CWE-400— Uncontrolled Resource Consumption (Denial of Service)

The product does not properly control the allocation and maintenance of a limited resource.— MITRE CWE catalog

4,293 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-400page 43 of 86

CVE-2018-10193HIGHCVSS 7.5EG 7.5
2018-04-18
LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser hang) via an HTML document because the resource consumption of onloadwff.js grows with the number of INPUT elements.
CVE-2018-10070HIGHCVSS 7.5EG 7.5
2018-04-16
A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM by sending a crafted FTP request on port 21 that begins with many '\0' characters, preventing the …
CVE-2018-0022HIGHCVSS 7.5EG 7.5
2018-04-11
A Junos device with VPLS routing-instances configured on one or more interfaces may be susceptible to an mbuf leak when processing a specific MPLS packet. Approximately 1 mbuf is leaked per each packet processed. The number of mbufs is pla…
CVE-2018-8777HIGHCVSS 7.5EG 7.5
2018-04-03
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause …
CVE-2018-4100HIGHCVSS 7.5EG 7.5
2018-04-03
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. watchOS before 4.2.2 is affected. The issue involves the "LinkPresentation" component. It allows remote attackers to cause …
CVE-2018-1064HIGHCVSS 7.5EG 7.5
2018-03-28
libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.
CVE-2016-9589HIGHCVSS 7.5EG 7.5
2018-03-12
Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily…
CVE-2017-12174HIGHCVSS 7.5EG 7.5
2018-03-07
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full …
CVE-2017-18214HIGHCVSS 7.5EG 7.5
2018-03-04
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.
CVE-2018-7048HIGHCVSS 7.5EG 7.5
2018-03-01
An issue was discovered in Wowza Streaming Engine before 4.7.1. There is a denial of service (memory consumption) via a crafted HTTP request.
CVE-2018-6532HIGHCVSS 7.5EG 7.5
2018-02-27
An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated and unauthenticated) requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer.
CVE-2017-17290HIGHCVSS 7.5EG 7.5
2018-02-15
The Light Directory Access Protocol (LDAP) clients of Huawei TE60 with software V600R006C00, ViewPoint 9030 with software V100R011C02, V100R011C03 have a resource management errors vulnerability. An unauthenticated, remote attacker may mak…
CVE-2017-15133HIGHCVSS 7.5EG 7.5
2018-01-29
A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting new connections.
CVE-2017-3768HIGHCVSS 7.5EG 7.5
2018-01-26
An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Lenovo System x and earlier than 6.4 for IBM System x). Flooding the IMM2 with a high volume of authen…
CVE-2017-15132HIGHCVSS 7.5EG 7.5
2018-01-25
A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login proce…
CVE-2018-5954HIGHCVSS 7.5EG 7.5
2018-01-25
phpFreeChat 1.7 and earlier allows remote attackers to cause a denial of service by sending a large number of connect commands.
CVE-2018-5748HIGHCVSS 7.5EG 7.5
2018-01-25
qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply.
CVE-2018-4837HIGHCVSS 7.5EG 7.5
2018-01-25
A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with access to the TeleControl Server Basic's webserver (port 80/tcp or 443/tcp) could cause a Denial-of-Service condition on the web server. The remaining…
CVE-2018-0094HIGHCVSS 7.5EG 7.5
2018-01-18
A vulnerability in IPv6 ingress packet processing for Cisco UCS Central Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to high CPU utilization on the targeted device. The vulnerabi…
CVE-2018-0090HIGHCVSS 7.5EG 7.5
2018-01-18
A vulnerability in management interface access control list (ACL) configuration of Cisco NX-OS System Software could allow an unauthenticated, remote attacker to bypass configured ACLs on the management interface. This could allow traffic …
CVE-2017-13211HIGHCVSS 7.5EG 7.5
2018-01-12
In bta_scan_results_cb_impl of btif_ble_scanner.cc, there is possible resource exhaustion if a large number of repeated BLE scan results are received. This could lead to a remote denial of service of a critical system process with no addit…
CVE-2017-17901HIGHCVSS 7.5EG 7.5
2017-12-29
ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption) via a flood of IP packets with a TTL of 1.
CVE-2014-3651HIGHCVSS 7.5EG 7.5
2017-12-29
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.
CVE-2017-12741HIGHCVSS 7.5EG 7.5
2017-12-26
Specially crafted packets sent to port 161/udp could cause a denial of service condition. The affected devices must be restarted manually.
CVE-2017-15701HIGHCVSS 7.5EG 7.5
2017-12-01
In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all availabl…
CVE-2017-1000191HIGHCVSS 7.5EG 7.5
