CWE-400 · Uncontrolled Resource Consumption (page 10)
Page 10 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6416 | Low | 2.7 | 2026-04-22 | Tanium addressed an uncontrolled resource consumption vulnerability in Interact. |
CVE-2026-41146 | | 2026-04-22 | facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop whe… | |
CVE-2026-41135 | High | 7.5 | 2026-04-22 | free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. A memory leak vulnerabili… |
CVE-2026-6797 | Medium | 4.3 | 2026-04-21 | A vulnerability was identified in Sanluan PublicCMS up to 6.202506.d. Affected by this vulnerability is the function ZipSecureFile.setMinflateRatio of the file… |
CVE-2026-40924 | Medium | 6.5 | 2026-04-21 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2… |
CVE-2026-34308 | Medium | 6.5 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9… |
CVE-2026-34304 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9… |
CVE-2026-34303 | Medium | 6.5 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a… |
CVE-2026-34293 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable… |
CVE-2026-34290 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2… |
CVE-2026-34282 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2026-34281 | Medium | 6.5 | 2026-04-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnera… |
CVE-2026-34278 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45. Easily exploi… |
CVE-2026-34277 | Medium | 6.6 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.61-8.6… |
CVE-2026-34276 | Medium | 6.5 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.0-8.0.45… |
CVE-2026-34272 | Medium | 6.5 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.6.0. Easily exploit… |
CVE-2026-34271 | Medium | 6.5 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.0-8.0.45… |
CVE-2026-34270 | Medium | 6.5 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.0-8.0.45… |
CVE-2026-34267 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45. Easily exploi… |
CVE-2026-22021 | Medium | 5.3 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions… |
CVE-2026-22017 | Medium | 6.5 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a… |
CVE-2026-22009 | Medium | 6.5 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a… |
CVE-2026-22005 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a… |
CVE-2026-22004 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9… |
CVE-2026-22003 | Medium | 6.0 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected ar… |
CVE-2026-22002 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a… |
CVE-2026-21998 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a… |
CVE-2026-6781 | High | 7.5 | 2026-04-21 | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6780 | High | 7.5 | 2026-04-21 | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6777 | Medium | 5.3 | 2026-04-21 | Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-39396 | Low | 3.1 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extra… |
CVE-2026-39320 | High | 7.5 | 2026-04-21 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression… |
CVE-2026-6060 | Medium | 4.5 | 2026-04-20 | A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be kil… |
CVE-2026-6607 | Medium | 5.3 | 2026-04-20 | A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint… |
CVE-2026-6601 | Medium | 4.3 | 2026-04-20 | A vulnerability has been found in Lagom WHMCS Template up to 2.4.2. This impacts an unknown function of the component Datatables. The manipulation leads to res… |
CVE-2026-40347 | Medium | 5.3 | 2026-04-18 | Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/fo… |
CVE-2026-40481 | High | 7.5 | 2026-04-17 | monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoint buffers the entire request body into… |
CVE-2026-40303 | High | 7.5 | 2026-04-17 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie… |
CVE-2026-40192 | High | 7.5 | 2026-04-15 | Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making the… |
CVE-2026-3505 | High | 7.5 | 2026-04-15 | Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (… |
CVE-2024-33618 | High | 7.5 | 2026-04-15 | Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network int… |
CVE-2026-35034 | Medium | 6.5 | 2026-04-14 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoin… |
CVE-2026-27308 | Low | 2.4 | 2026-04-14 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-ser… |
CVE-2026-27307 | Low | 2.4 | 2026-04-14 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-ser… |
CVE-2026-33116 | High | 7.5 | 2026-04-14 | Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network. |
CVE-2026-26171 | High | 7.5 | 2026-04-14 | Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-2405 | Medium | 6.5 | 2026-04-14 | CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Ad… |
CVE-2026-30998 | High | 7.5 | 2026-04-13 | An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (Do… |
CVE-2026-39304 | High | 7.5 | 2026-04-10 | Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not corre… |
CVE-2026-5986 | Medium | 5.3 | 2026-04-09 | A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation… |
CVE-2026-23869 | High | 7.5 | 2026-04-08 | A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and… |
CVE-2026-34166 | Low | 3.7 | 2026-04-08 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for m… |
CVE-2026-33459 | Medium | 6.5 | 2026-04-08 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to… |
CVE-2026-39865 | Medium | 5.9 | 2026-04-08 | Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a… |
CVE-2026-35406 | Medium | 6.2 | 2026-04-07 | Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset cause… |
CVE-2026-34045 | High | 8.2 | 2026-04-07 | Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allow… |
CVE-2026-32588 | Medium | 6.5 | 2026-04-07 | Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recomm… |
CVE-2026-35441 | Medium | 6.5 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus' GraphQL endpoints (/graphql and /graphql/system) d… |
CVE-2026-0049 | Medium | 6.2 | 2026-04-06 | In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of… |
CVE-2025-58349 | Critical | 9.1 | 2026-04-06 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-54324 | High | 7.5 | 2026-04-06 | An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-59440 | High | 7.5 | 2026-04-06 | An issue was discovered in USIM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2026-34148 | High | 7.5 | 2026-04-06 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP… |
CVE-2026-26477 | Medium | 4.3 | 2026-04-03 | An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.ph… |
CVE-2022-4986 | High | 7.5 | 2026-04-02 | Hirschmann EagleSDV version 05.4.01 prior to 05.4.02 contains a denial-of-service vulnerability that causes the device to crash during session establishment wh… |
CVE-2024-14033 | High | 7.5 | 2026-04-02 | Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TL… |
CVE-2026-34827 | High | 7.5 | 2026-04-02 | Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head pa… |
CVE-2026-34593 | High | 7.5 | 2026-04-02 | Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally cr… |
CVE-2026-34829 | High | 7.5 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO wh… |
CVE-2026-34826 | Medium | 5.3 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limi… |
CVE-2026-34230 | Medium | 5.3 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encoding processes Accept-Encoding values wit… |
CVE-2026-31935 | High | 7.5 | 2026-04-02 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, u… |
CVE-2026-5316 | Medium | 4.3 | 2026-04-02 | A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to… |
CVE-2026-22815 | High | 7.5 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling c… |
CVE-2026-34445 | High | 8.6 | 2026-04-01 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was… |
CVE-2026-34404 | High | 7.5 | 2026-03-31 | Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older version… |
CVE-2026-34043 | Medium | 5.9 | 2026-03-31 | Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerab… |
CVE-2026-33750 | Medium | 6.5 | 2026-03-27 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace patte… |
CVE-2026-28375 | Medium | 6.5 | 2026-03-27 | A testdata data-source can be used to trigger out-of-memory crashes in Grafana. |
CVE-2026-27879 | Medium | 6.5 | 2026-03-27 | A resample query can be used to trigger out-of-memory crashes in Grafana. |
CVE-2026-27859 | Medium | 5.3 | 2026-03-27 | A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message causes mail delivery… |
CVE-2026-27858 | High | 7.5 | 2026-03-27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force manages… |
CVE-2026-27857 | Medium | 4.3 | 2026-03-27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This… |
CVE-2026-33623 | Medium | 6.7 | 2026-03-26 | PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.4` contains a Windows-only command injection iss… |
CVE-2026-33541 | Medium | 6.5 | 2026-03-26 | TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Pr… |
CVE-2026-33375 | Medium | 6.5 | 2026-03-26 | The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out… |
CVE-2026-4926 | High | 7.5 | 2026-03-26 | Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated… |
CVE-2026-3116 | Medium | 4.9 | 2026-03-26 | Mattermost Plugins versions <=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows an authenticated attacker to cause servi… |
CVE-2026-33287 | High | 7.5 | 2026-03-26 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaS… |
CVE-2026-33285 | High | 7.5 | 2026-03-26 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's `memoryLimit` security mechanism can b… |
CVE-2026-26233 | Medium | 4.3 | 2026-03-25 | Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows unauthenticated re… |
CVE-2026-20084 | High | 8.6 | 2026-03-25 | A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded be… |
CVE-2026-33268 | Medium | 6.5 | 2026-03-25 | Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume stora… |
CVE-2026-28874 | High | 7.5 | 2026-03-25 | The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remote attacker may cause an unexpected app termination. |
CVE-2026-33538 | High | 7.5 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.58 and 9.6.0-alpha.52, an unauthe… |
CVE-2026-33474 | Medium | 6.5 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 1.0.0-rc0 and prior to version 2.2.0, unbounded image decoding and resizing… |
CVE-2026-30662 | Medium | 6.5 | 2026-03-24 | ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager component. The 'download' method in 'concrete/controllers/backend/file… |
CVE-2026-30653 | High | 7.5 | 2026-03-24 | An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of the component AMF |
CVE-2026-4727 | High | 7.5 | 2026-03-24 | Denial-of-service in the Libraries component in NSS. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4726 | High | 7.5 | 2026-03-24 | Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |