CWE-400— Uncontrolled Resource Consumption (Denial of Service)

The product does not properly control the allocation and maintenance of a limited resource.— MITRE CWE catalog

4,293 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-400page 39 of 86

CVE-2020-6986HIGHCVSS 7.5EG 7.5
2020-03-05
In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result.
CVE-2020-8661HIGHCVSS 7.5EG 7.5
2020-03-04
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
CVE-2020-1881HIGHCVSS 7.5EG 7.5
2020-02-28
NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have have a resource management error vulnerability. An attacker needs to perform specific operations to trigger a function of th…
CVE-2020-9431HIGHCVSS 7.5EG 7.5
2020-02-27
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.
CVE-2020-3168HIGHCVSS 7.5EG 7.5
2020-02-26
A vulnerability in the Secure Login Enhancements capability of Cisco Nexus 1000V Switch for VMware vSphere could allow an unauthenticated, remote attacker to cause an affected Nexus 1000V Virtual Supervisor Module (VSM) to become inaccessi…
CVE-2020-9369HIGHCVSS 7.5EG 7.5
2020-02-24
Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
CVE-2012-0785HIGHCVSS 7.5EG 7.5
2020-02-24
Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU lo…
CVE-2015-4411HIGHCVSS 7.5EG 7.5
2020-02-20
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomp…
CVE-2012-5366HIGHCVSS 7.5EG 7.5
2020-02-20
The IPv6 implementation in Apple Mac OS X (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
CVE-2012-5365HIGHCVSS 7.5EG 7.5
2020-02-20
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
CVE-2012-5364HIGHCVSS 7.5EG 7.5
2020-02-20
The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
CVE-2012-5363HIGHCVSS 7.5EG 7.5
2020-02-20
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than CVE-2011-2393.
CVE-2012-5362HIGHCVSS 7.5EG 7.5
2020-02-20
The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than CVE-2010-4669.
CVE-2020-4135HIGHCVSS 7.5EG 7.5
2020-02-19
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to send specially crafted packets to cause a denial of service from excessive memory usage.
CVE-2020-3756HIGHCVSS 7.5EG 7.5
2020-02-13
Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have a stack exhaustion vulnerability. Successful exploitation could lead to memory leak .
CVE-2020-3753HIGHCVSS 7.5EG 7.5
2020-02-13
Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have a stack exhaustion vulnerability. Successful exploitation could lead to memory leak .
CVE-2020-3741HIGHCVSS 7.5EG 7.5
2020-02-13
Adobe Experience Manager versions 6.5, and 6.4 have an uncontrolled resource consumption vulnerability. Successful exploitation could lead to denial-of-service.
CVE-2011-3336HIGHCVSS 7.5EG 7.5
2020-02-12
regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.
CVE-2019-13946HIGHCVSS 7.5EG 7.5
2020-02-11
Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due …
CVE-2019-13926HIGHCVSS 7.5EG 7.5
2020-02-11
A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). S…
CVE-2019-13925HIGHCVSS 7.5EG 7.5
2020-02-11
A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). S…
CVE-2020-7920HIGHCVSS 7.5EG 7.5
2020-02-06
pmm-server in Percona Monitoring and Management (PMM) 2.2.x before 2.2.1 allows unauthenticated denial of service.
CVE-2019-9674HIGHCVSS 7.5EG 7.5
2020-02-04
Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
CVE-2013-3074HIGHCVSS 7.5EG 7.5
2020-01-28
NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (device crash).
CVE-2019-5472HIGHCVSS 7.5EG 7.5
2020-01-28
An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments.
CVE-2015-5333HIGHCVSS 7.5EG 7.5
2020-01-23
Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object identifiers in X.509 certificates.
CVE-2012-6083HIGHCVSS 7.5EG 7.5
2020-01-23
Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.
CVE-2019-14888HIGHCVSS 7.5EG 7.5
2020-01-23
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.
CVE-2008-7314HIGHCVSS 7.5EG 7.5
2020-01-23
mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.
CVE-2019-15961HIGHCVSS 7.5EG 7.5
2020-01-15
A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerabilit…
CVE-2014-3447HIGHCVSS 7.5EG 7.5
2020-01-09
BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability
CVE-2014-3211HIGHCVSS 7.5EG 7.5
2020-01-09
Publify before 8.0.1 is vulnerable to a Denial of Service attack
CVE-2019-10775HIGHCVSS 7.5EG 7.5
2020-01-02
ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.
CVE-2019-20176HIGHCVSS 7.5EG 7.5
2019-12-31
In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.
CVE-2012-5645HIGHCVSS 7.5EG 7.5
2019-12-30
A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker could send a specially-crafted packet that, when processed would lead to memory exhaustion or excessive…
CVE-2019-6683HIGHCVSS 7.5EG 7.5
2019-12-23
On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IP virtual servers with Loose Initiation enabled on a FastL4 profile may be subject to excessive flow usage under undiscl…
CVE-2019-6682HIGHCVSS 7.5EG 7.5
2019-12-23
On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessive resources when processing certain types of HTTP responses from the origin web server. This vulne…
CVE-2014-0212HIGHCVSS 7.5EG 7.5
2019-12-13
qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors
CVE-2019-12420HIGHCVSS 7.5EG 7.5
2019-12-12
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
CVE-2013-3691HIGHCVSS 7.5EG 7.5
2019-12-11
AirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long URL.
CVE-2013-4120HIGHCVSS 7.5EG 7.5
2019-12-10
Katello has a Denial of Service vulnerability in API OAuth authentication
CVE-2019-6667HIGHCVSS 7.5EG 7.5
2019-11-27
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under certain conditions, TMM may consume excessive resources when processing traffic for a Virtual Server with the FIX (Financ…
CVE-2019-6477HIGHCVSS 7.5EG 7.5
2019-11-26
With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume m…
CVE-2011-4082HIGHCVSS 7.5EG 7.5
2019-11-26
A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header. A remote attacker could use this flaw to cause a denial of service via specially-crafted request.
CVE-2019-11287HIGHCVSS 7.5EG 7.5
2019-11-23
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a deni…
CVE-2012-0877HIGHCVSS 7.5EG 7.5
2019-11-22
PyXML: Hash table collisions CPU usage Denial of Service
CVE-2019-6661HIGHCVSS 7.5EG 7.5
2019-11-15
When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may consume excessive resources.
CVE-2019-6660HIGHCVSS 7.5EG 7.5
2019-11-15
On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a denial of service.
CVE-2019-17360HIGHCVSS 7.5EG 7.5
2019-11-12
A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an unauthenticated remote user to trigger a denial of service (DoS) condition because of Uncontrolled Resource Consumption.
CVE-2012-1572HIGHCVSS 7.5EG 7.5
2019-11-12
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space

Map vulnerabilities like CWE-400 to your infrastructure

EchelonGraph correlates every CVE — across CWE-400 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →