cve.bz

CWE-400: Uncontrolled Resource Consumption, page 59

Filter

The product does not properly control the allocation and maintenance of a limited resource.

What the weakness is: CWE-400 at MITRE

Ask an AI about CWE-400

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-400: Uncontrolled Resource Consumption and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/400.html and https://cve.bz/cve/cwe/400?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.9CVE-2022-39194EPSS 1.0%

    An issue was discovered in the MediaWiki through 1.38.2. The community configuration pages for the GrowthExperiments extension could cause a site to become unavailable due to insufficient validation when certain actions (including page mov…

  2. 4.9CVE-2022-2764EPSS 0.9%

    A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.

  3. 6.3CVE-2022-1677EPSS 0.6%

    In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitra…

  4. 5.5CVE-2020-35534EPSS 0.3%

    In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.

  5. 6.5CVE-2022-36055EPSS 1.1%

    Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to functions in the _strvals_ package that can cause an out of memory panic. The _strvals_…

  6. 7.5CVE-2022-2004EPSS 1.0%

    AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect…

  7. 5.5CVE-2022-1325EPSS 0.4%

    A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading …

  8. 7.5CVE-2022-1259EPSS 1.4%

    A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.

  9. 7.5CVE-2022-36034EPSS 0.9%

    nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in all versions above `0.2.5`. There are currently no known workarounds.

  10. 6.5CVE-2022-0669EPSS 0.3%

    A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slav…

  11. 4.4CVE-2021-3735EPSS 0.2%

    A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside th…

  12. 5.5CVE-2021-3669EPSS 0.3%

    A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.

  13. 5.5CVE-2021-4022EPSS 0.3%

    A vulnerability was found in rizin. The bug involves an ELF64 binary for the HPPA architecture. When a specially crafted binarygets analysed by rizin, it causes rizin to crash by freeing an uninitialized (and potentially user controlled, d…

  14. 7.5CVE-2021-42521EPSS 1.3%

    There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe …

  15. 5.3CVE-2021-4040EPSS 3.2%

    A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sust…

  16. 7.5CVE-2022-24375EPSS 1.7%

    The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

  17. 6.5CVE-2022-33142EPSS 1.1%

    Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress.

  18. 5.5CVE-2021-3764EPSS 0.3%

    A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is…

  19. 5.5CVE-2021-3759EPSS 0.4%

    A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resource…

  20. 7.5CVE-2021-3690EPSS 1.8%

    A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

  21. 6.5CVE-2021-3670EPSS 2.3%

    MaxQueryDuration not honoured in Samba AD DC LDAP

  22. 7.5CVE-2021-20298EPSS 1.6%

    A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to syste…

  23. 6.5CVE-2022-35013EPSS 0.9%

    PNGDec commit 8abf6be was discovered to contain a FPE via SaveBMP at /linux/main.cpp.

  24. 7.5CVE-2022-38150EPSS 1.5%

    In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status …

  25. 6.2CVE-2022-35776EPSS 0.8%

    Azure Site Recovery Denial of Service Vulnerability

  26. 7.5CVE-2022-35769EPSS 2.5%

    Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability

  27. 7.5CVE-2022-34701EPSS 2.9%

    Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability

  28. 7.5CVE-2022-28880EPSS 0.5%

    A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files it is possible that can crash the scanning engine. The exploit can be triggered remotely by an …

  29. 7.5CVE-2022-2053EPSS 1.1%

    When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior re…

  30. 6.5CVE-2022-35241EPSS 0.8%

    In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utilization. Note: Software versions which have reached End of Technical Support (EoTS…

  31. 7.5CVE-2022-35236EPSS 0.8%

    In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software …

  32. 7.5CVE-2022-33203EPSS 0.8%

    In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access policy with Service Connect agent is configured on a virtual server, undisclosed requests can cause an increase in memory r…

  33. 7.5CVE-2022-35923EPSS 1.8%

    v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing …

  34. 7.5CVE-2022-35922EPSS 1.9%

    Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during data…

  35. 5.3CVE-2022-35915EPSS 0.8%

    OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this …

  36. 7.5CVE-2022-31173EPSS 1.7%

    Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable …

  37. 7.5CVE-2021-22642EPSS 0.9%

    An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.

  38. 7.5CVE-2022-24294EPSS 1.9%

    A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be exploited when loading a model in Apache MXNet that has a specially crafted operator …

  39. 7.5CVE-2020-21405EPSS 0.9%

    An issue was discovered in H96 Smart TV Box H96 Pro Plus allows attackers to corrupt files via calls to the saveDeepColorAttr service.unk

  40. 7.5CVE-2022-27937EPSS 1.2%

    Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.

  41. 6.5CVE-2022-2406EPSS 0.9%

    The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.

  42. 6.5CVE-2022-31080EPSS 0.7%

    KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, a large response received by the viaduct WSClient can cause a DoS fr…

  43. 6.5CVE-2022-31079EPSS 0.7%

    KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the Cloud Stream server and the Edge Stream server reads the entire …

  44. 6.5CVE-2022-31078EPSS 0.7%

    KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the CloudCore Router does not impose a limit on the size of response…

  45. 6.5CVE-2022-31075EPSS 1.0%

    KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, EdgeCore may be susceptible to a DoS attack on CloudHub if an attack…

  46. 6.5CVE-2022-31074EPSS 0.8%

    KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, several endpoints in the Cloud AdmissionController may be susceptibl…

  47. 7.5CVE-2022-31073EPSS 1.7%

    KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the ServiceBus server on the edge side may be susceptible to a DoS a…

  48. 7.5CVE-2022-30792EPSS 0.9%

    In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Existing connections are not affected.

  49. 7.5CVE-2022-30791EPSS 0.9%

    In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected.

  50. 6.5CVE-2022-20808EPSS 1.0%

    A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incorrect handling of mult…