CWE-400— Uncontrolled Resource Consumption (Denial of Service)

The product does not properly control the allocation and maintenance of a limited resource.— MITRE CWE catalog

4,308 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-400page 58 of 87

CVE-2020-0175MEDIUMCVSS 6.5EG 6.5
2020-06-11
In XMF_ReadNode of eas_xmf.c, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.P…
CVE-2020-0174MEDIUMCVSS 6.5EG 6.5
2020-06-11
In Parse_ptbl of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Produ…
CVE-2020-0173MEDIUMCVSS 6.5EG 6.5
2020-06-11
In Parse_lins of eas_mdls.c, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Pr…
CVE-2020-0172MEDIUMCVSS 6.5EG 6.5
2020-06-11
In Parse_art of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Produc…
CVE-2020-0171MEDIUMCVSS 6.5EG 6.5
2020-06-11
In Parse_lart of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Produ…
CVE-2020-0170MEDIUMCVSS 6.5EG 6.5
2020-06-11
In IMY_Event of eas_imelody.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Pro…
CVE-2020-0169MEDIUMCVSS 6.5EG 6.5
2020-06-11
In RTTTL_Event of eas_rtttl.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Pro…
CVE-2020-3260MEDIUMCVSS 6.5EG 6.5
2020-04-15
A vulnerability in Cisco Aironet Series Access Points Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper processing of cli…
CVE-2020-0993MEDIUMCVSS 6.5EG 6.5
2020-04-15
A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries, aka 'Windows DNS Denial of Service Vulnerability'.
CVE-2020-1625MEDIUMCVSS 6.5EG 6.5
2020-04-08
The kernel memory usage represented as "temp" via 'show system virtual-memory' may constantly increase when Integrated Routing and Bridging (IRB) is configured with multiple underlay physical interfaces, and one interface flaps. This memor…
CVE-2019-18904MEDIUMCVSS 6.5EG 6.5
2020-04-03
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Lin…
CVE-2020-0088MEDIUMCVSS 6.5EG 6.5
2020-03-15
In parseTrackFragmentRun of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed …
CVE-2019-13009MEDIUMCVSS 6.5EG 6.5
2020-03-10
An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. It has Incorrect Acc…
CVE-2020-3181MEDIUMCVSS 6.5EG 6.5
2020-03-04
A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection (AMP) in Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) could allow an unauthenticated remote attacker to exhaust resources on a…
CVE-2020-1700MEDIUMCVSS 6.5EG 6.5
2020-02-07
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. …
CVE-2019-20446MEDIUMCVSS 6.5EG 6.5
2020-02-02
In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects …
CVE-2020-8492MEDIUMCVSS 6.5EG 6.5
2020-01-30
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.Abs…
CVE-2020-3131MEDIUMCVSS 6.5EG 6.5
2020-01-26
A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to explo…
CVE-2019-16018MEDIUMCVSS 6.5EG 6.5
2020-01-26
A vulnerability in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabili…
CVE-2020-7052MEDIUMCVSS 6.5EG 6.5
2020-01-24
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.
CVE-2012-4863MEDIUMCVSS 6.5EG 6.5
2020-01-23
IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability
CVE-2020-1600MEDIUMCVSS 6.5EG 6.5
2020-01-15
In a Point-to-Multipoint (P2MP) Label Switched Path (LSP) scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon (RPD) in Juniper Networks Junos OS allows a specific SNMP request to trigger an infinite …
CVE-2020-6610MEDIUMCVSS 6.5EG 6.5
2020-01-08
GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c.
CVE-2019-20201MEDIUMCVSS 6.5EG 6.5
2019-12-31
An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities, leading to an infinite loop in which memory allocations occur.
CVE-2019-15584MEDIUMCVSS 6.5EG 6.5
2019-12-20
A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.
CVE-2019-16555MEDIUMCVSS 6.5EG 6.5
2019-12-17
A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interr…
CVE-2019-16671MEDIUMCVSS 6.5EG 6.5
2019-12-06
An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Remote authenticated users can crash a device with a special packet because of Uncon…
CVE-2019-16764MEDIUMCVSS 6.5EG 6.5
2019-11-25
The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary v…
CVE-2019-15593MEDIUMCVSS 6.5EG 6.5
2019-11-22
GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.
CVE-2019-10504MEDIUMCVSS 6.5EG 6.5
2019-11-06
Firmware not able to send EXT scan response to host within 1 sec due to resource consumption issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, …
CVE-2011-1459MEDIUMCVSS 6.5EG 6.5
2019-11-05
The WebKit::WebPluginContainerImpl::handleEvent function in Google Chrome before Blink M11 allows an attacker to cause a denial of service (crash) via the htmlpluginelement.cpp plugin.
CVE-2019-15264MEDIUMCVSS 6.5EG 6.5
2019-10-16
A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol implementation of Cisco Aironet and Catalyst 9100 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause an affected device…
CVE-2019-12714MEDIUMCVSS 6.5EG 6.5
2019-10-02
A vulnerability in the web-based management interface of Cisco IC3000 Industrial Compute Gateway could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists bec…
CVE-2019-12700MEDIUMCVSS 6.5EG 6.5
2019-10-02
A vulnerability in the configuration of the Pluggable Authentication Module (PAM) used in Cisco Firepower Threat Defense (FTD) Software, Cisco Firepower Management Center (FMC) Software, and Cisco FXOS Software could allow an authenticated…
CVE-2019-9349MEDIUMCVSS 6.5EG 6.5
2019-09-27
In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: …
CVE-2019-9717MEDIUMCVSS 6.5EG 6.5
2019-09-19
In Libav 12.3, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c has a complex format argument to sscanf.
CVE-2019-13655MEDIUMCVSS 6.5EG 6.5
2019-07-29
Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a small JPEG file to specify dimensions of 64250x64250 pixels, which is mishandled during an attempt to load the 'whole im…
CVE-2019-1010266MEDIUMCVSS 6.5EG 6.5
2019-07-17
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to …
CVE-2019-0046MEDIUMCVSS 6.5EG 6.5
2019-07-11
A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the EX4300 when specific valid broadcast packets create a broadcast storm condition whe…
CVE-2017-12804MEDIUMCVSS 6.5EG 6.5
2019-05-09
The iwgif_init_screen function in imagew-gif.c:510 in ImageWorsener 1.3.2 allows remote attackers to cause a denial of service (hmemory exhaustion) via a crafted file.
CVE-2019-11470MEDIUMCVSS 6.5EG 6.5
2019-04-23
The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in…
CVE-2019-0038MEDIUMCVSS 6.5EG 6.5
2019-04-10
Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial of service (DoS) condition due to buffer space exhaustion. This issue only affects the SRX340 and SRX345 services gatew…
CVE-2018-4409MEDIUMCVSS 6.5EG 6.5
2019-04-03
A resource exhaustion issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1, tvOS 12.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
CVE-2019-4080MEDIUMCVSS 6.5EG 6.5
2019-04-02
IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5, and 9.0 is vulnerable to a potential denial of service, caused by improper parameter parsing. A remote attacker could exploit this to consume all available CPU resources. IBM X-…
CVE-2018-3979MEDIUMCVSS 6.5EG 6.5
2019-04-01
A remote denial-of-service vulnerability exists in the way the Nouveau Display Driver (the default Ubuntu Nvidia display driver) handles GPU shader execution. A specially crafted pixel shader can cause remote denial-of-service issues. An a…
CVE-2019-3874MEDIUMCVSS 6.5EG 6.5
2019-03-25
The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable.
CVE-2019-6559MEDIUMCVSS 6.5EG 6.5
2019-03-05
Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch to crash.
CVE-2018-20543MEDIUMCVSS 6.5EG 6.5
2018-12-28
There is an attempted excessive memory allocation at libxsmm_sparse_csc_reader in generator_spgemm_csc_reader.c in LIBXSMM 1.10 that will cause a denial of service.
CVE-2018-20502MEDIUMCVSS 6.5EG 6.5
2018-12-26
An issue was discovered in Bento4 1.5.1-627. There is an attempt at excessive memory allocation in the AP4_DataBuffer class when called from AP4_HvccAtom::Create in Core/Ap4HvccAtom.cpp.
CVE-2018-19871MEDIUMCVSS 6.5EG 6.5
2018-12-26
An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.

Map vulnerabilities like CWE-400 to your infrastructure

EchelonGraph correlates every CVE — across CWE-400 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →