cve.bz

CWE-400: Uncontrolled Resource Consumption, page 55

Filter

The product does not properly control the allocation and maintenance of a limited resource.

What the weakness is: CWE-400 at MITRE

Ask an AI about CWE-400

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-400: Uncontrolled Resource Consumption and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/400.html and https://cve.bz/cve/cwe/400?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2023-28507EPSS 0.9%

    Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a memory-exhaustion issue, where a decompression routine will allocate increasing amounts of memor…

  2. 7.5CVE-2023-28626EPSS 1.1%

    comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Mark…

  3. 7.5CVE-2022-48351EPSS 0.5%

    The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect availability.

  4. 7.8CVE-2023-1654EPSS 0.3%

    Denial of Service in GitHub repository gpac/gpac prior to 2.4.0.

  5. 7.5CVE-2023-21061EPSS 0.3%

    Product: AndroidVersions: Android kernelAndroid ID: A-229255400References: N/A

  6. 5.5CVE-2023-21033EPSS 0.09%

    In addNetwork of WifiManager.java, there is a possible way to trigger a persistent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed fo…

  7. 7.8CVE-2023-20911EPSS 0.2%

    In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed.…

  8. 5.5CVE-2023-20910EPSS 0.1%

    In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not n…

  9. 6.5CVE-2023-20861EPSS 1.0%

    In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) c…

  10. 6.5CVE-2023-0056EPSS 1.8%

    An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The bi…

  11. 7.5CVE-2023-1605EPSS 1.0%

    Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.

  12. 7.5CVE-2022-45003EPSS 1.0%

    Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.

  13. 5.5CVE-2023-24862EPSS 0.5%

    Windows Secure Channel Denial of Service Vulnerability

  14. 6.5CVE-2023-23411EPSS 0.6%

    Windows Hyper-V Denial of Service Vulnerability

  15. 6.5CVE-2023-23396EPSS 3.8%

    Microsoft Excel Denial of Service Vulnerability

  16. 6.5CVE-2023-27270EPSS 0.6%

    SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a …

  17. 6.5CVE-2023-25618EPSS 0.6%

    SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authentica…

  18. 7.5CVE-2023-27530EPSS 1.8%

    A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than …

  19. 5.3CVE-2023-1072EPSS 0.8%

    An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion at…

  20. 4.9CVE-2023-27484EPSS 0.7%

    crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly privileged user able to create or update Compositions can specify an arbitrarily …

  21. 7.5CVE-2023-27483EPSS 0.8%

    crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the `Paved` type's …

  22. 7.5CVE-2022-41333ExploitEPSS 7.2%

    An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET req…

  23. 6.5CVE-2022-3277EPSS 1.1%

    An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the us…

  24. 7.5CVE-2023-26601EPSS 34%

    Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS).

  25. 7.5CVE-2021-36395EPSS 0.7%

    In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.

  26. 7.5CVE-2023-27567EPSS 0.8%

    In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel.

  27. 7.5CVE-2023-26470EPSS 0.9%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). Most of the time this will f…

  28. 7.5CVE-2022-38734EPSS 0.6%

    StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to to a crash of the Local Distribution Router (LDR) service.

  29. 7.5CVE-2023-20014EPSS 1.0%

    A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the improper processing of DNS request…

  30. 7.5CVE-2022-41724EPSS 1.1%

    Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 …

  31. 7.5CVE-2023-23689EPSS 0.6%

    Dell PowerScale nodes A200, A2000, H400, H500, H600, H5600, F800, F810 integrated hardware management software contains an uncontrolled resource consumption vulnerability. This may allow an unauthenticated network host to impair built-in h…

  32. 5.5CVE-2022-20455EPSS 0.1%

    In addAutomaticZenRule of ZenModeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not n…

  33. 7.5CVE-2023-23524EPSS 0.6%

    A denial-of-service issue was addressed with improved input validation. This issue is fixed in tvOS 16.3.2, iOS 16.3.1 and iPadOS 16.3.1, watchOS 9.3.1, macOS Ventura 13.2.1. Processing a maliciously crafted certificate may lead to a denia…

  34. 7.5CVE-2023-26104EPSS 1.2%

    All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.

  35. 6.5CVE-2023-25816EPSS 1.4%

    Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can configure a very long password, consuming more resources on password validation th…

  36. 6.5CVE-2023-23296EPSS 0.8%

    Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.

  37. 6.5CVE-2023-23009EPSS 1.6%

    Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.

  38. 7.5CVE-2023-0662EPSS 1.5%

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected…

  39. 7.5CVE-2023-24580EPSS 63%

    An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open file…

  40. 7.5CVE-2023-0518EPSS 1.2%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by …

  41. 7.5CVE-2022-3759EPSS 1.2%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job art…

  42. 6.5CVE-2022-3411EPSS 1.2%

    A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly …

  43. 5.5CVE-2022-47370EPSS 0.09%

    In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.

  44. 5.5CVE-2022-47356EPSS 0.08%

    In log service, there is a missing permission check. This could lead to local denial of service in log service.

  45. 5.5CVE-2022-47355EPSS 0.08%

    In log service, there is a missing permission check. This could lead to local denial of service in log service.

  46. 5.5CVE-2022-47354EPSS 0.08%

    In log service, there is a missing permission check. This could lead to local denial of service in log service.

  47. 7.5CVE-2022-40513EPSS 0.4%

    Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state.

  48. 5.5CVE-2022-38674EPSS 0.09%

    In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.

  49. 7.5CVE-2023-23631EPSS 0.9%

    github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual mem…

  50. 7.5CVE-2023-23625EPSS 0.7%

    go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can the…