Weakness (CWE)
CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
How to prevent it (4 mitigations)
-
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
-
Architecture and Design
Mitigation of resource exhaustion attacks requires that the target system either:
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
-
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
-
Implementation
Ensure that all failures in resource allocation place the system into a safe posture.
Source: MITRE CWE-400
51 results · Clear filters · Feed
-
Medium 6.5CVE-2026-16265 Public exploit
WP Maps < 4.9.7 - Subscriber+ Denial of Service
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resourc…
-
Medium 6.2CVE-2026-58045 Public exploit
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…
-
Medium 5.9CVE-2026-58042 Public exploit
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…
-
Medium 6.3CVE-2026-59941 Public exploit
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whos…
-
Medium 5.5CVE-2026-38763 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a denial of service via th…
-
Medium 6.5CVE-2026-48208 Public exploit
Denial-of-Service via SVG Rendering in Ticket
An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when…
-
Medium 4.0
Microsoft Defender Denial of Service Vulnerability
Microsoft Defender Denial of Service Vulnerability
KEV May 20, 2026 -
Medium 6.5CVE-2026-34308 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affect…
-
Medium 6.5CVE-2026-22017 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 6.5CVE-2026-22009 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9CVE-2026-22005 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9CVE-2026-22004 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 6.0CVE-2026-22003 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 4.9CVE-2026-22002 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.5CVE-2026-6060 Public exploit
Possible DoS via SQL Box
A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X befor…
-
Medium 6.2CVE-2026-0049 Public exploit
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaust…
-
Medium 6.5CVE-2025-68971 Public exploit
In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attac…
-
Medium 6.5CVE-2025-67445 Public exploit
TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI rea…
-
Medium 6.2CVE-2025-66676 Public exploit
An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.
-
Medium 6.5CVE-2025-60458 Public exploit
UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN reques…
-
Medium 5.5CVE-2025-61155 Public exploit
The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in…
-
Medium 5.3CVE-2025-59139 Public exploit
Hono has Body Limit Middleware Bypass
Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the `bodyLimit` middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The…
-
Medium 5.5CVE-2025-40766 Public exploit
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected …
-
Medium 5.4CVE-2025-46171 Public exploit
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authentica…
-
Medium 5.7CVE-2024-57708 Public exploit
An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, _…
-
Medium 6.5CVE-2025-21574 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…
-
Medium 5.3CVE-2024-38828 Public exploit
CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter
Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.
-
Medium 6.5CVE-2024-42849 Public exploit
An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change …
-
Medium 4.3CVE-2024-39908 Public exploit
Denial of service in REXML
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. Th…
-
Medium 6.2CVE-2024-3651 Public exploit
Denial of Service via Quadratic Complexity in kjd/idna
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a…
-
Medium 4.9CVE-2024-23443 Public exploit
A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading …
-
Medium 4.3CVE-2023-46442 Public exploit
Soot Infinite Loop vulnerability
An infinite loop in the retrieveActiveBody function of Soot before v4.4.1 under Java 8 allows attackers to cause a Denial of Service (DoS).
-
Medium 5.3CVE-2024-35176 Public exploit
REXML contains a denial of service vulnerability
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.…
-
Medium 5.5CVE-2023-43786 Public exploit
Libx11: stack exhaustion from infinite recursion in putsubimage()
A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.
-
Medium 5.3CVE-2023-26144 Public exploit
graphql Uncontrolled Resource Consumption vulnerability
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade sys…
-
Medium 5.3CVE-2023-26048 Public exploit
OutOfMemoryError for large multipart without filename in Eclipse Jetty
Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` wh…
-
Medium 6.5CVE-2023-23396 Public exploit
Microsoft Excel Denial of Service Vulnerability
Microsoft Excel Denial of Service Vulnerability
-
Medium 6.8CVE-2022-41333 Public exploit
An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below…
-
Medium 5.3CVE-2022-25927 Public exploit
ReDoS Vulnerability in ua-parser-js version
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
-
Medium 5.3CVE-2022-21340 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…