Weakness (CWE)
CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
How to prevent it (4 mitigations)
-
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
-
Architecture and Design
Mitigation of resource exhaustion attacks requires that the target system either:
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
-
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
-
Implementation
Ensure that all failures in resource allocation place the system into a safe posture.
Source: MITRE CWE-400
60 results · Clear filters · Feed
-
Critical 9.1
Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode
In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every d…
-
Critical 9.8
In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a d…
-
Critical 9.1
Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most e…
-
Critical 9.9
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.…
-
Critical 9.1
plone.app.event: Denial of service via iCalendar import
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or…
-
Critical 9.1
plone.app.portlets: Denial of service via RSS feed portlet
plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to…
-
Critical 9.3
An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.…
-
Critical 9.4
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by def…
-
Critical 9.4
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The …
-
Critical 9.1
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The…
-
Critical 9.9
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions t…
-
Critical 9.1
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.3
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This ca…
-
Critical 10.0
In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSessio…
-
Critical 10.0
In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to loc…
-
Critical 9.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure …
-
Critical 9.1
An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 21…
-
Critical 9.1
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, …
-
Critical 9.8
TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of …
-
Critical 9.2
Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/…
-
Critical 10.0
Email Sending Vulnerability in BLUVOYIX
The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploitation of t…
-
Critical 9.2
DENIAL OF SERVICE FOR CONCURRENT CONNECTIONS ON TELNET
An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service.
-
Critical 9.2
DENIAL OF SERVICE VIA ARP PACKETS
The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.
-
Critical 9.2
Denial of service through specific packets
Denial of service of the web server through specific requests to this protocol
-
Critical 9.8CVE-2025-61303 Public exploit
Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a vulnerabilit…
-
Critical 9.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, …
-
Critical 9.1
DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs
DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending requests via curl and file_get_contents to arbitrary URLs set via $wgDiscordIncomingWebhookUrl and $w…
-
Critical 9.8
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iP…
-
Critical 9.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
-
Critical 9.8
This issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6,…
-
Critical 9.8
A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7…
-
Critical 9.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, …
-
Critical 9.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, …
-
Critical 9.8
An input validation issue was addressed. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Son…
-
Critical 9.1
Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). …
-
Critical 9.8
An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper d…
-
Critical 9.1
The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server. Un…
-
Critical 9.8
clk: bcm: dvp: Assign ->num before accessing ->hws
In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' …
-
Critical 9.8
STRIMZI incorrect access control
Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka…
-
Critical 9.8
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 16.7.6 and iPadOS 16.…