CWE-400— Uncontrolled Resource Consumption (Denial of Service)
The product does not properly control the allocation and maintenance of a limited resource.— MITRE CWE catalog
4,327 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-400page 79 of 87
- CVE-2024-21218MEDIUMCVSS 4.9EG 4.92024-10-15
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attack…
- CVE-2024-21207MEDIUMCVSS 4.9EG 4.92024-10-15
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38 and prior, 8.4.1 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attack…
- CVE-2024-21204MEDIUMCVSS 4.9EG 4.92024-10-15
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.4.0 and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access v…
- CVE-2024-21203MEDIUMCVSS 4.9EG 4.92024-10-15
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged a…
- CVE-2024-21194MEDIUMCVSS 4.9EG 4.92024-10-15
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attack…
- CVE-2024-39810MEDIUMCVSS 4.9EG 4.92024-08-22
Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a C…
- CVE-2024-37299MEDIUMCVSS 4.9EG 4.92024-07-30
Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availability of a Discourse instance. This vulnerability is fixed in 3.2.5 and 3.3.0.beta…
- CVE-2024-21185MEDIUMCVSS 4.9EG 4.92024-07-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38, 8.4.1 and 9.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via mul…
- CVE-2024-21173MEDIUMCVSS 4.9EG 4.92024-07-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network a…
- CVE-2024-21142MEDIUMCVSS 4.9EG 4.92024-07-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged a…
- CVE-2024-21130MEDIUMCVSS 4.9EG 4.92024-07-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker wit…
- CVE-2024-21127MEDIUMCVSS 4.9EG 4.92024-07-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with netw…
- CVE-2024-20996MEDIUMCVSS 4.9EG 4.92024-07-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network a…
- CVE-2024-38360MEDIUMCVSS 4.9EG 4.92024-07-15
Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters, a moderator can reduce the availability of a Discourse instance. This issue ha…
- CVE-2024-23443MEDIUMCVSS 4.9EG 4.92024-06-19
A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.
- CVE-2024-4284MEDIUMCVSS 4.9EG 4.92024-05-19
A vulnerability in mintplex-labs/anything-llm allows for a denial of service (DoS) condition through the modification of a user's `id` attribute to a value of 0. This issue affects the current version of the software, with the latest commi…
- CVE-2024-28717MEDIUMCVSS 4.9EG 4.92024-04-22
An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.
- CVE-2024-21062MEDIUMCVSS 4.9EG 4.92024-04-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker wit…
- CVE-2024-21057MEDIUMCVSS 4.9EG 4.92024-04-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via …
- CVE-2024-21055MEDIUMCVSS 4.9EG 4.92024-04-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via …
- CVE-2024-21051MEDIUMCVSS 4.9EG 4.92024-04-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multip…
- CVE-2024-21050MEDIUMCVSS 4.9EG 4.92024-04-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multip…
- CVE-2024-23450MEDIUMCVSS 4.9EG 4.92024-03-27
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
- CVE-2024-28176MEDIUMCVSS 4.9EG 4.92024-03-09
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has …
- CVE-2024-20978MEDIUMCVSS 4.9EG 4.92024-02-17
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker wit…
- CVE-2024-20976MEDIUMCVSS 4.9EG 4.92024-02-17
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker wit…
- CVE-2024-20972MEDIUMCVSS 4.9EG 4.92024-02-17
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker wit…
- CVE-2024-20716MEDIUMCVSS 4.9EG 4.92024-02-15
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could leverage this vulnera…
- CVE-2023-29153MEDIUMCVSS 4.9EG 4.92024-02-14
Uncontrolled resource consumption for some Intel(R) SPS firmware before version SPS_E5_06.01.04.002.0 may allow a privileged user to potentially enable denial of service via network access.
- CVE-2023-22819MEDIUMCVSS 4.9EG 4.92024-02-05
An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Weste…
- CVE-2024-20983MEDIUMCVSS 4.9EG 4.92024-01-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multip…
- CVE-2024-20981MEDIUMCVSS 4.9EG 4.92024-01-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with netw…
- CVE-2024-20971MEDIUMCVSS 4.9EG 4.92024-01-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker wit…
- CVE-2024-20965MEDIUMCVSS 4.9EG 4.92024-01-16
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker wit…
- CVE-2023-34324MEDIUMCVSS 4.9EG 4.92024-01-05
Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. …
- CVE-2023-46118MEDIUMCVSS 4.9EG 4.92023-10-25
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient cred…
- CVE-2023-42031MEDIUMCVSS 4.9EG 4.92023-10-25
IBM TXSeries for Multiplatforms, 8.1, 8.2, and 9.1, CICS TX Standard CICS TX Advanced 10.1 and 11.1 could allow a privileged user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 266016.
- CVE-2023-32229MEDIUMCVSS 4.9EG 4.92023-06-15
Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5,…
- CVE-2023-28837MEDIUMCVSS 4.9EG 4.92023-04-03
Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded …
- CVE-2022-42950MEDIUMCVSS 4.9EG 4.92023-02-06
An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be k…
- CVE-2022-39194MEDIUMCVSS 4.9EG 4.92022-09-02
An issue was discovered in the MediaWiki through 1.38.2. The community configuration pages for the GrowthExperiments extension could cause a site to become unavailable due to insufficient validation when certain actions (including page mov…
- CVE-2022-2764MEDIUMCVSS 4.9EG 4.92022-09-01
A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.
- CVE-2022-31075MEDIUMCVSS 4.9EG 4.92022-07-11
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, EdgeCore may be susceptible to a DoS attack on CloudHub if an attack…
- CVE-2021-32503MEDIUMCVSS 4.9EG 4.92022-04-01
Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system.
- CVE-2021-36310MEDIUMCVSS 4.9EG 4.92021-11-20
Dell Networking OS10, versions 10.4.3.x, 10.5.0.x, 10.5.1.x & 10.5.2.x, contain an uncontrolled resource consumption flaw in its API service. A high-privileged API user may potentially exploit this vulnerability, leading to a denial of ser…
- CVE-2021-23852MEDIUMCVSS 4.9EG 4.92021-06-09
An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS).
- CVE-2021-27617MEDIUMCVSS 4.9EG 4.92021-05-11
The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when u…
- CVE-2020-6866MEDIUMCVSS 4.9EG 4.92020-04-30
A ZTE product is impacted by a resource management error vulnerability. An attacker could exploit this vulnerability to cause a denial of service by issuing a specific command. This affects: ZXCTN 6500 version V2.10.00R3B87.
- CVE-2019-13007MEDIUMCVSS 4.9EG 4.92020-03-10
An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Cons…
- CVE-2020-8123MEDIUMCVSS 4.9EG 4.92020-02-04
A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.
Map vulnerabilities like CWE-400 to your infrastructure
EchelonGraph correlates every CVE — across CWE-400 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →