CWE-400 Uncontrolled Resource Consumption
classThe product does not properly control the allocation and maintenance of a limited resource.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (9570)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-28318US | —OT critical | KEV | ||
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provi… | ||||
| CVE-2026-45498US | high7.5OT critical | KEV | ||
Microsoft Defender Denial of Service Vulnerability | ||||
| CVE-2023-44487US | high7.5OT critical | KEV | ||
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through… | ||||
| CVE-2023-38180US | —OT critical | KEV | ||
.NET and Visual Studio Denial of Service Vulnerability | ||||
| CVE-2021-44228US | critical10.0OT critical | KEV | ||
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect agai… | ||||
| CVE-2020-3569US | high8.6OT critical | KEV | ||
Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immedi… | ||||
| CVE-2020-3566US | high8.6OT critical | KEV | ||
A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory… | ||||
| CVE-2020-9859US | high7.8OT critical | KEV | ||
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6… | ||||
| CVE-2010-3035US | high7.5OT critical | KEV | ||
Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peer… | ||||
| CVE-2004-1464US | medium5.9OT critical | KEV | ||
Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reve… | ||||
| CVE-2011-3192US | high7.8 | Exploit | ||
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumptio… | ||||
| CVE-2023-50387US | high7.5 | Exploit | ||
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more D… | ||||
| CVE-2019-11477US | high7.5 | Exploit | ||
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs).… | ||||
| CVE-2013-6194US | high10.0 | Exploit | ||
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1905. | ||||
| CVE-2013-2347US | high10.0 | Exploit | ||
The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a denial of service via a crafted EXEC_BAR… | ||||
| CVE-2002-0392US | high7.5 | Exploit | ||
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request… | ||||
| CVE-2024-27316US | high7.5 | Exploit | ||
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, th… | ||||
| CVE-2024-30255US | high7.5 | Exploit | ||
Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustio… | ||||
| CVE-2018-1000115US | high7.5 | Exploit | ||
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that ca… | ||||
| CVE-2020-13935US | high7.5 | Exploit | ||
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payl… | ||||
04
attack patterns (3)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan