CWE-400— Uncontrolled Resource Consumption (Denial of Service)

The product does not properly control the allocation and maintenance of a limited resource.— MITRE CWE catalog

5,012 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-400page 9 of 101

CVE-2019-9587HIGHCVSS 7.8EG 7.8
2019-03-06
There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation f…
CVE-2017-14180HIGHCVSS 7.8EG 7.8
2018-02-02
Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or po…
CVE-2017-14179HIGHCVSS 7.8EG 7.8
2018-02-02
Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gai…
CVE-2017-14177HIGHCVSS 7.8EG 7.8
2018-02-02
Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain ro…
CVE-2017-7132HIGHCVSS 7.8EG 7.8
2017-11-13
An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Quick Look" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption) via …
CVE-2017-13825HIGHCVSS 7.8EG 7.8
2017-11-13
An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "CoreText" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption) via a …
CVE-2017-8247HIGHCVSS 7.8EG 7.8
2017-09-21
In all Qualcomm products with Android releases from CAF using the Linux kernel, if there is more than one thread doing the device open operation, the device may be opened more than once. This would lead to get_pid being called more than on…
CVE-2017-8264HIGHCVSS 7.8EG 7.8
2017-08-11
A userspace process can cause a Denial of Service in the camera driver in all Qualcomm products with Android releases from CAF using the Linux kernel.
CVE-2017-2535HIGHCVSS 7.8EG 7.8
2017-05-22
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Security" component. It allows attackers to conduct sandbox-escape attacks or cause a denial of service (resource consumption) via…
CVE-2018-12122HIGHCVSS 7.5EG 7.8
2018-11-28
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated re…
CVE-2016-8610HIGHCVSS 7.5EG 7.8
2017-11-13
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a …
CVE-2024-44160HIGHCVSS 5.5EG 7.8
2024-09-17
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. Processing a maliciously crafted texture may lead to unexpected app termination.
CVE-2024-40841HIGHCVSS 5.5EG 7.8
2024-09-17
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously crafted video file may lead to unexpected app termination.
CVE-2024-28717HIGHCVSS 4.9EG 7.8
2024-04-22
An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.
CVE-2014-0230HIGHCVSS v2 7.8EG 7.8
2015-06-07
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial o…
CVE-2014-5418HIGHCVSS v2 7.8EG 7.8
2015-01-17
GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumpt…
CVE-2014-2741HIGHCVSS v2 7.8EG 7.8
2014-04-11
nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XM…
CVE-2012-6638HIGHCVSS v2 7.8EG 7.8
2014-02-15
The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability t…
CVE-2012-0024HIGHCVSS v2 7.8EG 7.8
2012-01-08
MaraDNS before 1.3.07.12 and 1.4.x before 1.4.08 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by send…
CVE-2011-5034HIGHCVSS v2 7.8EG 7.8
2011-12-30
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many…
CVE-2011-3192HIGHCVSS v2 7.8EG 7.8
2011-08-29
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping r…
CVE-2010-4686HIGHCVSS v2 7.8EG 7.8
2011-01-07
CallManager Express (CME) on Cisco IOS before 15.0(1)XA1 does not properly handle SIP TRUNK traffic that contains rate bursts and a "peculiar" request size, which allows remote attackers to cause a denial of service (memory consumption) by…
CVE-2010-4671HIGHCVSS v2 7.8EG 7.8
2011-01-07
The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS before 15.0(1)XA5 allows remote attackers to cause a denial of service (CPU consumption and device hang) by sending many Router Advertisement (RA) messages …
CVE-2008-4310HIGHCVSS v2 7.8EG 7.8
2008-12-09
httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incompl…
CVE-2008-4077HIGHCVSS v2 7.8EG 7.8
2008-09-15
The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attackers to cause a denial of service (resource exhaustion) via an HTTP POST request with a large Content-Length.
