cve.bz

CWE-408: Incorrect Behavior Order: Early Amplification

Filter

The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.

What the weakness is: CWE-408 at MITRE. All weaknesses

Ask an AI about CWE-408

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-408: Incorrect Behavior Order: Early Amplification and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/408.html and https://cve.bz/cve/cwe/408?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2026-119079EPSS 0.6%

    decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) b…

  2. 5.5CVE-2026-104032EPSS 0.10%

    A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups …

  3. 7.5CVE-2026-11605EPSS 0.7%

    The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many vali…

  4. 7.8CVE-2026-46015EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same…

  5. 5.3CVE-2026-3592EPSS 0.4%

    BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions…

  6. 8.7CVE-2026-41405EPSS 0.5%

    OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust ser…

  7. 6.9CVE-2026-41374EPSS 0.5%

    OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume resources. Remote attackers can trigger audio preflight processing without membe…

  8. 6.9CVE-2026-41331EPSS 0.3%

    OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows unauthorized group senders to trigger transcription processing. Attackers can exploit insufficient allowlist enfo…

  9. 7.5CVE-2022-2576EPSS 0.6%

    In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher sui…

  10. 7.5CVE-2020-1657EPSS 1.3%

    On SRX Series devices, a vulnerability in the key-management-daemon (kmd) daemon of Juniper Networks Junos OS allows an attacker to spoof packets targeted to IPSec peers before a security association (SA) is established thereby causing a f…