CWE-400 · Uncontrolled Resource Consumption (page 10)
Page 10 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-56264 | High | 7.5 | 2025-09-16 | The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability. |
CVE-2025-43295 | Medium | 5.5 | 2025-09-15 | A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7 and iPadOS 18.7, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS… |
CVE-2025-43796 | High | 7.5 | 2025-09-12 | Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the nu… |
CVE-2025-59139 | Medium | 5.3 | 2025-09-12 | Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the `bodyLimit` middleware could al… |
CVE-2025-48041 | | 2025-09-11 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerabili… | |
CVE-2025-48040 | | 2025-09-11 | Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated wi… | |
CVE-2025-48039 | | 2025-09-11 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. Th… | |
CVE-2025-48038 | | 2025-09-11 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. Th… | |
CVE-2025-20340 | High | 7.4 | 2025-09-10 | A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a… |
CVE-2025-49460 | Medium | 4.3 | 2025-09-09 | Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2025-52322 | High | 7.5 | 2025-09-09 | An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to the SMF (PGW-C), us… |
CVE-2025-40802 | Low | 3.1 | 2025-09-09 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device may be susceptible to resource exhaustion when su… |
CVE-2025-58451 | | 2025-09-08 | Cattown is a JavaScript markdown parser. Versions prior to 1.0.2 used regular expressions with inefficient, potentially exponential worst-case complexity. This… | |
CVE-2025-52288 | High | 7.5 | 2025-09-08 | Assertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the Access and Mobility Management Function (AMF) component, in O… |
CVE-2025-58369 | Medium | 5.3 | 2025-09-05 | fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vuln… |
CVE-2024-40664 | Medium | 6.2 | 2025-09-04 | In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility service due to a logic error in the code… |
CVE-2025-48542 | Medium | 5.5 | 2025-09-04 | In multiple functions of AccountManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denia… |
CVE-2025-26463 | Medium | 5.5 | 2025-09-04 | In allowPackageAccess of multiple files, resource exhaustion is possible when repeatedly adding allowed packages. This could lead to a local persistent denial… |
CVE-2025-26449 | Medium | 5.5 | 2025-09-04 | In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additiona… |
CVE-2025-26423 | Medium | 6.2 | 2025-09-04 | In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to… |
CVE-2025-43772 | | 2025-09-04 | Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict t… | |
CVE-2025-36892 | High | 7.5 | 2025-09-04 | Denial of service |
CVE-2025-52494 | High | 7.5 | 2025-09-03 | Adacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes during connection init… |
CVE-2024-13065 | Medium | 6.3 | 2025-09-03 | Improper Enforcement of Behavioral Workflow, Uncontrolled Resource Consumption vulnerability in Akinsoft MyRezzta allows Input Data Manipulation, CAPEC - 125 -… |
CVE-2025-57614 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Integer overflow and invalid input vulnerability in the cached method allows an attacker to… |
CVE-2025-58157 | High | 7.5 | 2025-08-29 | gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication… |
CVE-2025-9670 | Medium | 5.3 | 2025-08-29 | A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipu… |
CVE-2025-29898 | Medium | 6.5 | 2025-08-29 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-54995 | Medium | 6.5 | 2025-08-28 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can l… |
CVE-2024-49740 | Medium | 5.5 | 2025-08-26 | In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privi… |
CVE-2025-55634 | High | 7.5 | 2025-08-22 | Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unau… |
CVE-2025-55631 | Medium | 4.0 | 2025-08-22 | Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to manage users' sessions system wide instead of an… |
CVE-2025-9341 | | 2025-08-22 | Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bou… | |
CVE-2025-57751 | | 2025-08-21 | pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk paramet… | |
CVE-2025-55521 | Medium | 6.5 | 2025-08-21 | An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service (DoS) via a crafted POST requ… |
CVE-2025-9308 | Low | 3.3 | 2025-08-21 | A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation l… |
CVE-2025-48956 | High | 7.5 | 2025-08-21 | vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Service (DoS) vulnerability can be trigger… |
CVE-2025-5115 | High | 7.5 | 2025-08-20 | In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for e… |
CVE-2025-8449 | | 2025-08-20 | CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted reque… | |
CVE-2025-9182 | High | 7.5 | 2025-08-19 | Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, a… |
CVE-2025-55029 | High | 7.5 | 2025-08-19 | Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks. This vulnerability was fixed in Firefox… |
CVE-2025-55028 | Medium | 6.5 | 2025-08-19 | Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks. This… |
CVE-2025-55588 | High | 7.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fw_ip parameter at /boafrm/formPortFw. This vulnerability allows attac… |
CVE-2025-55587 | High | 7.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability all… |
CVE-2025-55586 | High | 7.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the url parameter at /boafrm/formFilter. This vulnerability allows attacke… |
CVE-2025-9092 | | 2025-08-16 | Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0 bc-fips (API modules) allows Excessiv… | |
CVE-2025-38501 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from… |
CVE-2025-50861 | Medium | 6.5 | 2025-08-14 | The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication… |
CVE-2025-54472 | High | 7.5 | 2025-08-14 | Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network… |
CVE-2025-55197 | High | 7.5 | 2025-08-13 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requi… |
CVE-2025-50615 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00470c50 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-53722 | High | 7.5 | 2025-08-12 | Uncontrolled resource consumption in Windows Remote Desktop Services allows an unauthorized attacker to deny service over a network. |
CVE-2025-27576 | Low | 2.9 | 2025-08-12 | Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated… |
CVE-2025-27250 | Low | 3.5 | 2025-08-12 | Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated us… |
CVE-2025-26863 | Low | 3.8 | 2025-08-12 | Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user t… |
CVE-2025-26697 | Low | 3.3 | 2025-08-12 | Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user t… |
CVE-2025-26472 | Medium | 5.7 | 2025-08-12 | Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated us… |
CVE-2025-40766 | Medium | 5.5 | 2025-08-12 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers witho… |
CVE-2025-55152 | Medium | 5.3 | 2025-08-09 | oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it'… |
CVE-2025-54884 | | 2025-08-06 | Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the generateSecureId and getSecure… | |
CVE-2025-8537 | Low | 3.7 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of th… |
CVE-2025-54796 | High | 7.5 | 2025-08-02 | Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is… |
CVE-2025-53012 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested impor… |
CVE-2025-54575 | Medium | 5.3 | 2025-07-30 | ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension b… |
CVE-2025-54572 | | 2025-07-30 | The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ru… | |
CVE-2025-43235 | Medium | 5.5 | 2025-07-30 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. An app may be able to cause a denial-of-service. |
CVE-2025-43193 | Critical | 9.8 | 2025-07-30 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able… |
CVE-2024-42651 | High | 7.5 | 2025-07-29 | NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle. This vulnerability allows attackers to cause a D… |
CVE-2025-8262 | Medium | 4.3 | 2025-07-28 | A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file s… |
CVE-2025-46171 | Medium | 5.4 | 2025-07-23 | vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy… |
CVE-2025-53538 | High | 7.5 | 2025-07-22 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and b… |
CVE-2025-44653 | High | 7.5 | 2025-07-21 | In H3C GR2200 MiniGR1A0V100R016, the USERLIMIT_GLOBAL option is set to 0 in the /etc/bftpd.conf. This can cause DoS attacks when unlimited users are connected. |
CVE-2025-44651 | High | 7.5 | 2025-07-21 | In TRENDnet TPL-430AP FW1.0, the USERLIMIT_GLOBAL option is set to 0 in the bftpd-related configuration file. This can cause DoS attacks when unlimited users a… |
CVE-2025-44650 | High | 7.5 | 2025-07-21 | In Netgear R7000 V1.3.1.64_10.1.36 and EAX80 V1.0.1.70_1.0.2, the USERLIMIT_GLOBAL option is set to 0 in the bftpd.conf configuration file. This can cause DoS… |
CVE-2025-41677 | Medium | 4.9 | 2025-07-21 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast successio… |
CVE-2025-41676 | Medium | 4.9 | 2025-07-21 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession. |
CVE-2025-50057 | | 2025-07-18 | A DOS vulnerability in RSFiles! component 1.16.3-1.17.7 Joomla was discovered. The issue allows unauthenticated remote attackers to deny access to service via… | |
CVE-2025-53023 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.42. Easily expl… |
CVE-2025-50104 | Low | 2.7 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9… |
CVE-2025-50103 | Medium | 4.4 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are 9.0.0-9.3.0. Diff… |
CVE-2025-50102 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50101 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50100 | Low | 2.2 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8… |
CVE-2025-50099 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9… |
CVE-2025-50098 | Low | 2.7 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50097 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.0-8.0.42, 8… |
CVE-2025-50096 | Medium | 4.4 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9… |
CVE-2025-50095 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.3.0. Easily exploit… |
CVE-2025-50094 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.42, 8.4.5 and 9.3.0. Easily… |
CVE-2025-50093 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9… |
CVE-2025-50092 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9… |
CVE-2025-50091 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50089 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.1.0. Easily exploit… |
CVE-2025-50088 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-50083 | Medium | 6.5 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50082 | Medium | 6.5 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50080 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-… |
CVE-2025-50079 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-50078 | Medium | 6.5 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9… |
CVE-2025-50077 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9… |