CWE-400— Uncontrolled Resource Consumption (Denial of Service)
The product does not properly control the allocation and maintenance of a limited resource.— MITRE CWE catalog
4,284 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-400page 23 of 86
- CVE-2024-10714HIGHCVSS 7.5EG 7.52025-03-20
A vulnerability in binary-husky/gpt_academic version 3.83 allows an attacker to cause a Denial of Service (DoS) by adding excessive characters to the end of a multipart boundary during file upload. This results in the server continuously p…
- CVE-2024-10650HIGHCVSS 7.5EG 7.52025-03-20
An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although a patch was applied for CVE-2024-7807,…
- CVE-2024-10624HIGHCVSS 7.5EG 7.52025-03-20
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular ex…
- CVE-2024-10572HIGHCVSS 7.5EG 7.52025-03-20
In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large …
- CVE-2024-10549HIGHCVSS 7.5EG 7.52025-03-20
A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-spec…
- CVE-2024-10225HIGHCVSS 7.5EG 7.52025-03-20
A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a multipart boundary in a file upload request. This causes the server to continuously…
- CVE-2024-10188HIGHCVSS 7.5EG 7.52025-03-20
A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_eval to parse user input. This function is not safe and is prone to DoS attacks,…
- CVE-2024-10110HIGHCVSS 7.5EG 7.52025-03-20
In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the t…
- CVE-2024-10051HIGHCVSS 7.5EG 7.52025-03-20
Realchar version v0.0.4 is vulnerable to an unauthenticated denial of service (DoS) attack. The vulnerability exists in the file upload request handling, where appending characters, such as dashes (-), to the end of a multipart boundary in…
- CVE-2025-29907HIGHCVSS 7.5EG 7.52025-03-18
jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the a…
- CVE-2025-25293HIGHCVSS 7.5EG 7.52025-03-12
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib…
- CVE-2025-0114HIGHCVSS 7.5EG 7.52025-03-12
A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the service unavailable by sending a large number of specially crafted packets over a …
- CVE-2024-54546HIGHCVSS 7.5EG 7.52025-03-10
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An app may be able to cause unexpected system termination or corrupt kernel memory.
- CVE-2024-44227HIGHCVSS 7.5EG 7.52025-03-10
The issue was addressed with improved memory handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to cause unexpected system termination or corrupt kernel memory.
- CVE-2024-53458HIGHCVSS 7.5EG 7.52025-03-05
Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packets.
- CVE-2025-27669HIGHCVSS 7.5EG 7.52025-03-05
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Network Scanning (XSPA)/DoS OVE-20230524-0013.
- CVE-2025-27421HIGHCVSS 7.5EG 7.52025-03-03
Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events (SSE) implementation. The issue occurs when clients disconnect from the /stream e…
- CVE-2025-27097HIGHCVSS 7.5EG 7.52025-02-20
GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a use…
- CVE-2023-51316HIGHCVSS 7.5EG 7.52025-02-20
A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Bus Reservation System v1.1 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service (DoS) via a large amoun…
- CVE-2023-51314HIGHCVSS 7.5EG 7.52025-02-20
A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Restaurant Booking System v3.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service (D…
- CVE-2023-51301HIGHCVSS 7.5EG 7.52025-02-19
A lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service (DoS…
- CVE-2023-51293HIGHCVSS 7.5EG 7.52025-02-19
A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event Booking Calendar v4.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service (DoS)…
- CVE-2023-34397HIGHCVSS 7.5EG 7.52025-02-13
Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. During parsing you can trigger that the service will be crashed.
- CVE-2024-56940HIGHCVSS 7.5EG 7.52025-02-12
An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file uploads.
- CVE-2024-46923HIGHCVSS 7.5EG 7.52025-02-12
An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. The absence of a null check leads to a Denial of Service at amdgpu_cs_ib_fill in the Xclipse Driver.
- CVE-2025-21351HIGHCVSS 7.5EG 7.52025-02-11
Windows Active Directory Domain Services API Denial of Service Vulnerability
- CVE-2025-21181HIGHCVSS 7.5EG 7.52025-02-11
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
- CVE-2024-57085HIGHCVSS 7.5EG 7.52025-02-05
A prototype pollution in the function deepMerge of @stryker-mutator/util v8.6.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57081HIGHCVSS 7.5EG 7.52025-02-05
A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57079HIGHCVSS 7.5EG 7.52025-02-05
A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57076HIGHCVSS 7.5EG 7.52025-02-05
A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57075HIGHCVSS 7.5EG 7.52025-02-05
A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57074HIGHCVSS 7.5EG 7.52025-02-05
A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2025-21087HIGHCVSS 7.5EG 7.52025-02-05
When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reach…
- CVE-2025-20058HIGHCVSS 7.5EG 7.52025-02-05
When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- CVE-2024-56921HIGHCVSS 7.5EG 7.52025-02-03
An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of gmm_state_exception() function upon receipt of the Nausf_UEAuthentication_Authentica…
- CVE-2024-57519HIGHCVSS 7.5EG 7.52025-01-28
An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file.
- CVE-2023-37022HIGHCVSS 7.5EG 7.52025-01-22
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID` field causes Open5gs to crash; an attacker may repeatedly send such packets to …
- CVE-2023-37014HIGHCVSS 7.5EG 7.52025-01-22
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Release Request` message missing a required `MME_UE_S1AP_ID` field …
- CVE-2024-24424HIGHCVSS 7.5EG 7.52025-01-21
A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
- CVE-2025-21549HIGHCVSS 7.5EG 7.52025-01-21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access…
- CVE-2025-21545HIGHCVSS 7.5EG 7.52025-01-21
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Supported versions that are affected are 8.60 and 8.61. Easily exploitable vulnerability allows unauthenticated attacker with ne…
- CVE-2024-50953HIGHCVSS 7.5EG 7.52025-01-15
An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message.
- CVE-2024-54730HIGHCVSS 7.5EG 7.52025-01-14
Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function.
- CVE-2025-21389HIGHCVSS 7.5EG 7.52025-01-14
Uncontrolled resource consumption in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to deny service over a network.
- CVE-2025-21330HIGHCVSS 7.5EG 7.52025-01-14
Windows Remote Desktop Services Denial of Service Vulnerability
- CVE-2025-21300HIGHCVSS 7.5EG 7.52025-01-14
Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability
- CVE-2025-21290HIGHCVSS 7.5EG 7.52025-01-14
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
- CVE-2025-21289HIGHCVSS 7.5EG 7.52025-01-14
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
- CVE-2025-21270HIGHCVSS 7.5EG 7.52025-01-14
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Map vulnerabilities like CWE-400 to your infrastructure
EchelonGraph correlates every CVE — across CWE-400 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →