Weakness (CWE)
CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
How to prevent it (4 mitigations)
-
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
-
Architecture and Design
Mitigation of resource exhaustion attacks requires that the target system either:
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
-
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
-
Implementation
Ensure that all failures in resource allocation place the system into a safe posture.
Source: MITRE CWE-400
4,062 results · Feed
-
High 7.5
genson vulnerable to stack exhaustion
An issue was discovered genson thru 1.6 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
-
High 7.5
htmlcleaner vulnerable to stack exhaustion
An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
-
High 7.5
ph-json vulnerable to stack exhaustion
An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
-
High 7.5
pbjson vulnerable to stack exhaustion
An issue was discovered pbjson thru 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
-
High 7.5
JSONUtil vulnerable to stack exhaustion
An issue was discovered JSONUtil thru 5.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
-
High 7.5
hjson stack exhaustion vulnerability
An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
-
High 7.5
jjson vulnerable to stack exhaustion
An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
-
Medium 5.3
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
High 7.5
Rockwell Automation FactoryTalk Transaction Manager Vulnerable to Denial-Of-Service
A denial-of-service vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager. This vulnerability can be exploited by sending a modified packet to port 400. If exploited, the application could potentially crash or experience a high CPU or me…
-
High 7.5
In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms
-
Low 3.5CVE-2023-3163 Public exploit
y_project RuoYi filterKeyword resource consumption
A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of the argument value leads to resource consumption. VDB-231090 is the identifier assigned to this vulner…
-
Medium 6.5
User input results in Unbounded resource consumption in @zxcvbn-ts/core
zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platform which are using the second argument of the zxcvbn function. It can result in an unbounded resource consumption as th…
-
Medium 5.4
Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verif…
-
Low 2.6
Denial of service from high number of artifact signatures in notation
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspe…
-
High 7.5
Regex Injection via Doctype Entities
fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML bo…
-
Medium 5.5
Uncontrolled resource consumption in Linux kernel
Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message queue.
-
Medium 6.5
Synapse Denial of service due to incorrect application of event authorization rules during state resolution
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into …
-
Medium 5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for res…
-
Medium 5.5
A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the …
-
High 7.5
Spring Boot Welcome Page Denial of Service
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
-
Medium 5.9
In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a…
-
High 7.5
0-byte UDP payload DoS in c-ares
c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously i…
-
High 7.5
Denial of service in HtmlUnit
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may suppor…
-
Medium 4.4
Resource Exhaustion Vulnerability in Western Digital devices
An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud …
-
Medium 5.3
ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. Th…
-
High 7.5
A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is …
-
Medium 5.3
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 112…
-
High 7.5
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 112…
-
Medium 5.3
github.com/ipfs/kubo affected by DOS Bitswap unbounded persistent memory leak
### Impact An attacker is able allocate arbitrarily many bytes in the Bitswap server by sending many `WANT_BLOCK` and or `WANT_HAVE` requests which are queued in an unbounded queue, with allocations that persist even if the connection is closed. This affects …
-
High 7.5
A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can c…
-
Medium 4.4
Denial of Service over OTA mechanism in Western Digital My Cloud Home and ibi devices
An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Ho…
-
Medium 5.0
Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authentic…
-
Medium 5.0
Uncontrolled resource consumption in the Intel(R) Connect M Android application before version 1.82 may allow an authen…
-
Medium 5.0
Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an auth…
-
High 8.2
Boxo bitswap/server: DOS unbounded persistent memory leak
Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection …
-
Low 3.3
Microsoft Access Denial of Service Vulnerability
Microsoft Access Denial of Service Vulnerability
-
Medium 5.3
BIG-IP TMM SSL vulnerability
When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
High 7.5
MultipartParser DOS with too many fields or files in Starlette Framework
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the …
-
Medium 6.5
Uncontrolled Resource Consuption in M-Files Server
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled job.
-
Medium 6.5
An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a …