CWE-400 · Uncontrolled Resource Consumption (page 8)
Page 8 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-70347 | Medium | 5.5 | 2026-02-10 | An issue in mquickjs before commit 74b7e (2026-01-15) allows a local attacker to cause a denial of service via a crafted file to the get_mblock_size function a… |
CVE-2024-54192 | Medium | 5.5 | 2026-02-10 | An issue inTcpreplay v4.5.1 allows a local attacker to cause a denial of service via a crafted file to the tcpedit_dlt_getplugin function at src/tcpedit/plugin… |
CVE-2026-25791 | High | 7.5 | 2026-02-09 | Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap mes… |
CVE-2026-25762 | High | 7.5 | 2026-02-06 | AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file… |
CVE-2026-25579 | Medium | 6.5 | 2026-02-04 | Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supp… |
CVE-2025-71031 | High | 7.5 | 2026-02-04 | Water-Melon Melon commit 9df9292 and below is vulnerable to Denial of Service. The HTTP component doesn't have any maximum length. As a result, an excessive re… |
CVE-2026-25140 | High | 7.5 | 2026-02-04 | apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromis… |
CVE-2026-25122 | Medium | 5.5 | 2026-02-04 | apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip… |
CVE-2026-22228 | Medium | 4.9 | 2026-02-03 | An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file con… |
CVE-2025-59439 | High | 7.5 | 2026-02-03 | An issue was discovered in Samsung Mobile Processor, Wearable Processor and Modem Exynos 980, 990, 850, 1080, 9110, W920, W930, W1000 and Modem 5123. Incorrect… |
CVE-2026-0599 | High | 7.5 | 2026-02-02 | A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching dur… |
CVE-2025-7105 | Medium | 5.7 | 2026-02-02 | A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in `/api/convos/fork` to fork numerous contents rapidly. If… |
CVE-2025-6208 | Medium | 5.3 | 2026-02-02 | The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The… |
CVE-2025-71000 | High | 7.5 | 2026-01-28 | An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-70999 | High | 7.5 | 2026-01-28 | A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a… |
CVE-2025-65891 | High | 7.5 | 2026-01-28 | A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice (DoS) by invoking flow.cuda.get_device_properties() with an i… |
CVE-2025-65890 | High | 7.5 | 2026-01-28 | A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-… |
CVE-2025-65889 | High | 7.5 | 2026-01-28 | A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-65888 | High | 7.5 | 2026-01-28 | A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively la… |
CVE-2025-65886 | High | 7.5 | 2026-01-28 | A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes. |
CVE-2026-24738 | Medium | 6.5 | 2026-01-27 | gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts TLVs with lengths that can range up to 4… |
CVE-2026-22259 | High | 7.5 | 2026-01-27 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of mem… |
CVE-2026-22258 | High | 7.5 | 2026-01-27 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, lea… |
CVE-2025-55102 | High | 7.5 | 2026-01-27 | A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet To… |
CVE-2026-21720 | High | 7.5 | 2026-01-27 | Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three se… |
CVE-2025-59472 | Medium | 5.9 | 2026-01-26 | A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint acce… |
CVE-2025-59471 | Medium | 5.9 | 2026-01-26 | A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimizat… |
CVE-2026-23864 | High | 7.5 | 2026-01-26 | Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbop… |
CVE-2026-24001 | High | 7.5 | 2026-01-22 | jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers c… |
CVE-2025-66960 | High | 7.5 | 2026-01-21 | An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length fro… |
CVE-2025-66959 | High | 7.5 | 2026-01-21 | An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder |
CVE-2026-20080 | Medium | 5.3 | 2026-01-21 | A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticated, remote attacker to cause the SSH se… |
CVE-2026-21956 | High | 8.2 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easi… |
CVE-2026-21955 | High | 8.2 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easi… |
CVE-2026-21952 | Medium | 4.9 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitabl… |
CVE-2026-21950 | Medium | 6.5 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploit… |
CVE-2026-21949 | Medium | 6.5 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploit… |
CVE-2026-21948 | Medium | 4.9 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 a… |
CVE-2026-21945 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2026-21942 | Medium | 5.0 | 2026-01-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). Supported versions that are affected are 10 and 11. Easily exploitabl… |
CVE-2026-21941 | Medium | 4.9 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 a… |
CVE-2026-21637 | High | 7.5 | 2026-01-20 | A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Syn… |
CVE-2025-59465 | High | 7.5 | 2026-01-20 | A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. I… |
CVE-2025-59464 | High | 7.5 | 2026-01-20 | A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applicatio… |
CVE-2025-9466 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP and CIP grammar te… |
CVE-2025-9465 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive grammar tests, t… |
CVE-2025-9464 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. This vulnerability is triggered during fuzzing of multiple CIP… |
CVE-2025-9283 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limits Storms… |
CVE-2025-9282 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive limited storm te… |
CVE-2025-9281 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive step limit storm… |
CVE-2025-9280 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. Fuzzing performed using Defensics causes the device to become u… |
CVE-2025-9279 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limit Storm t… |
CVE-2025-9278 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. After running a Burp Suite active scan, the device loses ICMP c… |
CVE-2026-21696 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Win… |
CVE-2026-1174 | Medium | 5.3 | 2026-01-19 | A vulnerability was determined in birkir prime up to 0.4.0.beta.0. This affects an unknown function of the file /graphql of the component GraphQL Alias Handler… |
CVE-2025-69199 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack prop… |
CVE-2026-23842 | High | 7.5 | 2026-01-19 | ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service c… |
CVE-2025-69198 | Medium | 6.5 | 2026-01-19 | Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. dat… |
CVE-2025-15532 | Medium | 5.3 | 2026-01-17 | A security flaw has been discovered in Open5GS up to 2.7.5. This issue affects some unknown processing of the component Timer Handler. The manipulation results… |
CVE-2026-0517 | High | 7.5 | 2026-01-17 | CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially crafted packet to a s… |
CVE-2024-48077 | High | 7.5 | 2026-01-15 | NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate… |
CVE-2026-0992 | Low | 2.9 | 2026-01-15 | A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCa… |
CVE-2025-67835 | Medium | 6.5 | 2026-01-14 | Paessler PRTG Network Monitor before 25.4.114 allows Denial-of-Service (DoS) by an authenticated attacker via the Notification Contacts functionality. |
CVE-2026-22239 | Medium | 5.3 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sendi… |
CVE-2026-0889 | High | 7.5 | 2026-01-13 | Denial-of-service in the DOM: Service Workers component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
CVE-2025-40944 | High | 7.5 | 2026-01-13 | A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (… |
CVE-2026-22691 | Medium | 5.3 | 2026-01-10 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses… |
CVE-2026-22690 | Medium | 5.3 | 2026-01-10 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size val… |
CVE-2025-67133 | High | 7.5 | 2026-01-09 | An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component |
CVE-2025-65518 | High | 7.5 | 2026-01-08 | Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint… |
CVE-2025-56424 | High | 7.5 | 2026-01-08 | An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause a denial of service via a crafted script |
CVE-2026-21500 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-22542 | | 2026-01-07 | An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet se… | |
CVE-2026-22541 | | 2026-01-07 | The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board… | |
CVE-2026-22540 | | 2026-01-07 | The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be op… | |
CVE-2026-21485 | High | 8.8 | 2026-01-06 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (U… |
CVE-2025-43706 | High | 7.5 | 2026-01-05 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2400, 1580, 9110, W920, W930, Modem 5123… |
CVE-2026-21452 | High | 7.5 | 2026-01-02 | MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack… |
CVE-2025-68272 | High | 7.5 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an una… |
CVE-2025-66863 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66861 | Low | 2.5 | 2025-12-29 | An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE fi… |
CVE-2025-60458 | Medium | 6.5 | 2025-12-29 | UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN request can trigger multiple calls to free() o… |
CVE-2025-25341 | High | 7.5 | 2025-12-26 | A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document. Accessing the internal _ref property on entity_ref and entity_decl… |
CVE-2025-59529 | Medium | 5.5 | 2025-12-18 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simpl… |
CVE-2025-8872 | Medium | 6.5 | 2025-12-16 | On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may… |
CVE-2023-53873 | | 2025-12-15 | SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service. Attackers can s… | |
CVE-2025-65781 | High | 8.2 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer… |
CVE-2025-67731 | High | 7.5 | 2025-12-12 | Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Express server used express.json() without… |
CVE-2025-67726 | High | 7.5 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP h… |
CVE-2025-67725 | High | 7.5 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the ser… |
CVE-2025-67779 | High | 7.5 | 2025-12-12 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific cas… |
CVE-2024-58306 | | 2025-12-11 | minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending oversized GET requests. Attackers can… | |
CVE-2025-48569 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additiona… |
CVE-2025-48631 | Medium | 6.5 | 2025-12-08 | In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of… |
CVE-2025-48615 | High | 7.8 | 2025-12-08 | In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalatio… |
CVE-2025-48603 | Medium | 5.5 | 2025-12-08 | In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of serv… |
CVE-2025-48590 | Medium | 5.5 | 2025-12-08 | In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances d… |
CVE-2025-48584 | Medium | 5.5 | 2025-12-08 | In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This co… |
CVE-2025-48576 | Medium | 5.5 | 2025-12-08 | In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exh… |
CVE-2025-65637 | High | 7.5 | 2025-12-04 | A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline… |