Uncontrolled Resource Consumption
CWE-400
The product does not properly control the allocation and maintenance of a limited resource.
We track 1,380 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.6. 8 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
- Implementation: Ensure that all failures in resource allocation place the system into a safe posture.
Latest Uncontrolled Resource Consumption vulnerabilities
- 7.5 High severity
LMS5xx: Uncontrolled Resource Consumption
A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-service (DDoS) attack. By exploiting this vulnerability, an attacker can flood the targeted LMS5xx with a high volume of TCP S
- 7.5 High severity
SNAP PAC S1: Uncontrolled Resource Consumption
An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SN
- 7.5 High severity
SNAP PAC S1: Uncontrolled Resource Consumption
An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b
- 8.1 High severity
Apache Airflow: Exposure of Sensitive Information to an Unauthorized Actor
Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connect
- 7.8 High severity
Binutils: Uncontrolled Resource Consumption
An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.
- 7.8 High severity
Binutils: Uncontrolled Resource Consumption
An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c.
- 7.5 High severity
tl-wr1041n: Uncontrolled Resource Consumption
An issue in the component /userRpm/NetworkCfgRpm of TP-Link TL-WR1041N V2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
- 7.5 High severity
WebSphere Application Server Liberty: Uncontrolled Resource Consumption
IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-F
- 7.5 High severity
TXSeries for Multiplatforms: Uncontrolled Resource Consumption
IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to c
- 7.5 High severity
Microsoft .NET Core and Visual Studio Denial-of-Service Exploited
.NET and Visual Studio Denial of Service Vulnerability
- 7.5 High severity
KEPServerEX: Out-of-bounds Write
PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create co
- 7.5 High severity
Red Hat Enterprise Linux 9: Excessive Iteration
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
- 7.5 High severity
Kinetix 5700 DC Bus Power Supply Series A: Uncontrolled Resource Consumption
The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing. The new ENIP connections cannot be established if impacted by this vulnerability, which prohibits operational capabilities of the device resulting in a denial-of-se
- 7.5 High severity
avro: Uncontrolled Resource Consumption
Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of memory` which is unrecoverable
- 7.5 High severity
csharp-language-server-protocol: Uncontrolled Resource Consumption
A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function CreateSerializerSettings of the file src/JsonRpc/Serialization/SerializerBase.cs of the component JS
- 7.5 High severity
discourse: Uncontrolled Resource Consumption
Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit `52b003d915`. Users are advised to upgrade. There are no known worka
- 7.5 High severity
envoy: Incomplete Cleanup
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pe
- 7.5 High severity
cmark-gfm: Uncontrolled Resource Consumption
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of ser
- 7.5 High severity
C300: Out-of-bounds Write
Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. See Honeywell Security Notification for recommendations on upg
- 7.5 High severity
SIMATIC MV540 H: Uncontrolled Resource Consumption
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X
- 7.5 High severity
SIMATIC MV540 H: Uncontrolled Resource Consumption
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X
- 7.5 High severity
Globalscape EFT: Uncontrolled Recursion
Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service
- 7.5 High severity
HarmonyOS: Uncontrolled Resource Consumption
Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart.
- 7.5 High severity
Security Directory Suite VA: Uncontrolled Resource Consumption
IBM Security Directory Suite VA 8.0.1 could allow an attacker to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 228588.
- 7.5 High severity
FactoryTalk Transaction Manager: Uncontrolled Resource Consumption
A denial-of-service vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager. This vulnerability can be exploited by sending a modified packet to port 400. If exploited, the application could potentially crash or experience a high CPU or mem
- 7.5 High severity
RuoYi: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of the argument value leads to resource consumption. VDB-231090 is the identifier assigned to this vulnera
- 7.5 High severity
zxcvbn: Uncontrolled Resource Consumption
zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platform which are using the second argument of the zxcvbn function. It can result in an unbounded resource consumption as the
- 7.5 High severity
fast-xml-parser: Inefficient Regular Expression Complexity
fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML bod
- 7.5 High severity
Libreswan: Uncontrolled Resource Consumption
pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.
- 7.5 High severity
Spring Boot: Uncontrolled Resource Consumption
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
- 7.5 High severity
c-ares: Uncontrolled Resource Consumption
c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously in
- 7.5 High severity
Htmlunit: Out-of-bounds Write
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support
- 7.5 High severity
Briar: Uncontrolled Resource Consumption
Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) via a series of long messages to a contact.
- 7.5 High severity
Bitcoin Core: Uncontrolled Resource Consumption
Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.
- 7.5 High severity
libreswan: Uncontrolled Resource Consumption
A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is
- 7.8 High severity
Android: Uncontrolled Resource Consumption
In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exp
- 7.5 High severity
Ua Java Legacy: Uncontrolled Resource Consumption
The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications.
- 7.5 High severity
SICK FTMG-ESD15AXX AIR FLOW SENSOR: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability of the webserver by invocing a Slowloris style attack via HTTP
- 7.5 High severity
SICK FTMG-ESD15AXX AIR FLOW SENSOR: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to influence the availability of the webserver by invocing several open file re
- 7.5 High severity
Rocket.Chat: Uncontrolled Resource Consumption
A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one of the processes, consuming ~120% CPU and rendering the service unresponsive.