CWE-400 · Uncontrolled Resource Consumption (page 13)
Page 13 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56921 | High | 7.5 | 2025-02-03 | An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of gmm_… |
CVE-2024-57519 | High | 7.5 | 2025-01-28 | An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file. |
CVE-2025-24151 | Medium | 5.5 | 2025-01-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able… |
CVE-2025-24126 | High | 7.3 | 2025-01-27 | An input validation issue was addressed. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 1… |
CVE-2024-12345 | Medium | 4.4 | 2025-01-27 | A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx o… |
CVE-2025-0704 | Medium | 5.3 | 2025-01-24 | A vulnerability, which was classified as problematic, was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. Affected is the function… |
CVE-2024-53299 | Medium | 6.5 | 2025-01-23 | The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are… |
CVE-2024-57724 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell. |
CVE-2023-37022 | High | 7.5 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID`… |
CVE-2023-37014 | High | 7.5 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2024-43763 | Medium | 6.5 | 2025-01-21 | In build_read_multi_rsp of gatt_sr.cc, there is a possible denial of service due to a logic error in the code. This could lead to remote (proximal/adjacent) de… |
CVE-2024-24424 | High | 7.5 | 2025-01-21 | A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows atta… |
CVE-2025-21549 | High | 7.5 | 2025-01-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.1.0.0. Easi… |
CVE-2025-21548 | Medium | 6.4 | 2025-01-21 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.1.0 and prior. Easily… |
CVE-2025-21547 | Critical | 9.1 | 2025-01-21 | Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected ar… |
CVE-2025-21545 | High | 7.5 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Supported versions that are affected are 8.60 and… |
CVE-2025-21529 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior… |
CVE-2025-23184 | Medium | 5.9 | 2025-01-21 | A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream ins… |
CVE-2018-9447 | Medium | 5.5 | 2025-01-17 | In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible way to crash the emergency callback mode due to a missing null check. This could lead… |
CVE-2024-50953 | High | 7.5 | 2025-01-15 | An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message. |
CVE-2024-54730 | High | 7.5 | 2025-01-14 | Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function. |
CVE-2025-21389 | High | 7.5 | 2025-01-14 | Uncontrolled resource consumption in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to deny service over a network. |
CVE-2025-21330 | High | 7.5 | 2025-01-14 | Windows Remote Desktop Services Denial of Service Vulnerability |
CVE-2025-21300 | High | 7.5 | 2025-01-14 | Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability |
CVE-2025-21290 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21289 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21270 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21251 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21231 | High | 7.5 | 2025-01-14 | IP Helper Denial of Service Vulnerability |
CVE-2025-21230 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21218 | High | 7.5 | 2025-01-14 | Windows Kerberos Denial of Service Vulnerability |
CVE-2025-21207 | High | 7.5 | 2025-01-14 | Windows Connected Devices Platform Service (Cdpsvc) Denial of Service Vulnerability |
CVE-2024-57655 | High | 7.5 | 2025-01-14 | An issue in the dfe_n_in_order component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-47239 | Medium | 6.5 | 2025-01-08 | Dell PowerScale OneFS versions 8.2.2.x through 9.9.0.0 contain an uncontrolled resource consumption vulnerability. A remote low privileged attacker could poten… |
CVE-2025-21614 | High | 7.5 | 2025-01-06 | go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to… |
CVE-2024-55605 | High | 7.5 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large input buffer to t… |
CVE-2024-53647 | Medium | 6.5 | 2024-12-31 | Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests… |
CVE-2024-13058 | | 2024-12-30 | An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and avai… | |
CVE-2024-56200 | High | 8.6 | 2024-12-19 | Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote… |
CVE-2022-27600 | Medium | 6.8 | 2024-12-19 | An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2024-12698 | Medium | 6.5 | 2024-12-18 | An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated stream… |
CVE-2024-54677 | Medium | 5.3 | 2024-12-17 | Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apa… |
CVE-2024-12601 | Medium | 5.3 | 2024-12-17 | The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited heigh… |
CVE-2024-11835 | High | 7.5 | 2024-12-13 | Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.3 before 2.8.1. |
CVE-2024-12579 | Medium | 5.3 | 2024-12-13 | The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to… |
CVE-2024-54113 | Medium | 6.5 | 2024-12-12 | Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect power consumption. |
CVE-2024-49129 | High | 7.5 | 2024-12-12 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability |
CVE-2024-49096 | High | 7.5 | 2024-12-12 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2024-49075 | High | 7.5 | 2024-12-12 | Windows Remote Desktop Services Denial of Service Vulnerability |
CVE-2024-42426 | Medium | 4.3 | 2024-12-09 | Dell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource consumption vulnerability. A low privilege remote attacker could potent… |
CVE-2024-12254 | High | 7.5 | 2024-12-06 | Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer… |
CVE-2024-11498 | High | 7.5 | 2024-11-25 | There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is p… |
CVE-2024-52804 | High | 7.5 | 2024-11-22 | Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes… |
CVE-2018-9412 | Medium | 5.5 | 2024-11-19 | In removeUnsynchronization of ID3.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no ad… |
CVE-2024-45420 | Medium | 4.3 | 2024-11-19 | Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-39180 | Medium | 4.0 | 2024-11-18 | A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime… |
CVE-2024-38828 | Medium | 5.3 | 2024-11-18 | Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack. |
CVE-2024-52520 | Medium | 5.7 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigg… |
CVE-2023-20125 | High | 8.6 | 2024-11-15 | A vulnerability in the local interface of Cisco BroadWorks Network Server could allow an unauthenticated, remote attacker to exhaust system resources, causing… |
CVE-2024-48989 | High | 7.5 | 2024-11-13 | A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, renderi… |
CVE-2024-9409 | High | 7.5 | 2024-11-13 | CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communication loss when a la… |
CVE-2024-47535 | Medium | 5.5 | 2024-11-12 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsaf… |
CVE-2024-46891 | Medium | 5.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly restrict the size of generated… |
CVE-2024-10345 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Więsek. | |
CVE-2024-10344 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Więsek. | |
CVE-2024-10314 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the auto-generation function was identified. Reported by Karol W… | |
CVE-2024-38826 | | 2024-11-11 | Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack aga… | |
CVE-2024-51513 | Medium | 5.5 | 2024-11-05 | Vulnerability of processes not being fully terminated in the VPN module Impact: Successful exploitation of this vulnerability will affect power consumption. |
CVE-2024-10599 | Medium | 5.3 | 2024-10-31 | A vulnerability, which was classified as problematic, has been found in Tongda OA 2017 up to 11.7. This issue affects some unknown processing of the file /inc/… |
CVE-2024-50354 | Medium | 5.5 | 2024-10-31 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys all… |
CVE-2024-31152 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series of crafted HTTP req… |
CVE-2024-10466 | High | 7.5 | 2024-10-29 | By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability… |
CVE-2024-49767 | High | 7.5 | 2024-10-25 | Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werk… |
CVE-2024-20526 | Medium | 5.3 | 2024-10-23 | A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a denial of serv… |
CVE-2024-20351 | High | 8.6 | 2024-10-23 | A vulnerability in the TCP/IP traffic handling function of the Snort Detection Engine of Cisco Firepower Threat Defense (FTD) Software and Cisco FirePOWER Serv… |
CVE-2024-21536 | High | 7.5 | 2024-10-19 | Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRej… |
CVE-2024-21232 | Low | 2.2 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.4.2 and prior a… |
CVE-2024-21231 | Low | 3.1 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and p… |
CVE-2024-21230 | Medium | 6.5 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and… |
CVE-2024-21219 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior… |
CVE-2024-21218 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and… |
CVE-2024-21207 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38 and prior, 8.4.1 and prior and… |
CVE-2024-21204 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.4.0 and 9.0.1 and prior. Easily… |
CVE-2024-21203 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior… |
CVE-2024-21196 | Medium | 6.5 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and… |
CVE-2024-21194 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and… |
CVE-2024-45736 | Medium | 6.5 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privil… |
CVE-2024-8184 | Medium | 5.9 | 2024-10-14 | There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service… |
CVE-2024-6762 | Low | 3.1 | 2024-10-14 | Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory. |
CVE-2024-9823 | Medium | 5.3 | 2024-10-14 | There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the s… |
CVE-2024-47497 | High | 7.5 | 2024-10-11 | An Uncontrolled Resource Consumption vulnerability in the http daemon (httpd) of Juniper Networks Junos OS on SRX Series, QFX Series, MX Series and EX Series a… |
CVE-2024-7294 | High | 7.5 | 2024-10-09 | In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting. |
CVE-2024-43575 | High | 7.5 | 2024-10-08 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2024-43545 | High | 7.5 | 2024-10-08 | Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability |
CVE-2024-43544 | High | 7.5 | 2024-10-08 | Microsoft Simple Certificate Enrollment Protocol Denial of Service Vulnerability |
CVE-2024-43541 | High | 7.5 | 2024-10-08 | Microsoft Simple Certificate Enrollment Protocol Denial of Service Vulnerability |
CVE-2024-43515 | High | 7.5 | 2024-10-08 | Internet Small Computer Systems Interface (iSCSI) Denial of Service Vulnerability |
CVE-2024-43506 | High | 7.5 | 2024-10-08 | BranchCache Denial of Service Vulnerability |
CVE-2024-38149 | High | 7.5 | 2024-10-08 | BranchCache Denial of Service Vulnerability |
CVE-2024-8626 | High | 7.5 | 2024-10-08 | Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability… |