CWE-400 · Uncontrolled Resource Consumption (page 3)
Page 3 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-88290 | High | 7.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing… |
CVE-2026-88286 | High | 7.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ conn… |
CVE-2026-73786 | High | 7.5 | 2026-09-09 | A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack. Succe… |
CVE-2026-71616 | Medium | 6.2 | 2026-09-09 | An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object(). Fi… |
CVE-2026-22591 | High | 7.5 | 2026-09-09 | eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14… |
CVE-2026-86204 | Medium | 6.5 | 2026-09-09 | PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of ser… |
CVE-2026-86201 | High | 7.5 | 2026-09-09 | PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT pr… |
CVE-2025-71418 | Medium | 5.3 | 2026-09-09 | PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers ca… |
CVE-2026-53937 | Medium | 6.2 | 2026-09-09 | MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `k… |
CVE-2026-82001 | Medium | 5.5 | 2026-09-08 | Acrobat Reader is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit th… |
CVE-2026-76000 | Medium | 6.5 | 2026-09-08 | ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this v… |
CVE-2026-28617 | Medium | 5.5 | 2026-09-08 | In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no… |
CVE-2026-28596 | Medium | 5.5 | 2026-09-08 | In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local de… |
CVE-2026-83968 | High | 7.8 | 2026-09-08 | Use after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72923 | High | 7.5 | 2026-09-08 | In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML… |
CVE-2026-86734 | Medium | 6.5 | 2026-09-08 | Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit… |
CVE-2026-86135 | | 2026-09-08 | A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized… | |
CVE-2026-79378 | High | 7.5 | 2026-09-08 | An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Se… |
CVE-2026-12611 | | 2026-09-08 | A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and… | |
CVE-2026-86515 | Medium | 4.3 | 2026-09-08 | A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txt… |
CVE-2026-86513 | Medium | 5.3 | 2026-09-08 | A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file s… |
CVE-2026-86511 | Medium | 5.3 | 2026-09-08 | A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/mai… |
CVE-2026-86319 | Medium | 5.3 | 2026-09-07 | A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/ja… |
CVE-2026-86452 | High | 7.5 | 2026-09-07 | Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting… |
CVE-2026-86421 | Low | 3.7 | 2026-09-07 | ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallo… |
CVE-2026-86420 | Low | 3.7 | 2026-09-07 | ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such… |
CVE-2022-51018 | Medium | 6.5 | 2026-09-07 | PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable bo… |
CVE-2026-86347 | Medium | 6.5 | 2026-09-07 | Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wild… |
CVE-2026-86255 | Medium | 6.5 | 2026-09-06 | wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long period… |
CVE-2026-86250 | High | 7.5 | 2026-09-06 | h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() funct… |
CVE-2020-37277 | Medium | 6.5 | 2026-09-06 | PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clien… |
CVE-2026-85703 | Medium | 6.5 | 2026-09-04 | A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the… |
CVE-2026-55512 | Medium | 5.3 | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is r… |
CVE-2021-44320 | High | 7.5 | 2026-09-04 | Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device availability (… |
CVE-2021-44319 | High | 7.5 | 2026-09-04 | Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing rem… |
CVE-2026-19645 | Medium | 6.5 | 2026-09-04 | IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requ… |
CVE-2026-85585 | High | 7.5 | 2026-09-04 | SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique… |
CVE-2026-85443 | High | 7.5 | 2026-09-03 | MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLoop() where the accept thread performs a blocking receive wi… |
CVE-2026-85107 | Medium | 4.3 | 2026-09-03 | A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/… |
CVE-2026-85100 | Medium | 4.3 | 2026-09-03 | A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squ… |
CVE-2026-84888 | Medium | 4.3 | 2026-09-03 | A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec of the file crates/openfang-runtime/src/… |
CVE-2026-84886 | Medium | 5.3 | 2026-09-03 | A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_… |
CVE-2026-84857 | Medium | 5.3 | 2026-09-02 | A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulatio… |
CVE-2026-84833 | Medium | 4.3 | 2026-09-02 | A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of… |
CVE-2026-49249 | | 2026-09-02 | Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0… | |
CVE-2026-19475 | Medium | 6.5 | 2026-09-02 | An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause… |
CVE-2026-84375 | High | 7.5 | 2026-09-01 | js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does no… |
CVE-2026-84289 | Medium | 4.3 | 2026-09-01 | A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the co… |
CVE-2026-84364 | Medium | 5.3 | 2026-09-01 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names… |
CVE-2026-73773 | High | 7.5 | 2026-09-01 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability results in the abi… |
CVE-2026-73759 | Medium | 6.5 | 2026-09-01 | Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets… |
CVE-2026-73754 | Medium | 5.3 | 2026-09-01 | Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the norma… |
CVE-2026-73746 | Low | 3.1 | 2026-09-01 | A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a… |
CVE-2026-73744 | Low | 3.5 | 2026-09-01 | A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privileg… |
CVE-2026-73728 | Medium | 6.5 | 2026-09-01 | Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a d… |
CVE-2026-73715 | High | 7.5 | 2026-09-01 | A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful e… |
CVE-2026-84304 | | 2026-09-01 | gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recv… | |
CVE-2026-52023 | High | 7.5 | 2026-09-01 | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_p… |
CVE-2026-52022 | High | 7.5 | 2026-09-01 | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components |
CVE-2026-51788 | High | 7.5 | 2026-09-01 | An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verification function and the accounts/models.py com… |
CVE-2026-83619 | | 2026-09-01 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in… | |
CVE-2026-83614 | | 2026-09-01 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, a… | |
CVE-2026-83612 | | 2026-09-01 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing thr… | |
CVE-2026-83606 | | 2026-09-01 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instru… | |
CVE-2026-84235 | | 2026-09-01 | A denial-of-service security issue exists in the affected product. The security issue stems from a crafted CIP packet being sent crashing the module. The devic… | |
CVE-2026-84138 | Medium | 6.5 | 2026-09-01 | Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
CVE-2026-82743 | | 2026-09-01 | Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits… | |
CVE-2026-82742 | | 2026-09-01 | Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relati… | |
CVE-2026-82735 | | 2026-09-01 | Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length co… | |
CVE-2026-82397 | High | 7.5 | 2026-08-31 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with url… |
CVE-2026-82333 | High | 7.5 | 2026-08-28 | multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's fie… |
CVE-2026-77037 | High | 7.5 | 2026-08-28 | multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream… |
CVE-2026-55520 | | 2026-08-28 | Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex tran… | |
CVE-2026-55248 | Critical | 9.1 | 2026-08-28 | plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS port… |
CVE-2026-55247 | Critical | 9.1 | 2026-08-28 | plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py acce… |
CVE-2026-55108 | High | 8.5 | 2026-08-28 | KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the… |
CVE-2026-38638 | High | 7.5 | 2026-08-28 | An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2026-38636 | High | 7.5 | 2026-08-28 | An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2026-37237 | High | 7.5 | 2026-08-28 | vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch… |
CVE-2026-82261 | High | 7.5 | 2026-08-28 | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form des… |
CVE-2026-82260 | High | 7.5 | 2026-08-28 | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory ex… |
CVE-2026-82256 | Medium | 5.3 | 2026-08-28 | SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads… |
CVE-2026-82235 | Medium | 5.9 | 2026-08-28 | filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscal… |
CVE-2026-52687 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory… |
CVE-2026-42395 | Medium | 4.3 | 2026-08-28 | A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The log… |
CVE-2026-42391 | High | 7.5 | 2026-08-28 | An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow dis… |
CVE-2026-40019 | Medium | 5.9 | 2026-08-28 | An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This… |
CVE-2026-40017 | Medium | 6.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD c… |
CVE-2026-40014 | Medium | 6.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message… |
CVE-2026-33607 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for a… |
CVE-2026-33605 | High | 7.5 | 2026-08-28 | An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mod… |
CVE-2026-27852 | High | 7.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes exce… |
CVE-2026-13108 | | 2026-08-28 | WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service. | |
CVE-2026-59315 | Medium | 5.3 | 2026-08-27 | The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0… |
CVE-2026-59282 | High | 7.5 | 2026-08-27 | Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a D… |
CVE-2026-53580 | High | 8.1 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a no… |
CVE-2026-81725 | Low | 3.7 | 2026-08-27 | NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption… |
CVE-2026-81723 | Low | 3.7 | 2026-08-27 | NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on ev… |
CVE-2026-81721 | High | 7.5 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded mem… |
CVE-2026-81720 | Medium | 6.2 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory cond… |