cve.bz

CWE-400: Uncontrolled Resource Consumption, page 71

Filter

The product does not properly control the allocation and maintenance of a limited resource.

What the weakness is: CWE-400 at MITRE

Ask an AI about CWE-400

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-400: Uncontrolled Resource Consumption and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/400.html and https://cve.bz/cve/cwe/400?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2012-5362EPSS 15%

    The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than CVE-2010-4669.

  2. 5.9CVE-2020-3132EPSS 1.5%

    A vulnerability in the email message scanning feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a temporary denial of service (DoS) condition on an affected …

  3. 5.5CVE-2020-8992EPSS 0.4%

    ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size.

  4. 7.5CVE-2020-3741EPSS 3.2%

    Adobe Experience Manager versions 6.5, and 6.4 have an uncontrolled resource consumption vulnerability. Successful exploitation could lead to denial-of-service.

  5. 5.5CVE-2013-4602EPSS 1.4%

    A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Scanner Engine.

  6. 7.5CVE-2011-3336ExploitEPSS 6.5%

    regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.

  7. 5.5CVE-2012-0810EPSS 0.4%

    The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and panic) via a crafted application that triggers certain lock contention.

  8. 7.5CVE-2019-13946EPSS 1.5%

    Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due …

  9. 7.5CVE-2019-13940EPSS 1.7%

    A vulnerability has been identified in SIMATIC ET 200pro IM154-8 PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200pro IM154-8F PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200pro IM154-8FX PN/DP CPU (All versions < V3.X.17), SIMATIC ET …

  10. 7.5CVE-2019-13926EPSS 1.5%

    A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). S…

  11. 7.5CVE-2019-13925EPSS 1.5%

    A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). S…

  12. 6.5CVE-2020-1700EPSS 2.4%

    A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. …

  13. 3.3CVE-2016-1544EPSS 0.9%

    nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).

  14. 4.9CVE-2020-8123EPSS 1.1%

    A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.

  15. 7.5CVE-2019-9674EPSS 5.6%

    Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

  16. 6.5CVE-2020-5236EPSS 2.4%

    Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically …

  17. 6.5CVE-2019-20446EPSS 2.1%

    In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects …

  18. 6.5CVE-2020-8492EPSS 6.6%

    Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.Abs…

  19. 7.5CVE-2013-3074EPSS 1.7%

    NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (device crash).

  20. 7.5CVE-2019-5472EPSS 1.9%

    An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments.

  21. 6.5CVE-2020-3131EPSS 2.2%

    A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to explo…

  22. 8.6CVE-2019-16022EPSS 1.3%

    Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vu…

  23. 8.6CVE-2019-16020EPSS 1.3%

    Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vu…

  24. 6.5CVE-2019-16018EPSS 1.1%

    A vulnerability in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabili…

  25. 7.5CVE-2015-5333EPSS 2.0%

    Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object identifiers in X.509 certificates.

  26. 7.5CVE-2012-6083ExploitEPSS 12%

    Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.

  27. 7.5CVE-2019-14888EPSS 2.2%

    A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

  28. 5.5CVE-2013-4175EPSS 0.4%

    MySecureShell 1.31 has a Local Denial of Service Vulnerability

  29. 6.5CVE-2012-4863EPSS 1.2%

    IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability

  30. 7.5CVE-2008-7314EPSS 1.3%

    mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.

  31. 6.5CVE-2019-15961EPSS 3.1%

    A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerabilit…

  32. 6.5CVE-2020-1600EPSS 1.2%

    In a Point-to-Multipoint (P2MP) Label Switched Path (LSP) scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon (RPD) in Juniper Networks Junos OS allows a specific SNMP request to trigger an infinite …

  33. 5.3CVE-2020-6173EPSS 1.8%

    TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.

  34. 5.3CVE-2019-20146EPSS 1.1%

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption.

  35. 7.5CVE-2014-3447EPSS 1.8%

    BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability

  36. 7.5CVE-2014-3211EPSS 1.1%

    Publify before 8.0.1 is vulnerable to a Denial of Service attack

  37. 7.5CVE-2019-10775EPSS 1.3%

    ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.

  38. 6.5CVE-2019-20201EPSS 1.1%

    An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities, leading to an infinite loop in which memory allocations occur.

  39. 7.5CVE-2019-20176ExploitEPSS 4.4%

    In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.

  40. 7.5CVE-2012-5645EPSS 4.3%

    A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker could send a specially-crafted packet that, when processed would lead to memory exhaustion or excessive…

  41. 5.5CVE-2011-1474EPSS 0.4%

    A locally locally exploitable DOS vulnerability was found in pax-linux versions 2.6.32.33-test79.patch, 2.6.38-test3.patch, and 2.6.37.4-test14.patch. A bad bounds check in arch_get_unmapped_area_topdown triggered by programs doing an mmap…

  42. 7.5CVE-2019-6683EPSS 1.0%

    On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IP virtual servers with Loose Initiation enabled on a FastL4 profile may be subject to excessive flow usage under undiscl…

  43. 7.5CVE-2019-6682EPSS 1.0%

    On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessive resources when processing certain types of HTTP responses from the origin web server. This vulne…

  44. 5.5CVE-2019-19922EPSS 0.9%

    kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted s…

  45. 6.5CVE-2019-15584EPSS 1.2%

    A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.

  46. 6.5CVE-2019-16555EPSS 1.1%

    A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interr…

  47. 7.5CVE-2014-0212EPSS 4.0%

    qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors

  48. 7.5CVE-2019-12420EPSS 7.2%

    In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.

  49. 7.5CVE-2013-3691ExploitEPSS 3.9%

    AirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long URL.

  50. 7.5CVE-2013-4120EPSS 1.3%

    Katello has a Denial of Service vulnerability in API OAuth authentication