2017-11-17
Jool 3.5.0-3.5.1 is vulnerable to a kernel crashing packet resulting in a DOS.
CVE-2017-14028HIGHCVSS 7.5EG 7.5
2017-11-16
A Resource Exhaustion issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be a…
CVE-2017-12318HIGHCVSS 7.5EG 7.5
2017-11-16
A vulnerability in the TCP state machine of Cisco RF Gateway 1 devices could allow an unauthenticated, remote attacker to prevent an affected device from delivering switched digital video (SDV) or video on demand (VoD) streams, resulting i…
CVE-2017-14360HIGHCVSS 7.5EG 7.5
2017-11-08
A potential security vulnerability has been identified in HPE Content Manager Workgroup Service v9.00. The vulnerability could be remotely exploited to allow Denial of Service (DoS).
CVE-2017-2889HIGHCVSS 7.5EG 7.5
2017-11-07
An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A large amount of simultaneous TCP connections causes the APID daemon to repeatedly fork, causing the daemon to run out o…
CVE-2017-2884HIGHCVSS 7.5EG 7.5
2017-11-07
An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. A repeated set of specially crafted API calls can cause the device to corrupt essential memory, resulting in a bricked…
CVE-2017-15882HIGHCVSS 7.5EG 7.5
2017-10-26
The London Trust Media Private Internet Access (PIA) application before 1.3.3.1 for Android allows remote attackers to cause a denial of service (application crash) via a large VPN server-list file.
CVE-2017-7086HIGHCVSS 7.5EG 7.5
2017-10-23
An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "libc" component. It allows remote attackers to …
CVE-2014-9697HIGHCVSS 7.5EG 7.5
2017-10-17
Huawei USG9560/9520/9580 before V300R001C01SPC300 allows remote attackers to cause a memory leak or denial of service (memory exhaustion, reboot and MPU switchover) via a crafted website.
CVE-2017-10614HIGHCVSS 7.5EG 7.5
2017-10-13
A vulnerability in telnetd service on Junos OS allows a remote attacker to cause a limited memory and/or CPU consumption denial of service attack. This issue was found during internal product security testing. Affected releases are Juniper…
CVE-2017-10608HIGHCVSS 7.5EG 7.5
2017-10-13
Any Juniper Networks SRX series device with one or more ALGs enabled may experience a flowd crash when traffic is processed by the Sun/MS-RPC ALGs. This vulnerability in the Sun/MS-RPC ALG services component of Junos OS allows an attacker …
CVE-2017-15193HIGHCVSS 7.5EG 7.5
2017-10-10
In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.
CVE-2015-7384HIGHCVSS 7.5EG 7.5
2017-10-10
Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.
CVE-2017-14086HIGHCVSS 7.5EG 7.5
2017-10-06
Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to start the fcgiOfcDDA.exe executable or cause a potential INI corruption, w…
CVE-2017-15010HIGHCVSS 7.5EG 7.5
2017-10-04
A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an ex…
CVE-2017-14616HIGHCVSS 7.5EG 7.5
2017-09-20
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opene…
CVE-2013-7428HIGHCVSS 7.5EG 7.5
2017-09-07
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2_proxy.php.
CVE-2017-14158HIGHCVSS 7.5EG 7.5
2017-09-05
Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually written in a separ…
CVE-2017-14137HIGHCVSS 7.5EG 7.5
2017-09-04
ReadWEBPImage in coders/webp.c in ImageMagick 7.0.6-5 has an issue where memory allocation is excessive because it depends only on a length field in a header.
CVE-2015-2313HIGHCVSS 7.5EG 7.5
2017-08-09
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which trig…
CVE-2015-2312HIGHCVSS 7.5EG 7.5
2017-08-09
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption) via a list with a large number of elements.
CVE-2015-1417HIGHCVSS 7.5EG 7.5
2017-07-25
The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and 8.x before 8.4-STABLE, 8.4-RELEASE-p35 on systems with VNET enabled and at leas…
CVE-2017-11521HIGHCVSS 7.5EG 7.5
2017-07-22
The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows remote attackers to cause a denial of service (memory consumption) by triggering many media connections.
CVE-2017-7063HIGHCVSS 7.5EG 7.5
2017-07-20
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. watchOS before 3.2.3 is affected. The issue involves the "Messages" component. It allows remote attackers to cause a denial of service (memory consumption an…
CVE-2017-7007HIGHCVSS 7.5EG 7.5
2017-07-20
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the "EventKitUI" component. It allows remote attackers to cause a denial of service (resource consumption and application crash).

Map vulnerabilities like CWE-400 to your infrastructure

EchelonGraph correlates every CVE — across CWE-400 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →