CWE-400— Uncontrolled Resource Consumption (Denial of Service)

The product does not properly control the allocation and maintenance of a limited resource.— MITRE CWE catalog

4,289 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-400page 33 of 86

CVE-2022-29117HIGHCVSS 7.5EG 7.5
2022-05-10
.NET and Visual Studio Denial of Service Vulnerability
CVE-2022-28701HIGHCVSS 7.5EG 7.5
2022-05-05
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technic…
CVE-2022-28691HIGHCVSS 7.5EG 7.5
2022-05-05
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when a Real Time Streaming Protocol (RTSP) profile is configured on a virtual server, …
CVE-2022-26372HIGHCVSS 7.5EG 7.5
2022-05-05
On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when a DNS listener is configured on a virtual server with DNS queueing (default), u…
CVE-2022-20760HIGHCVSS 7.5EG 7.5
2022-05-03
A vulnerability in the DNS inspection handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service condition (DoS) on a…
CVE-2022-22275HIGHCVSS 7.5EG 7.5
2022-04-27
Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service (DoS) attack if a target host is vulnerable.
CVE-2022-24863HIGHCVSS 7.5EG 7.5
2022-04-18
http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on t…
CVE-2022-26498HIGHCVSS 7.5EG 7.5
2022-04-15
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. …
CVE-2022-28773HIGHCVSS 7.5EG 7.5
2022-04-12
Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.
CVE-2022-21155HIGHCVSS 7.5EG 7.5
2022-04-12
A specially crafted packet sent to the Fernhill SCADA Server Version 3.77 and earlier may cause an exception, causing the server process (FHSvrService.exe) to exit.
CVE-2022-27194HIGHCVSS 7.5EG 7.5
2022-04-12
A vulnerability has been identified in SIMATIC PCS neo (Administration Console) (All versions < V3.1 SP1), SINETPLAN (All versions), TIA Portal (V15, V15.1, V16 and V17). The affected system cannot properly process specially crafted packet…
CVE-2022-24839HIGHCVSS 7.5EG 7.5
2022-04-11
org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.…
CVE-2022-24836HIGHCVSS 7.5EG 7.5
2022-04-11
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised…
CVE-2021-42219HIGHCVSS 7.5EG 7.5
2022-03-17
Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.
CVE-2022-24726HIGHCVSS 7.5EG 7.5
2022-03-10
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message…
CVE-2022-24464HIGHCVSS 7.5EG 7.5
2022-03-09
.NET and Visual Studio Denial of Service Vulnerability
CVE-2022-24713HIGHCVSS 7.5EG 7.5
2022-03-08
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (…
CVE-2022-24921HIGHCVSS 7.5EG 7.5
2022-03-05
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
CVE-2021-3737HIGHCVSS 7.5EG 7.5
2022-03-04
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest …
CVE-2022-23328HIGHCVSS 7.5EG 7.5
2022-03-04
A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of …
CVE-2022-23327HIGHCVSS 7.5EG 7.5
2022-03-04
A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a de…
CVE-2021-4021HIGHCVSS 7.5EG 7.5
2022-02-24
A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS architecture can lead to uncontrolled resource consumption and DoS.
CVE-2022-24678HIGHCVSS 7.5EG 7.5
2022-02-24
An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agent…
CVE-2022-21698HIGHCVSS 7.5EG 7.5
2022-02-15
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptibl…
CVE-2022-0214HIGHCVSS 7.5EG 7.5
2022-02-14
The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
CVE-2022-23772HIGHCVSS 7.5EG 7.5
2022-02-11
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
CVE-2022-22543HIGHCVSS 7.5EG 7.5
2022-02-09
SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, does not suffici…
CVE-2007-20001HIGHCVSS 7.5EG 7.5
2022-02-06
A flaw was found in StarWind iSCSI target. An attacker could script standard iSCSI Initiator operation(s) to exhaust the StarWind service socket, which could lead to denial of service. This affects iSCSI SAN (Windows Native) Version 3.2.2 …
CVE-2022-23591HIGHCVSS 7.5EG 7.5
2022-02-04
Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as…
CVE-2022-22724HIGHCVSS 7.5EG 7.5
2022-02-04
A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Pro…
CVE-2021-43859HIGHCVSS 7.5EG 7.5
2022-02-01
XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a pa…
CVE-2022-21801HIGHCVSS 7.5EG 7.5
2022-01-28
A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to a reboot. An attacker can send a malicious packet to trigger this…
CVE-2021-40406HIGHCVSS 7.5EG 7.5
2022-01-28
A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP …
CVE-2022-23024HIGHCVSS 7.5EG 7.5
2022-01-25
On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.2, and all versions of 13.1.x, when the IPsec application layer gateway (ALG) logging profile is configured on an IPsec ALG virtual server, undisclosed …
CVE-2022-23015HIGHCVSS 7.5EG 7.5
2022-01-25
On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client Certificate Authentication set to request/require and Session Ticket enabled and …
CVE-2021-23236HIGHCVSS 7.5EG 7.5
2022-01-21
Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be rebooted via a hard reset triggered by pressing a button on the rack system.
CVE-2021-38788HIGHCVSS 7.5EG 7.5
2022-01-19
The Background service in Allwinner R818 SoC Android Q SDK V1.0 is used to manage background applications. Malicious apps can use the interface provided by the service to set the number of applications allowed to run in the background to 0…
CVE-2022-22161HIGHCVSS 7.5EG 7.5
2022-01-19
An Uncontrolled Resource Consumption vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated network based attacker to cause 100% CPU load and the device to become unresponsive by sending a flood of traffic to th…
CVE-2022-22159HIGHCVSS 7.5EG 7.5
2022-01-19
A vulnerability in the NETISR network queue functionality of Juniper Networks Junos OS kernel allows an attacker to cause a Denial of Service (DoS) by sending crafted genuine packets to a device. During an attack, the routing protocol daem…
CVE-2022-21689HIGHCVSS 7.5EG 7.5
2022-01-18
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions the receive mode limits concurrent uploads to 100 per second and blocks …
CVE-2022-21681HIGHCVSS 7.5EG 7.5
2022-01-14
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted mark…
CVE-2022-21680HIGHCVSS 7.5EG 7.5
2022-01-14
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untr…
CVE-2021-30301HIGHCVSS 7.5EG 7.5
2022-01-13
Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile
CVE-2022-21848HIGHCVSS 7.5EG 7.5
2022-01-11
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
CVE-2022-21843HIGHCVSS 7.5EG 7.5
2022-01-11
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
CVE-2021-46149HIGHCVSS 7.5EG 7.5
2022-01-10
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search.
CVE-2021-24893HIGHCVSS 7.5EG 7.5
2022-01-03
The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as …
CVE-2021-44716HIGHCVSS 7.5EG 7.5
2022-01-01
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
CVE-2021-43854HIGHCVSS 7.5EG 7.5
2021-12-23
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable to regular expression denial of s…
CVE-2021-43228HIGHCVSS 7.5EG 7.5
2021-12-15
SymCrypt Denial of Service Vulnerability

Map vulnerabilities like CWE-400 to your infrastructure

EchelonGraph correlates every CVE — across CWE-400 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →