CWE-400— Uncontrolled Resource Consumption (Denial of Service)

The product does not properly control the allocation and maintenance of a limited resource.— MITRE CWE catalog

4,290 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-400page 34 of 86

CVE-2021-38951HIGHCVSS 7.5EG 7.5
2021-12-09
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CP…
CVE-2021-41014HIGHCVSS 7.5EG 7.5
2021-12-08
A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via huge HTTP packets
CVE-2021-37068HIGHCVSS 7.5EG 7.5
2021-12-07
There is a Resource Management Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to denial of Service Attacks.
CVE-2021-37061HIGHCVSS 7.5EG 7.5
2021-12-07
There is a Uncontrolled Resource Consumption vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Screen projection application denial of service.
CVE-2021-22956HIGHCVSS 7.5EG 7.5
2021-12-07
An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with management interface access to cause a temporary disruption of th…
CVE-2021-22955HIGHCVSS 7.5EG 7.5
2021-12-07
A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtual server could allow an attacker to cause a temporary disruption of the Manageme…
CVE-2021-44686HIGHCVSS 7.5EG 7.5
2021-12-07
calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.
CVE-2021-20609HIGHCVSS 7.5EG 7.5
2021-12-01
Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R Series R08/16/32/120SFCPU, MELSEC iQ-R Series R08/16/32/120PCPU, MELSEC iQ-R Se…
CVE-2021-22965HIGHCVSS 7.5EG 7.5
2021-11-19
A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device.
CVE-2002-20001HIGHCVSS 7.5EG 7.5
2021-11-11
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at …
CVE-2021-42284HIGHCVSS 7.5EG 7.5
2021-11-10
Windows Hyper-V Denial of Service Vulnerability
CVE-2021-43173HIGHCVSS 7.5EG 7.5
2021-11-09
In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. Wh…
CVE-2021-43114HIGHCVSS 7.5EG 7.5
2021-11-09
FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.
CVE-2021-42075HIGHCVSS 7.5EG 7.5
2021-11-08
An issue was discovered in Barrier before 2.3.4. The barriers component (aka the server-side implementation of Barrier) does not correctly close file descriptors for established TCP connections. An unauthenticated remote attacker can thus …
CVE-2021-37471HIGHCVSS 7.5EG 7.5
2021-11-07
Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local con…
CVE-2021-3704HIGHCVSS 7.5EG 7.5
2021-11-01
Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow a Denial of Service on the device.
CVE-2021-27005HIGHCVSS 7.5EG 7.5
2021-11-01
Clustered Data ONTAP versions 9.6 and higher prior to 9.6P16, 9.7P16, 9.8P7 and 9.9.1P3 are susceptible to a vulnerability which could allow a remote attacker to cause a crash of the httpd server.
CVE-2021-40117HIGHCVSS 7.5EG 7.5
2021-10-27
A vulnerability in SSL/TLS message handler for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition …
CVE-2021-34792HIGHCVSS 7.5EG 7.5
2021-10-27
A vulnerability in the memory management of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an aff…
CVE-2021-22101HIGHCVSS 7.5EG 7.5
2021-10-27
Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with label_selectors on multiple V3…
CVE-2021-42836HIGHCVSS 7.5EG 7.5
2021-10-22
GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
CVE-2021-41167HIGHCVSS 7.5EG 7.5
2021-10-20
modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should li…
CVE-2021-31368HIGHCVSS 7.5EG 7.5
2021-10-19
An Uncontrolled Resource Consumption vulnerability in the kernel of Juniper Networks JUNOS OS allows an unauthenticated network based attacker to cause 100% CPU load and the device to become unresponsive by sending a flood of traffic to th…
CVE-2021-37137HIGHCVSS 7.5EG 7.5
2021-10-19
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory us…
CVE-2021-37136HIGHCVSS 7.5EG 7.5
2021-10-19
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can…
CVE-2021-38181HIGHCVSS 7.5EG 7.5
2021-10-12
SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVE-2021-41546HIGHCVSS 7.5EG 7.5
2021-10-12
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM RO…
CVE-2021-3822HIGHCVSS 7.5EG 7.5
2021-09-27
jsoneditor is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-22010HIGHCVSS 7.5EG 7.5
2021-09-23
The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to create a denial of service condition due to excessive memory consu…
CVE-2021-22009HIGHCVSS 7.5EG 7.5
2021-09-23
The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit these issues to create a denial of service condition due …
CVE-2021-39229HIGHCVSS 7.5EG 7.5
2021-09-20
Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just co…
CVE-2021-32838HIGHCVSS 7.5EG 7.5
2021-09-20
Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.
CVE-2021-32839HIGHCVSS 7.5EG 7.5
2021-09-20
sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings…
CVE-2021-23042HIGHCVSS 7.5EG 7.5
2021-09-14
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is configured on a virtual server, undisclosed requests can cause a significant incr…
CVE-2021-23049HIGHCVSS 7.5EG 7.5
2021-09-14
On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed requests can cause an increase in Traffic Management Microkernel (TMM) memory utilizati…
CVE-2021-39123HIGHCVSS 7.5EG 7.5
2021-09-14
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the /rest/gadget/1.0/createdVsResolved/generate endpo…
CVE-2020-9000HIGHCVSS 7.5EG 7.5
2021-09-01
An issue was discovered in iPortalis iCS 7.1.13.0. Attackers can send a sequence of requests to rapidly cause .NET Input Validation errors. This increases the size of the log file on the remote server until memory is exhausted, therefore c…
CVE-2021-3749HIGHCVSS 7.5EG 7.5
2021-08-31
axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-33580HIGHCVSS 7.5EG 7.5
2021-08-18
User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer head…
CVE-2021-38566HIGHCVSS 7.5EG 7.5
2021-08-11
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows stack consumption during recursive processing of embedded XML nodes.
CVE-2021-25659HIGHCVSS 7.5EG 7.5
2021-08-10
A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0 SP9 Update 2). Sending specially crafted packets to port 4410/tcp of an affected system could lead to ext…
CVE-2021-22124HIGHCVSS 7.5EG 7.5
2021-08-04
An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and FortiAuthenticator before 6.0.6 may allow an unauthenticated…
CVE-2021-33196HIGHCVSS 7.5EG 7.5
2021-08-02
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
CVE-2021-36386HIGHCVSS 7.5EG 7.5
2021-07-30
report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error mes…
CVE-2021-3649HIGHCVSS 7.5EG 7.5
2021-07-16
chatwoot is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-0285HIGHCVSS 7.5EG 7.5
2021-07-15
An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large amounts of legitimate traffic destined to the device to cause Interchassis Contro…
CVE-2021-36716HIGHCVSS 7.5EG 7.5
2021-07-14
A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an…
CVE-2021-32740HIGHCVSS 7.5EG 7.5
2021-07-06
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template im…
CVE-2021-22119HIGHCVSS 7.5EG 7.5
2021-06-29
Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client…
CVE-2021-34549HIGHCVSS 7.5EG 7.5
2021-06-29
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.

Map vulnerabilities like CWE-400 to your infrastructure

EchelonGraph correlates every CVE — across CWE-400 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →