CWE-400 · Uncontrolled Resource Consumption (page 5)
Page 5 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49343 | Medium | 5.9 | 2026-08-07 | Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-e… |
CVE-2026-47249 | High | 7.5 | 2026-08-07 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array ampl… |
CVE-2026-54338 | Medium | 5.3 | 2026-08-07 | JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators… |
CVE-2026-71870 | | 2026-08-07 | pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_b… | |
CVE-2026-65819 | High | 7.5 | 2026-08-07 | gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets bef… |
CVE-2026-62296 | High | 7.5 | 2026-08-07 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum e… |
CVE-2026-62295 | High | 7.5 | 2026-08-07 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fh… |
CVE-2026-19113 | Medium | 5.3 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints… |
CVE-2025-63235 | High | 7.5 | 2026-08-07 | In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid… |
CVE-2026-16265 | Medium | 6.5 | 2026-08-07 | The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, al… |
CVE-2026-70646 | High | 7.5 | 2026-08-06 | aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body bef… |
CVE-2026-64958 | High | 7.5 | 2026-08-06 | An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachm… |
CVE-2026-57819 | High | 7.5 | 2026-08-06 | Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default… |
CVE-2026-67872 | High | 7.5 | 2026-08-06 | An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling |
CVE-2026-67864 | High | 7.5 | 2026-08-05 | An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component |
CVE-2026-71314 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop… |
CVE-2026-71310 | Medium | 5.9 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper i… |
CVE-2026-63457 | Medium | 6.5 | 2026-08-05 | A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78. |
CVE-2026-48834 | High | 7.5 | 2026-08-05 | Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attacker… |
CVE-2026-67862 | High | 7.5 | 2026-08-04 | open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c. This allows a remote attacker to caus… |
CVE-2026-67861 | High | 7.5 | 2026-08-04 | An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes component |
CVE-2026-67856 | High | 7.5 | 2026-08-04 | An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItems(Sampling)… |
CVE-2026-67855 | High | 7.5 | 2026-08-04 | open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remo… |
CVE-2026-70489 | Medium | 6.5 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_we… |
CVE-2026-61387 | High | 7.5 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server… |
CVE-2026-58045 | Medium | 6.2 | 2026-08-04 | A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process t… |
CVE-2026-58042 | Medium | 5.9 | 2026-08-04 | A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this co… |
CVE-2026-56846 | High | 7.5 | 2026-08-04 | A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability aff… |
CVE-2026-67978 | High | 7.5 | 2026-08-03 | An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame. |
CVE-2026-69249 | | 2026-08-03 | python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolvin… | |
CVE-2026-67977 | High | 7.5 | 2026-08-03 | An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service (DoS) via a crafte… |
CVE-2026-67973 | High | 7.5 | 2026-08-03 | An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs. |
CVE-2026-69244 | | 2026-08-03 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parse… | |
CVE-2026-67976 | High | 7.5 | 2026-08-03 | The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Ser… |
CVE-2026-69152 | High | 7.5 | 2026-08-03 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not appl… |
CVE-2026-67318 | Medium | 5.3 | 2026-08-01 | axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVe… |
CVE-2026-67313 | High | 7.5 | 2026-08-01 | axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Atta… |
CVE-2026-67312 | High | 7.5 | 2026-08-01 | axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used… |
CVE-2026-53505 | High | 7.5 | 2026-07-31 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on… |
CVE-2026-53504 | High | 7.5 | 2026-07-31 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on… |
CVE-2026-52857 | Medium | 5.5 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configurati… |
CVE-2026-18358 | High | 7.5 | 2026-07-31 | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming conne… |
CVE-2026-55497 | Medium | 6.5 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but… |
CVE-2026-10695 | Medium | 6.2 | 2026-07-30 | IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries. |
CVE-2024-25039 | High | 7.5 | 2026-07-30 | IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connecti… |
CVE-2026-9322 | High | 7.5 | 2026-07-30 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service vi… |
CVE-2026-67437 | High | 7.5 | 2026-07-29 | OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2… |
CVE-2026-63119 | Medium | 6.2 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client… |
CVE-2026-16543 | | 2026-07-29 | Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingres… | |
CVE-2026-15228 | | 2026-07-29 | Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of… | |
CVE-2026-58182 | High | 8.6 | 2026-07-29 | The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8… |
CVE-2026-65324 | High | 7.5 | 2026-07-29 | Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affe… |
CVE-2026-58151 | High | 7.5 | 2026-07-29 | Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: fr… |
CVE-2026-59942 | High | 7.5 | 2026-07-28 | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can… |
CVE-2026-59941 | High | 7.5 | 2026-07-28 | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dim… |
CVE-2026-14981 | High | 7.5 | 2026-07-28 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to un… |
CVE-2026-59932 | High | 7.5 | 2026-07-28 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0… |
CVE-2026-59933 | High | 7.5 | 2026-07-28 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0… |
CVE-2026-54609 | High | 8.6 | 2026-07-28 | QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQ… |
CVE-2026-66299 | Medium | 5.3 | 2026-07-28 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24… |
CVE-2026-66920 | | 2026-07-28 | Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traver… | |
CVE-2026-66913 | | 2026-07-28 | Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted Z… | |
CVE-2026-42493 | High | 7.5 | 2026-07-28 | Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costl… |
CVE-2025-63913 | High | 7.5 | 2026-07-27 | An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a… |
CVE-2026-55685 | High | 7.5 | 2026-07-27 | React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would… |
CVE-2026-64724 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m… |
CVE-2026-43806 | Medium | 5.5 | 2026-07-27 | A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.6. A local attacker may be able to cause a denia… |
CVE-2026-43804 | Medium | 6.5 | 2026-07-27 | This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. Visi… |
CVE-2026-43768 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able t… |
CVE-2026-28932 | Medium | 5.5 | 2026-07-27 | A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Son… |
CVE-2026-66144 | High | 7.5 | 2026-07-24 | Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service at… |
CVE-2026-66143 | High | 7.5 | 2026-07-24 | It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which ma… |
CVE-2026-66142 | High | 7.5 | 2026-07-24 | Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial o… |
CVE-2026-14257 | High | 7.5 | 2026-07-23 | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (d… |
CVE-2026-21723 | Medium | 5.3 | 2026-07-23 | The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing t… |
CVE-2026-38763 | Medium | 5.5 | 2026-07-22 | An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a denial of service via the function sub_13828 |
CVE-2026-45820 | High | 7.5 | 2026-07-22 | fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring com… |
CVE-2026-63263 | Medium | 6.5 | 2026-07-22 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user ma… |
CVE-2026-63261 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user c… |
CVE-2026-63260 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-pr… |
CVE-2026-56819 | High | 7.5 | 2026-07-21 | Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through… |
CVE-2026-62518 | High | 7.6 | 2026-07-21 | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-62508 | Low | 3.1 | 2026-07-21 | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-62465 | Medium | 6.6 | 2026-07-21 | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.9-12… |
CVE-2026-61247 | Medium | 4.8 | 2026-07-21 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12… |
CVE-2026-61195 | Medium | 6.5 | 2026-07-21 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Core). The supported version that is affected is 6.2… |
CVE-2026-61194 | Medium | 6.5 | 2026-07-21 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Core). The supported version that is affected is 6.2… |
CVE-2026-61192 | Medium | 5.3 | 2026-07-21 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is… |
CVE-2026-61186 | Critical | 9.4 | 2026-07-21 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is… |
CVE-2026-61165 | High | 7.1 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is… |
CVE-2026-61160 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The suppo… |
CVE-2026-61155 | Critical | 9.1 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is… |
CVE-2026-61147 | Medium | 6.2 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). T… |
CVE-2026-61144 | Medium | 4.9 | 2026-07-21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server… |
CVE-2026-61128 | Medium | 4.9 | 2026-07-21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server… |
CVE-2026-61123 | Medium | 4.2 | 2026-07-21 | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12… |
CVE-2026-61109 | Medium | 6.5 | 2026-07-21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 8.4… |
CVE-2026-61108 | Medium | 6.5 | 2026-07-21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are MySQL Server: 9.7… |
CVE-2026-61093 | Medium | 6.5 | 2026-07-21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server… |
CVE-2026-61070 | Medium | 5.3 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Cash Management). The supported version that… |