CWE-400 · Uncontrolled Resource Consumption (page 12)
Page 12 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21577 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-21575 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and… |
CVE-2025-21574 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and… |
CVE-2023-42983 | Medium | 6.4 | 2025-04-11 | Processing a file may lead to a denial-of-service or potentially disclose memory contents. This issue is fixed in macOS 14. The issue was addressed with improv… |
CVE-2025-27081 | Medium | 6.8 | 2025-04-10 | A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of Service. |
CVE-2025-27486 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-27485 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-27473 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. |
CVE-2025-27470 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-27469 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2025-26680 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-26673 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2025-26652 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-26641 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network. |
CVE-2025-21174 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2024-52981 | Medium | 4.9 | 2025-04-08 | An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause… |
CVE-2024-52980 | Medium | 6.5 | 2025-04-08 | A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elast… |
CVE-2024-52974 | Medium | 6.5 | 2025-04-08 | An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requir… |
CVE-2025-29478 | Medium | 5.5 | 2025-04-07 | An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165. |
CVE-2025-29477 | Medium | 5.5 | 2025-04-04 | An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event. |
CVE-2024-56528 | High | 7.5 | 2025-04-03 | This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits). It involves sending… |
CVE-2024-47212 | High | 7.5 | 2025-04-03 | An issue was discovered in Iglu Server 0.13.0 and below. It involves sending very large payloads to a particular API endpoint of Iglu Server and can render it… |
CVE-2025-27829 | High | 7.3 | 2025-04-01 | An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.35. If multicast streams are enabled on different interfaces, it may be possible… |
CVE-2025-24269 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to cause unexpected system termination. |
CVE-2025-24264 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18… |
CVE-2025-24260 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker in a p… |
CVE-2025-24247 | Critical | 9.8 | 2025-03-31 | A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker ma… |
CVE-2025-24235 | Medium | 5.5 | 2025-03-31 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5… |
CVE-2025-24211 | Critical | 9.8 | 2025-03-31 | This issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5… |
CVE-2025-24199 | Medium | 5.5 | 2025-03-31 | An uncontrolled format string issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura… |
CVE-2025-24190 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5… |
CVE-2025-3016 | Medium | 4.3 | 2025-03-31 | A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::Par… |
CVE-2025-2586 | High | 7.5 | 2025-03-31 | A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints i… |
CVE-2025-29490 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a segmentation fault via the decompileCALLMETHOD function. This vulnerability allows attackers to cause a Denial of Se… |
CVE-2025-29487 | High | 7.5 | 2025-03-27 | An out-of-memory error in the parseABC_STRING_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to allocator exhaustion. |
CVE-2025-29484 | High | 7.5 | 2025-03-27 | An out-of-memory error in the parseABC_NS_SET_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to allocator exhaustion. |
CVE-2025-2833 | Medium | 5.3 | 2025-03-27 | A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header… |
CVE-2025-2820 | Medium | 6.5 | 2025-03-26 | An authenticated attacker can compromise the availability of the device via the network |
CVE-2025-25374 | High | 7.5 | 2025-03-25 | In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causin… |
CVE-2025-26500 | Medium | 4.6 | 2025-03-21 | : Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation. Specifically crafted USB packets m… |
CVE-2025-30160 | High | 7.5 | 2025-03-20 | Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condi… |
CVE-2025-0191 | Medium | 6.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in the file upload feature of gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability is due to improper… |
CVE-2025-0187 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1. The vulnerability is due to improper han… |
CVE-2024-7771 | Medium | 6.5 | 2025-03-20 | A vulnerability in the Dockerized version of mintplex-labs/anything-llm (latest, digest 1d9452da2b92) allows for a denial of service. Uploading an audio file w… |
CVE-2024-6838 | Medium | 5.3 | 2025-03-20 | In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due… |
CVE-2024-12864 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2.0.0. The vulnerability is due to impro… |
CVE-2024-12761 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in the brycedrennan/imaginairy repository, version 15.0.0. The vulnerability is present in the `/api/stablestudi… |
CVE-2024-12074 | Medium | 6.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability was discovered in the file upload feature of automatic1111/stable-diffusion-webui version 1.10.0. The vulnerability is… |
CVE-2024-12070 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6). The vulnerability i… |
CVE-2024-12063 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling… |
CVE-2024-11043 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occur… |
