CWE-400 · Uncontrolled Resource Consumption (page 9)
Page 9 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-66453 | High | 7.5 | 2025-12-03 | Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker c… |
CVE-2025-66303 | Medium | 4.9 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of sched… |
CVE-2025-13837 | Medium | 5.5 | 2025-12-01 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues |
CVE-2025-13836 | High | 7.5 | 2025-12-01 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server… |
CVE-2025-58436 | Medium | 5.1 | 2025-11-29 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd b… |
CVE-2020-36872 | | 2025-11-26 | BACnet Test Server versions up to and including 1.01 contains a remote denial of service vulnerability in its BACnet/IP BVLC packet handling. The server fails… | |
CVE-2025-66019 | | 2025-11-26 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memor… | |
CVE-2025-51741 | High | 7.5 | 2025-11-25 | An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to send email verific… |
CVE-2025-13466 | | 2025-11-24 | body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can s… | |
CVE-2025-60638 | High | 7.5 | 2025-11-24 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability… |
CVE-2025-65947 | | 2025-11-21 | thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resource leaks when querying thread counts on… | |
CVE-2025-55128 | Medium | 6.5 | 2025-11-20 | HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php”. An attacker with… |
CVE-2025-37161 | High | 7.5 | 2025-11-18 | A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Succes… |
CVE-2025-55796 | High | 7.5 | 2025-11-18 | The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password… |
CVE-2025-6599 | Medium | 5.3 | 2025-11-18 | An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker t… |
CVE-2025-11681 | Medium | 6.5 | 2025-11-17 | Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause… |
CVE-2021-4467 | | 2025-11-14 | Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002. The servic… | |
CVE-2021-4465 | | 2025-11-14 | ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 contain a remote denial-of-servic… | |
CVE-2023-7326 | | 2025-11-12 | The Epson Stylus SX510W embedded web management service fails to properly handle consecutive ampersand characters in query parameters when accessing /PRESENTAT… | |
CVE-2025-63811 | High | 7.5 | 2025-11-12 | An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE)… |
CVE-2025-27249 | Medium | 5.5 | 2025-11-11 | Uncontrolled resource consumption for some Gaudi software before version 1.21.0 within Ring 3: User Applications may allow a denial of service. System software… |
CVE-2025-63288 | High | 7.5 | 2025-11-10 | In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service. |
CVE-2025-63560 | High | 7.5 | 2025-11-06 | An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware v.1.20.0006 allows a remote attacker to cause a denial of service via the system… |
CVE-2025-60753 | Medium | 5.5 | 2025-11-05 | An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution ru… |
CVE-2025-49494 | High | 7.5 | 2025-11-04 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 9110, Modem 5123. Mishandling of… |
CVE-2025-43462 | High | 7.5 | 2025-11-04 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26… |
CVE-2025-63561 | High | 7.5 | 2025-10-31 | Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connect… |
CVE-2025-6075 | Medium | 5.5 | 2025-10-31 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. |
CVE-2025-64388 | | 2025-10-31 | Denial of service of the web server through specific requests to this protocol | |
CVE-2025-30188 | High | 7.5 | 2025-10-31 | Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the w… |
CVE-2025-8849 | High | 7.5 | 2025-10-31 | LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `val… |
CVE-2025-6176 | High | 7.5 | 2025-10-31 | Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechan… |
CVE-2025-5342 | Medium | 4.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module. |
CVE-2025-10932 | High | 8.2 | 2025-10-29 | Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, fro… |
CVE-2025-54605 | High | 7.5 | 2025-10-28 | Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2). |
CVE-2025-54604 | High | 7.5 | 2025-10-28 | Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2). |
CVE-2025-61155 | Medium | 5.5 | 2025-10-28 | The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL handlers. A user-mode… |
CVE-2025-60349 | High | 7.5 | 2025-10-28 | An issue was discovered in Prevx v3.0.5.220 allowing attackers to cause a denial of service via sending IOCTL code 0x22E044 to the pxscan.sys driver. Any proce… |
CVE-2025-62260 | High | 7.5 | 2025-10-27 | Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported v… |
CVE-2025-12194 | | 2025-10-24 | Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bou… | |
CVE-2025-60419 | Medium | 6.2 | 2025-10-24 | An issue was discovered in the NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348) allowing local authenticated attackers to send a crafted IOCTL r… |
CVE-2025-62706 | Medium | 6.5 | 2025-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decomp… |
CVE-2025-62478 | Medium | 4.9 | 2025-10-21 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). The supported version that is affected is 8.8. Eas… |
CVE-2025-62477 | Medium | 4.9 | 2025-10-21 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). The supported version that is affected is 8… |
CVE-2025-62476 | Medium | 4.9 | 2025-10-21 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). The supported version that is affected is 8… |
CVE-2025-62475 | Medium | 4.9 | 2025-10-21 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily expl… |
CVE-2025-53068 | Medium | 6.5 | 2025-10-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabi… |
CVE-2025-53067 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.4.0. Easily exploit… |
CVE-2025-53062 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9… |
CVE-2025-53054 | Medium | 5.5 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9… |
CVE-2025-53053 | Medium | 5.5 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9… |
CVE-2025-53050 | High | 7.5 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are… |
CVE-2025-53046 | Medium | 4.9 | 2025-10-21 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Analytics). The supported version that is affected is 8.8. Easily… |
CVE-2025-53045 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9… |
CVE-2025-53044 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9… |
CVE-2025-53042 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 a… |
CVE-2025-53040 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 a… |
CVE-2025-60790 | Medium | 6.5 | 2025-10-21 | ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to… |
CVE-2025-61303 | Critical | 9.8 | 2025-10-20 | Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a vulnerability in its Windows behavioral analysis eng… |
CVE-2025-61301 | High | 7.5 | 2025-10-20 | Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows attackers who can submit samples to cause… |
CVE-2025-26782 | High | 7.5 | 2025-10-20 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 9110… |
CVE-2024-55568 | High | 7.5 | 2025-10-20 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110… |
CVE-2025-59043 | High | 7.5 | 2025-10-17 | OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more… |
CVE-2025-33177 | Medium | 5.5 | 2025-10-14 | NVIDIA Jetson Linux and IGX OS contain a vulnerability in NvMap, where improper tracking of memory allocations could allow a local attacker to cause memory ove… |
CVE-2025-60536 | High | 7.5 | 2025-10-14 | An issue in the Configure New Cluster interface of kafka-ui v0.6.0 to v0.7.2 allows attackers to cause a Denial of Service (DoS) via uploading a crafted config… |
CVE-2025-59502 | High | 7.5 | 2025-10-14 | Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network. |
CVE-2025-37148 | Medium | 6.5 | 2025-10-14 | A vulnerability in the parsing of ethernet frames in AOS-8 Instant and AOS 10 could allow an unauthenticated remote attacker to conduct a denial of service att… |
CVE-2025-37139 | Medium | 6.0 | 2025-10-14 | A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may… |
CVE-2025-11635 | Medium | 4.3 | 2025-10-12 | A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036. This vulnerability affects unknown code of the component File Upload. This manipulatio… |
CVE-2025-61920 | High | 7.5 | 2025-10-10 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT head… |
CVE-2025-61919 | High | 7.5 | 2025-10-10 | Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `C… |
CVE-2025-59975 | High | 7.5 | 2025-10-09 | An Uncontrolled Resource Consumption vulnerability in the HTTP daemon (httpd) of Juniper Networks Junos Space allows an unauthenticated network-based attacker… |
CVE-2025-52961 | Medium | 6.5 | 2025-10-09 | An Uncontrolled Resource Consumption vulnerability in the Connectivity Fault Management (CFM) daemon and the Connectivity Fault Management Manager (cfmman) of… |
CVE-2025-61772 | High | 7.5 | 2025-10-07 | Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a mul… |
CVE-2025-61771 | High | 7.5 | 2025-10-07 | Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (parts with… |
CVE-2025-61770 | High | 7.5 | 2025-10-07 | Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (b… |
CVE-2025-11274 | Low | 3.3 | 2025-10-05 | A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib… |
CVE-2025-52867 | Medium | 6.5 | 2025-10-03 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-55972 | High | 7.5 | 2025-10-03 | A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) condition. By sendi… |
CVE-2025-61600 | High | 7.5 | 2025-10-02 | Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which a… |
CVE-2025-61595 | | 2025-10-02 | MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx ga… | |
CVE-2025-20370 | Medium | 4.9 | 2025-10-01 | In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a us… |
CVE-2025-56572 | High | 7.5 | 2025-09-30 | An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter. |
CVE-2025-11149 | High | 7.5 | 2025-09-30 | This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an exception when user… |
CVE-2025-56234 | High | 7.5 | 2025-09-29 | AT_NA2000 from Nanda Automation Technology vendor has a denial-of-service vulnerability. For the processing of TCP RST packets, PLC AT_NA2000 has a wide accept… |
CVE-2025-56233 | High | 7.5 | 2025-09-29 | Openindiana, kernel SunOS 5.11 has a denial of service vulnerability. For the processing of TCP packets with RST or SYN flag set, Openindiana has a wide accept… |
CVE-2024-57412 | High | 7.5 | 2025-09-29 | An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP packets. |
CVE-2025-57446 | High | 7.5 | 2025-09-25 | An issue in O-RAN Near Realtime RIC ric-plt-submgr in the J-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted reque… |
CVE-2025-55560 | High | 7.5 | 2025-09-25 | An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is c… |
CVE-2025-55559 | High | 7.5 | 2025-09-25 | An issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D. |
CVE-2025-55558 | High | 7.5 | 2025-09-25 | A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() a… |
CVE-2025-59830 | High | 7.5 | 2025-09-25 | Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while sti… |
CVE-2025-55551 | High | 7.5 | 2025-09-25 | An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation. |
CVE-2025-57317 | High | 7.5 | 2025-09-25 | apidoc-core is the core parser library to generate apidoc result following the apidoc-spec. A Prototype Pollution vulnerability in the preProcess function of a… |
CVE-2025-48392 | High | 7.5 | 2025-09-24 | A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade t… |
CVE-2025-6921 | High | 7.5 | 2025-09-23 | The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer… |
CVE-2025-57440 | High | 7.5 | 2025-09-22 | The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling stre… |
CVE-2025-4444 | Low | 3.7 | 2025-09-18 | A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performi… |
CVE-2025-58767 | Medium | 5.3 | 2025-09-17 | REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need… |
CVE-2025-35432 | Medium | 5.3 | 2025-09-17 | CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user… |