CWE-400 · Uncontrolled Resource Consumption (page 3)
Page 3 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33754 | Medium | 6.5 | 2026-07-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and above, prior to 4.14.5, a remote attacker c… |
CVE-2026-44435 | High | 7.5 | 2026-07-16 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised w… |
CVE-2026-44433 | Medium | 5.3 | 2026-07-16 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a… |
CVE-2026-44019 | High | 8.1 | 2026-07-16 | Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling… |
CVE-2026-55407 | | 2026-07-16 | Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's p… | |
CVE-2026-55440 | Medium | 6.5 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handl… |
CVE-2026-52890 | High | 7.1 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/i… |
CVE-2026-36590 | High | 7.5 | 2026-07-15 | An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component |
CVE-2026-55399 | Medium | 4.3 | 2026-07-15 | CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunn… |
CVE-2026-55398 | Low | 3.7 | 2026-07-15 | CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control… |
CVE-2026-33445 | Medium | 5.9 | 2026-07-15 | CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the… |
CVE-2026-33444 | Low | 3.7 | 2026-07-15 | CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate knowledge of and total control over the tu… |
CVE-2026-33443 | Medium | 5.9 | 2026-07-15 | CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel… |
CVE-2026-48357 | Medium | 6.2 | 2026-07-14 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-46627 | Medium | 6.5 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under t… |
CVE-2026-49477 | High | 7.5 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular express… |
CVE-2026-49476 | High | 7.5 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory… |
CVE-2026-48125 | Medium | 5.3 | 2026-07-14 | UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expressio… |
CVE-2026-47736 | High | 7.5 | 2026-07-14 | Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes in… |
CVE-2026-47479 | High | 7.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this v… |
CVE-2026-47476 | High | 7.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this v… |
CVE-2026-58627 | High | 7.5 | 2026-07-14 | Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
CVE-2026-45756 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath compon… |
CVE-2026-59886 | High | 7.5 | 2026-07-14 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact… |
CVE-2026-59885 | High | 7.5 | 2026-07-14 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic tim… |
CVE-2026-59884 | High | 7.5 | 2026-07-14 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuati… |
CVE-2026-59200 | High | 7.5 | 2026-07-14 | Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the P… |
CVE-2026-50653 | High | 7.5 | 2026-07-14 | Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network. |
CVE-2026-49799 | Medium | 6.5 | 2026-07-14 | Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. |
CVE-2026-12523 | High | 7.5 | 2026-07-14 | Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. … |
CVE-2024-7708 | High | 7.5 | 2026-07-14 | For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but… |
CVE-2026-58486 | | 2026-07-13 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to… | |
CVE-2026-51539 | High | 7.5 | 2026-07-13 | A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. The issue stems from improper timeout managemen… |
CVE-2026-10668 | Low | 2.4 | 2026-07-12 | The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage unconditionally (base->CEPTXCNT = len i… |
CVE-2026-59161 | High | 7.5 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRow… |
CVE-2026-55782 | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archiv… | |
CVE-2026-55781 | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive… | |
CVE-2026-55780 | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Ar… | |
CVE-2026-39244 | High | 7.5 | 2026-07-10 | adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buf… |
CVE-2026-8609 | Medium | 5.3 | 2026-07-10 | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust mem… |
CVE-2026-33382 | High | 7.5 | 2026-07-10 | Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large pa… |
CVE-2026-40007 | High | 7.5 | 2026-07-10 | Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's r… |
CVE-2026-51600 | High | 7.5 | 2026-07-09 | Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY methods). When a req… |
CVE-2026-15308 | High | 7.5 | 2026-07-09 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontr… |
CVE-2026-54772 | High | 7.5 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that… |
CVE-2026-51535 | High | 7.5 | 2026-07-08 | In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop. |
CVE-2026-59936 | High | 7.5 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated in… |
CVE-2026-58210 | High | 7.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client c… |
CVE-2026-59937 | High | 7.5 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that caus… |
CVE-2026-59879 | High | 7.5 | 2026-07-08 | Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functiona… |
CVE-2026-55646 | Medium | 6.5 | 2026-07-06 | vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call r… |
CVE-2026-40140 | High | 7.5 | 2026-07-06 | BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insuff… |
CVE-2026-58203 | Medium | 5.3 | 2026-07-06 | pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecretsSettingsSource reads secret values from files in a config… |
CVE-2026-9165 | High | 7.7 | 2026-07-06 | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated G… |
CVE-2026-24012 | High | 7.5 | 2026-07-06 | Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval o… |
CVE-2026-14684 | Low | 3.3 | 2026-07-05 | A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/… |
CVE-2026-14683 | Low | 3.3 | 2026-07-04 | A vulnerability was detected in HdrHistogram up to 2.2.2. Affected by this issue is the function org.HdrHistogram.AbstractHistogram.decodeFromCompressedByteBuf… |
CVE-2026-26307 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources. |
CVE-2026-52192 | High | 7.5 | 2026-07-02 | An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C component |
CVE-2026-54886 | Medium | 4.3 | 2026-07-02 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP c… |
CVE-2026-9563 | High | 7.5 | 2026-07-02 | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consum… |
CVE-2026-54712 | Medium | 5.3 | 2026-07-01 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI con… |
CVE-2026-54260 | Medium | 4.3 | 2026-07-01 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expen… |
CVE-2026-54786 | Medium | 5.0 | 2026-07-01 | Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0… |
CVE-2026-55595 | Medium | 4.7 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid… |
CVE-2026-55594 | Medium | 5.3 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check… |
CVE-2026-47262 | Medium | 5.5 | 2026-07-01 | containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously cra… |
CVE-2026-54428 | High | 7.5 | 2026-07-01 | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allow… |
CVE-2026-49090 | Medium | 6.5 | 2026-07-01 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can su… |
CVE-2026-54399 | High | 7.5 | 2026-07-01 | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows … |
CVE-2026-2891 | | 2026-07-01 | The following Poly Voice IP devices, CCX, Trio, and Edge E, might be inoperable if they connect to a malicious SIP server and receive malformed data. HP is rel… | |
CVE-2026-57962 | Medium | 5.3 | 2026-07-01 | A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplie… |
CVE-2026-52197 | High | 7.5 | 2026-06-30 | An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_44af70 component |
CVE-2026-57204 | Medium | 6.5 | 2026-06-30 | pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can… |
CVE-2026-9002 | Medium | 6.5 | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a denial of service due to improper validation in the XDF decoder… |
CVE-2026-57081 | High | 7.5 | 2026-06-30 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per nested list or dict… |
CVE-2026-57080 | High | 7.5 | 2026-06-30 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _proc… |
CVE-2026-50750 | High | 7.5 | 2026-06-30 | Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an un… |
CVE-2026-13149 | | 2026-06-30 | brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-e… | |
CVE-2026-45822 | | 2026-06-30 | decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(… | |
CVE-2026-56018 | High | 7.5 | 2026-06-29 | JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanu… |
CVE-2026-36478 | High | 7.5 | 2026-06-26 | An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServerApp.dll, Technitiu… |
CVE-2026-47214 | High | 7.1 | 2026-06-26 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backen… |
CVE-2026-30041 | High | 7.5 | 2026-06-26 | An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via… |
CVE-2026-57914 | Medium | 6.5 | 2026-06-26 | By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of s… |
CVE-2026-48619 | High | 7.5 | 2026-06-26 | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This… |
CVE-2026-38640 | High | 7.5 | 2026-06-25 | A reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted str… |
CVE-2026-38637 | High | 7.5 | 2026-06-25 | An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2026-54092 | Medium | 6.5 | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, unche… |
CVE-2026-42005 | Medium | 4.3 | 2026-06-25 | An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web serve… |
CVE-2026-52814 | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymmetric Denial of Serv… | |
CVE-2026-33235 | High | 7.7 | 2026-06-24 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions prior to 0.6.52, the Fil… |
CVE-2026-49851 | High | 7.5 | 2026-06-24 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately… |
CVE-2026-50193 | High | 7.5 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denia… |
CVE-2026-55450 | Critical | 9.3 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the serve… |
CVE-2026-55446 | High | 7.5 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without an… |
CVE-2025-61025 | High | 7.5 | 2026-06-23 | An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2026-56248 | High | 7.5 | 2026-06-23 | Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Securit… |
CVE-2023-54365 | High | 7.5 | 2026-06-23 | Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP… |
CVE-2026-49461 | Medium | 5.5 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory u… |