Incorrect Behavior Order: Early Amplification
CWE-408
The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.6.
Latest Incorrect Behavior Order: Early Amplification vulnerabilities
- 7.5 High severity
Red Hat Enterprise Linux 10: Incorrect Behavior Order: Early Amplification
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthen
- 7.5 High severity
BIND 9: Incorrect Behavior Order: Early Amplification
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRS
- 7.8 High severity
Linux: Incorrect Behavior Order: Early Amplification
In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, th
- 7.5 High severity
OpenClaw: Incorrect Behavior Order: Early Amplification
OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server resources by bypa
- 7.5 High severity
Eclipse Californium: Incorrect Behavior Order: Early Amplification
In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in