Skip to content
OpenAdvisories

Weakness (CWE)

CWE-400: Uncontrolled Resource Consumption

Class Draft Mapping discouraged

The product does not properly control the allocation and maintenance of a limited resource.

How to prevent it (4 mitigations)

  1. Architecture and Design

    Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.

  2. Architecture and Design

    Mitigation of resource exhaustion attacks requires that the target system either:

    - recognizes the attack and denies that user further access for a given amount of time, or

    - uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

    The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.

    The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.

  3. Architecture and Design

    Ensure that protocols have specific limits of scale placed on them.

  4. Implementation

    Ensure that all failures in resource allocation place the system into a safe posture.

Source: MITRE CWE-400

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2026-28318 Exploited Public exploit EPSS 48%

    SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

    SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are u…

    SolarWinds Serv-U
    KEV Jun 5, 2026
  • Medium 4.0
    CVE-2026-45498 Exploited Public exploit EPSS 63%

    Microsoft Defender Denial of Service Vulnerability

    Microsoft Defender Denial of Service Vulnerability

    Microsoft Microsoft Defender Antimalware Platform
    KEV May 20, 2026
  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs go dotnet7 trafficserver Debian Ubuntu Alpine Maven Go SwiftURL
    KEV Oct 10, 2023
  • High 7.5
    CVE-2023-38180 Exploited EPSS 14%

    .NET and Visual Studio Denial of Service Vulnerability

    .NET and Visual Studio Denial of Service Vulnerability

    Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet
    KEV Aug 9, 2023
  • Critical 10.0
    CVE-2021-44228 Exploited · Ransomware Public exploit EPSS 100%

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

    Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV Dec 10, 2021
  • High 8.6
    CVE-2020-3569 Exploited

    Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities

    Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it co…

    Cisco Cisco IOS XR Software iOS Network devices
    KEV Nov 3, 2021
  • High 8.6
    CVE-2020-3566 Exploited

    Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

    A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue manageme…

    Cisco Cisco IOS XR Software iOS Network devices
    KEV Nov 3, 2021
  • Medium 5.9
    CVE-2004-1464 Exploited

    Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) con…

    KEV May 19, 2023