CWE-400— Uncontrolled Resource Consumption (Denial of Service)

The product does not properly control the allocation and maintenance of a limited resource.— MITRE CWE catalog

4,315 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-400page 68 of 87

CVE-2022-47355MEDIUMCVSS 5.5EG 5.5
2023-02-12
In log service, there is a missing permission check. This could lead to local denial of service in log service.
CVE-2022-47354MEDIUMCVSS 5.5EG 5.5
2023-02-12
In log service, there is a missing permission check. This could lead to local denial of service in log service.
CVE-2022-38674MEDIUMCVSS 5.5EG 5.5
2023-02-12
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
CVE-2023-20922MEDIUMCVSS 5.5EG 5.5
2023-01-26
In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploit…
CVE-2023-20908MEDIUMCVSS 5.5EG 5.5
2023-01-26
In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exp…
CVE-2021-26355MEDIUMCVSS 5.5EG 5.5
2023-01-11
Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service.
CVE-2022-46351MEDIUMCVSS 5.5EG 5.5
2022-12-13
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), …
CVE-2022-20482MEDIUMCVSS 5.5EG 5.5
2022-12-13
In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and require factory reset due to resource exhaustion. This could lead to local denial of service with no additional execution pri…
CVE-2021-0934MEDIUMCVSS 5.5EG 5.5
2022-12-13
In findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploi…
CVE-2022-45873MEDIUMCVSS 5.5EG 5.5
2022-11-23
systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling …
CVE-2022-20426MEDIUMCVSS 5.5EG 5.5
2022-11-08
In multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. Use…
CVE-2022-39128MEDIUMCVSS 5.5EG 5.5
2022-10-14
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVE-2022-39127MEDIUMCVSS 5.5EG 5.5
2022-10-14
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVE-2022-39126MEDIUMCVSS 5.5EG 5.5
2022-10-14
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVE-2022-39125MEDIUMCVSS 5.5EG 5.5
2022-10-14
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVE-2022-39124MEDIUMCVSS 5.5EG 5.5
2022-10-14
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVE-2022-39123MEDIUMCVSS 5.5EG 5.5
2022-10-14
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVE-2022-38687MEDIUMCVSS 5.5EG 5.5
2022-10-14
In messaging service, there is a missing permission check. This could lead to local denial of service in messaging service with no additional execution privileges needed.
CVE-2022-38679MEDIUMCVSS 5.5EG 5.5
2022-10-14
In music service, there is a missing permission check. This could lead to local denial of service in music service with no additional execution privileges needed.
CVE-2022-38677MEDIUMCVSS 5.5EG 5.5
2022-10-14
In cell service, there is a missing permission check. This could lead to local denial of service in cell service with no additional execution privileges needed.
CVE-2022-20425MEDIUMCVSS 5.5EG 5.5
2022-10-11
In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent degradation of performance due to resource exhaustion. This could lead to local denial of service with User execution privileges needed. User interaction is not ne…
CVE-2022-41844MEDIUMCVSS 5.5EG 5.5
2022-09-30
An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 and CVE-2019-16088.
CVE-2022-41842MEDIUMCVSS 5.5EG 5.5
2022-09-30
An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc.
CVE-2022-23951MEDIUMCVSS 5.5EG 5.5
2022-09-21
In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs.
CVE-2022-39190MEDIUMCVSS 5.5EG 5.5
2022-09-02
An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.
CVE-2020-35534MEDIUMCVSS 5.5EG 5.5
2022-09-01
In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
CVE-2022-1325MEDIUMCVSS 5.5EG 5.5
2022-08-31
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading …
CVE-2021-3669MEDIUMCVSS 5.5EG 5.5
2022-08-26
A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.
CVE-2021-4022MEDIUMCVSS 5.5EG 5.5
2022-08-25
A vulnerability was found in rizin. The bug involves an ELF64 binary for the HPPA architecture. When a specially crafted binarygets analysed by rizin, it causes rizin to crash by freeing an uninitialized (and potentially user controlled, d…
CVE-2021-3764MEDIUMCVSS 5.5EG 5.5
2022-08-23
A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is…
CVE-2021-3759MEDIUMCVSS 5.5EG 5.5
2022-08-23
A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resour…
CVE-2022-20260MEDIUMCVSS 5.5EG 5.5
2022-08-12
In the Phone app, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation.Prod…
CVE-2021-40606MEDIUMCVSS 5.5EG 5.5
2022-06-28
The gf_bs_write_data function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
CVE-2022-30155MEDIUMCVSS 5.5EG 5.5
2022-06-15
Windows Kernel Denial of Service Vulnerability
CVE-2022-20143MEDIUMCVSS 5.5EG 5.5
2022-06-15
In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for …
CVE-2022-31030MEDIUMCVSS 5.5EG 5.5
2022-06-09
containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` AP…
CVE-2022-29202MEDIUMCVSS 5.5EG 5.5
2022-05-20
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does not fully validate the input arguments. This results in a denial of service by co…
CVE-2022-28191MEDIUMCVSS 5.5EG 5.5
2022-05-17
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be triggered by an unprivileged regular user, which may lead to denial of service.
CVE-2021-33135MEDIUMCVSS 5.5EG 5.5
2022-05-12
Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access.
CVE-2022-27943MEDIUMCVSS 5.5EG 5.5
2022-03-26
libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
CVE-2022-22588MEDIUMCVSS 5.5EG 5.5
2022-03-18
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 15.2.1 and iPadOS 15.2.1. Processing a maliciously crafted HomeKit accessory name may cause a denial of service.
CVE-2021-39624MEDIUMCVSS 5.5EG 5.5
2022-03-16
In PackageManager, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: Andro…
CVE-2021-38989MEDIUMCVSS 5.5EG 5.5
2022-03-07
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 212951.
CVE-2021-38988MEDIUMCVSS 5.5EG 5.5
2022-03-07
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 212950.
CVE-2021-45864MEDIUMCVSS 5.5EG 5.5
2022-03-02
tsMuxer git-c6a0277 was discovered to contain a segmentation fault via DTSStreamReader::findFrame in dtsStreamReader.cpp.
CVE-2020-4925MEDIUMCVSS 5.5EG 5.5
2022-03-01
A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with requests and preventing the daemon to service other requests. IBM X-Force ID: 191599.
CVE-2022-25326MEDIUMCVSS 5.5EG 5.5
2022-02-25
fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on e…
CVE-2022-0695MEDIUMCVSS 5.5EG 5.5
2022-02-24
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
CVE-2022-0476MEDIUMCVSS 5.5EG 5.5
2022-02-23
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
CVE-2021-4115MEDIUMCVSS 5.5EG 5.5
2022-02-21
There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied…

Map vulnerabilities like CWE-400 to your infrastructure

EchelonGraph correlates every CVE — across CWE-400 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →