EPSS 0.6%

    Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in Denial of Service

  5. 6.5CVE-2023-2683EPSS 0.3%

    A memory leak in the EFR32 Bluetooth LE stack 5.1.0 through 5.1.1 allows an attacker to send an invalid pairing message and cause future legitimate connection attempts to fail. A reset of the device immediately clears the error.

  6. 6.5CVE-2023-32229EPSS 0.6%

    Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5,…

  7. 7.5CVE-2022-33168EPSS 0.8%

    IBM Security Directory Suite VA 8.0.1 could allow an attacker to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 228588.

  8. 7.5CVE-2023-29331EPSS 2.6%

    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

  9. 5.3CVE-2023-32013EPSS 1.6%

    Windows Hyper-V Denial of Service Vulnerability

  10. 7.5CVE-2023-2778EPSS 1.2%

    A denial-of-service vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager. This vulnerability can be exploited by sending a modified packet to port 400. If exploited, the application could potentially crash or experie…

  11. 7.5CVE-2023-35053EPSS 0.6%

    In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms

  12. 5.5CVE-2023-29767EPSS 0.3%

    An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files.

  13. 7.5CVE-2023-3163EPSS 1.4%

    A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of the argument value leads to resource consumption. VDB-231090 is the identifier ass…

  14. 7.5CVE-2023-34109EPSS 0.5%

    zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platform which are using the second argument of the zxcvbn function. It can result in an unbounded resour…

  15. 6.5CVE-2023-33958EPSS 0.5%

    notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user…

  16. 5.7CVE-2023-33957EPSS 0.5%

    notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user…

  17. 7.5CVE-2023-34104EPSS 1.1%

    fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing en…

  18. 5.5CVE-2022-33303EPSS 0.1%

    Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message queue.

  19. 6.5CVE-2023-29544EPSS 0.5%

    If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112…

  20. 6.5CVE-2023-0616EPSS 0.5%

    If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actio…

  21. 5.5CVE-2023-29735EPSS 0.3%

    An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files.

  22. 7.5CVE-2023-30570EPSS 1.2%

    pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.

  23. 5.9CVE-2023-28320EPSS 2.7%

    A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to ti…

  24. 5.5CVE-2023-1981EPSS 0.4%

    A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash.

  25. 7.5CVE-2023-20883EPSS 0.9%

    In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.

  26. 5.9CVE-2023-20882EPSS 0.6%

    In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are c…

  27. 6.5CVE-2023-33720EPSS 0.6%

    mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty.

  28. 6.5CVE-2022-39374EPSS 0.9%

    Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously r…

  29. 7.5CVE-2023-32067EPSS 1.6%

    c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target re…

  30. 7.5CVE-2023-2798EPSS 0.9%

    Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. Th…

  31. 7.5CVE-2023-33980EPSS 0.9%

    Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) via a series of long messages to a contact.

  32. 6.5CVE-2023-26595EPSS 0.5%

    Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition.

  33. 7.5CVE-2023-33297EPSS 1.4%

    Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.

  34. 4.9CVE-2022-36326EPSS 0.6%

    An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Weste…

  35. 7.5CVE-2023-2295EPSS 1.6%

    A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a…

  36. 5.3CVE-2023-26044EPSS 0.7%

    react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HT…

  37. 7.8CVE-2023-21110EPSS 0.09%

    In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …

  38. 5.5CVE-2023-20930EPSS 0.08%

    In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interact…

  39. 7.5CVE-2023-32787EPSS 1.2%

    The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications.

  40. 7.5CVE-2023-31409EPSS 1.1%

    Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability of the webserver by invocing a Slowloris …

  41. 7.5CVE-2023-23447EPSS 1.1%

    Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to influence the availability of the webserver by invocing…

  42. 7.5CVE-2023-28356EPSS 0.7%

    A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one of the processes, consuming ~120% CPU and rendering the service unresponsive.

  43. 7.5CVE-2022-36329EPSS 0.3%

    An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud …

  44. 7.5CVE-2023-25568EPSS 0.9%

    Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting eve…

  45. 5.5CVE-2023-25179EPSS 0.2%

    Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial of service via local access.

  46. 5.5CVE-2022-46645EPSS 0.2%

    Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access.

  47. 5.5CVE-2022-41801EPSS 0.2%

    Uncontrolled resource consumption in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable denial of service via local access.

  48. 5.5CVE-2022-4008EPSS 0.2%

    In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service

  49. 3.3CVE-2023-29333EPSS 0.6%

    Microsoft Access Denial of Service Vulnerability

  50. 5.5CVE-2023-22874EPSS 0.2%

    IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS are vulnerable to a denial of service attack when processing configuration files. IBM X-Force ID: 244216.