CVE-2024-11033 | Medium | 6.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in the file upload feature of binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handl… |
CVE-2024-10912 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of f… |
CVE-2024-10188 | High | 7.5 | 2025-03-20 | A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_… |
CVE-2024-10110 | High | 7.5 | 2025-03-20 | In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main… |
CVE-2024-25132 | Medium | 4.3 | 2025-03-19 | A flaw was found in the Hive hibernation controller component of OpenShift Dedicated. The ClusterDeployment.hive.openshift.io/v1 resource can be created with t… |
CVE-2025-29907 | High | 7.5 | 2025-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and den… |
CVE-2025-25293 | High | 7.5 | 2025-03-12 | ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to re… |
CVE-2025-0114 | High | 7.5 | 2025-03-12 | A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the se… |
CVE-2024-54546 | High | 7.5 | 2025-03-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An app may be able to cause unexpected system termination or co… |
CVE-2024-44227 | High | 7.5 | 2025-03-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to cause unexpected sy… |
CVE-2024-44192 | Medium | 5.5 | 2025-03-10 | The issue was addressed with improved checks. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Proces… |
CVE-2024-53693 | High | 7.1 | 2025-03-07 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-53458 | High | 7.5 | 2025-03-05 | Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packets. |
CVE-2025-27669 | High | 7.5 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Network Scanning (XSPA)/DoS OVE-20230524-0013. |
CVE-2025-27421 | High | 7.5 | 2025-03-03 | Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events (… |
CVE-2024-34036 | Medium | 4.3 | 2025-02-25 | An issue was discovered in O-RAN Near Realtime RIC I-Release. To exploit this vulnerability, an attacker can disrupt the initial connection between a gNB and t… |
CVE-2024-34035 | Medium | 5.7 | 2025-02-25 | An issue was discovered in O-RAN Near Realtime RIC H-Release. To trigger the crashing of the e2mgr, an adversary must flood the system with a significant quant… |
CVE-2025-27100 | Medium | 6.5 | 2025-02-21 | lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by ex… |
CVE-2025-27097 | High | 7.5 | 2025-02-20 | GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST… |
CVE-2023-51316 | High | 7.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Bus Reservation System v1.1 allows attackers to send an excessive amount of email for a… |
CVE-2023-51314 | High | 7.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Restaurant Booking System v3.0 allows attackers to send an excessive a… |
CVE-2023-51301 | High | 7.5 | 2025-02-19 | A lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of re… |
CVE-2023-51293 | High | 7.5 | 2025-02-19 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event Booking Calendar v4.0 allows attackers to send an excessive amou… |
CVE-2024-57782 | Medium | 6.8 | 2025-02-13 | An issue in Docker-proxy v18.09.0 allows attackers to cause a denial of service. |
CVE-2023-34397 | High | 7.5 | 2025-02-13 | Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. During parsing you can trigger that the service will be crashed. |
CVE-2025-0426 | Medium | 6.2 | 2025-02-13 | A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint… |
CVE-2024-56940 | High | 7.5 | 2025-02-12 | An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file uploads. |
CVE-2024-46923 | High | 7.5 | 2025-02-12 | An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. The absence of a null check leads to a Denial of Service at amdgpu_cs_ib_fill… |
CVE-2025-25205 | High | 8.2 | 2025-02-12 | Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic… |
CVE-2025-21352 | Medium | 6.5 | 2025-02-11 | Internet Connection Sharing (ICS) Denial of Service Vulnerability |
CVE-2025-21351 | High | 7.5 | 2025-02-11 | Windows Active Directory Domain Services API Denial of Service Vulnerability |
CVE-2025-21181 | High | 7.5 | 2025-02-11 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2024-23814 | Medium | 5.3 | 2025-02-11 | The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted… |
CVE-2025-25193 | Medium | 5.5 | 2025-02-10 | Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of env… |
CVE-2024-54658 | Medium | 6.5 | 2025-02-10 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1… |
CVE-2025-25186 | Medium | 6.5 | 2025-02-10 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0… |
CVE-2024-57673 | Medium | 5.5 | 2025-02-06 | An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module and Linkdiscovery module |
CVE-2024-57672 | Medium | 5.5 | 2025-02-06 | An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topologylnstance module, Routing module. |
CVE-2024-45626 | Medium | 6.5 | 2025-02-06 | Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a de… |
CVE-2024-57085 | High | 7.5 | 2025-02-05 | A prototype pollution in the function deepMerge of @stryker-mutator/util v8.6.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted pay… |
CVE-2024-57082 | Medium | 6.5 | 2025-02-05 | A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted… |
CVE-2024-57081 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted pa… |
CVE-2024-57079 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57076 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57075 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57074 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2025-21087 | High | 7.5 | 2025-02-05 | When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in me… |
CVE-2025-20058 | High | 7.5 | 2025-02-05 | When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Softwa… |
CVE-2024-53851 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs wasn't enforcing limit… |