CVE-2007-0086HIGHCVSS v2 7.8EG 7.8
2007-01-05
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fra…
CVE-2026-49407HIGHCVSS 7.7EG 7.7
2026-11-05
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local /ws/dictation WebSocket endpoint lacks client authentication and browser-origin validation. An unauthentic…
CVE-2026-61617HIGHCVSS 7.7EG 7.7
2026-08-26
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write acc…
CVE-2026-9165HIGHCVSS 7.7EG 7.7
2026-07-06
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested …
CVE-2026-13149HIGHCVSS 7.7EG 7.7
2026-06-30
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(),…
CVE-2026-33235HIGHCVSS 7.7EG 7.7
2026-06-24
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions prior to 0.6.52, the Fill Text Template block is vulnerable to a Denial of Service (DoS) attack. While t…
CVE-2025-57751HIGHCVSS 7.7EG 7.7
2025-08-21
pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dy…
CVE-2025-46580HIGHCVSS 7.7EG 7.7
2025-04-27
There is a code-related vulnerability in the GoldenDB database product. Attackers can access system tables to disrupt the normal operation of business SQL.
CVE-2024-5795HIGHCVSS 7.7EG 7.7
2024-07-16
A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large payload to the Git server. This vulnerability affected all versions of GitHub E…
CVE-2023-42358HIGHCVSS 7.7EG 7.7
2024-01-03
An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the E2Manager API component.
CVE-2022-37973HIGHCVSS 7.7EG 7.7
2022-10-11
Windows Local Session Manager (LSM) Denial of Service Vulnerability
CVE-2022-36049HIGHCVSS 7.7EG 7.7
2022-09-07
Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated w…
CVE-2022-33142HIGHCVSS 7.7EG 7.7
2022-08-23
Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress.
CVE-2022-20808HIGHCVSS 7.7EG 7.7
2022-07-06
A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incorrect handling of mult…
CVE-2022-20692HIGHCVSS 7.7EG 7.7
2022-04-15
A vulnerability in the NETCONF over SSH feature of Cisco IOS XE Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service condition (DoS) on an affected device. This vulnerability is due to insuffic…
CVE-2021-39877HIGHCVSS 7.7EG 7.7
2021-10-04
A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted file.
CVE-2021-1623HIGHCVSS 7.7EG 7.7
2021-09-23
A vulnerability in the Simple Network Management Protocol (SNMP) punt handling function of Cisco cBR-8 Converged Broadband Routers could allow an authenticated, remote attacker to overload a device punt path, resulting in a denial of servi…
CVE-2021-22181HIGHCVSS 7.7EG 7.7
2021-06-11
A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources.
CVE-2020-15114HIGHCVSS 7.7EG 7.7
2020-08-06
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, …
CVE-2019-1965HIGHCVSS 7.7EG 7.7
2019-08-28
A vulnerability in the Virtual Shell (VSH) session management for Cisco NX-OS Software could allow an authenticated, remote attacker to cause a VSH process to fail to delete upon termination. This can lead to a build-up of VSH processes th…
CVE-2018-0309HIGHCVSS 7.7EG 7.7
2018-06-21
A vulnerability in the implementation of a specific CLI command and the associated Simple Network Management Protocol (SNMP) MIB for Cisco NX-OS (in standalone NX-OS mode) on Cisco Nexus 3000 and 9000 Series Switches could allow an authent…
CVE-2017-12090HIGHCVSS 7.7EG 7.7
2018-04-05
An exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below. A specially crafted snmp-set request, when sent without associated firmware flas…
CVE-2017-6019HIGHCVSS 7.5EG 7.7
2017-04-07
An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid requests to the device may cause it to reboot.
CVE-2026-17279HIGHCVSS 6.5EG 7.7
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption. Certain requests can cause internal processing to s…
CVE-2019-9516HIGHCVSS 6.5EG 7.7
2019-08-13
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte o…

Map vulnerabilities like CWE-400 to your infrastructure

EchelonGraph correlates every CVE — across CWE-400 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →