CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5435 vulnerabilities reference this CWE, most recent first.
GHSA-983P-WV66-FFX7
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2022-05-24 17:33In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
{
"affected": [],
"aliases": [
"CVE-2020-28030"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-02T21:15:00Z",
"severity": "HIGH"
},
"details": "In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.",
"id": "GHSA-983p-wv66-ffx7",
"modified": "2022-05-24T17:33:00Z",
"published": "2022-05-24T17:33:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28030"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/commit/b287e7165e8aa89cde6ae37e7c257c5d87d16b9b"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/issues/16887"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UHZSVK7PO2LTGFQXFHFXY6SOMSQ7UPRS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2667E6WKVE56G66BVBVD7LJPIDOJ7K3"
},
{
"type": "WEB",
"url": "https://www.wireshark.org/security/wnpa-sec-2020-15.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-983V-FGVF-4JJC
Vulnerability from github – Published: 2022-04-13 00:00 – Updated: 2022-04-21 00:00A specially crafted packet sent to the Fernhill SCADA Server Version 3.77 and earlier may cause an exception, causing the server process (FHSvrService.exe) to exit.
{
"affected": [],
"aliases": [
"CVE-2022-21155"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-755"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-12T17:15:00Z",
"severity": "HIGH"
},
"details": "A specially crafted packet sent to the Fernhill SCADA Server Version 3.77 and earlier may cause an exception, causing the server process (FHSvrService.exe) to exit.",
"id": "GHSA-983v-fgvf-4jjc",
"modified": "2022-04-21T00:00:54Z",
"published": "2022-04-13T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21155"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-006-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9849-P7JC-9RMV
Vulnerability from github – Published: 2023-06-22 19:58 – Updated: 2023-06-22 19:58Summary
The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.
Severity
The maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
Mitigation
Upgrade to >= 1.9.22.noko2.
Credit
This vulnerability was reported by 이형관 (windshock).
References
CWE-400 Uncontrolled Resource Consumption
Notes
The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.nokogiri:nekohtml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.22.noko2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24839"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-22T19:58:54Z",
"nvd_published_at": "2022-04-11T22:15:07Z",
"severity": "HIGH"
},
"details": "## Summary\n\nThe fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.\n\n## Severity\n\nThe maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\n## Mitigation\n\nUpgrade to `\u003e= 1.9.22.noko2`.\n\n## Credit\n\nThis vulnerability was reported by [\uc774\ud615\uad00 (windshock)](https://www.linkedin.com/in/windshock/).\n\n## References\n\n[CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption\n\n## Notes\n\nThe upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.\n",
"id": "GHSA-9849-p7jc-9rmv",
"modified": "2023-06-22T19:58:54Z",
"published": "2023-06-22T19:58:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24839"
},
{
"type": "WEB",
"url": "https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d"
},
{
"type": "PACKAGE",
"url": "https://github.com/sparklemotion/nekohtml"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption"
}
GHSA-98CP-84M9-Q3QP
Vulnerability from github – Published: 2026-04-22 19:49 – Updated: 2026-04-22 19:49Summary
A memory leak vulnerability in the free5GC PCF (Policy Control Function) allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory growth by sending repeated HTTP requests to the OAM endpoint. The root cause is a router.Use() call inside an HTTP handler that registers a new CORS middleware on every incoming request, permanently growing the Gin router's handler chain. This leads to progressive memory exhaustion and eventual Denial of Service of the PCF, preventing all UEs from obtaining AM and SM policies and blocking 5G session establishment.
Details
File: free5gc/pcf/internal/sbi/api_oam.go
Function: setCorsHeader(), called by HTTPOAMGetAmPolicy()
The function setCorsHeader() invokes s.router.Use() on every incoming HTTP request:
func (s *Server) setCorsHeader(c *gin.Context) {
// BUG: router.Use() inside a handler — executes on every request
s.router.Use(cors.New(cors.Config{
AllowMethods: []string{"GET", "POST", "OPTIONS", "PUT", "PATCH", "DELETE"},
AllowAllOrigins: true,
AllowCredentials: true,
MaxAge: CorsConfigMaxAge,
}))
// Redundant manual header setting
c.Writer.Header().Set("Access-Control-Allow-Origin", "*")
c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
// ...
}
func (s *Server) HTTPOAMGetAmPolicy(c *gin.Context) {
s.setCorsHeader(c) // ← called on every GET /npcf-oam/v1/am-policy/:supi
// ...
}
In the Gin framework, router.Use() appends a new HandlerFunc to the router's internal middleware slice. This operation is not idempotent — it does not replace existing middleware but appends a new instance on every call. After N requests, Gin executes N CORS middleware instances before reaching the actual handler:
Request N → [cors_mw_1 → cors_mw_2 → ... → cors_mw_N → actual_handler]
Since s.router holds a permanent reference to the accumulated middleware slice, the Go garbage collector cannot free this memory. The additional issue of AllowAllOrigins: true combined with AllowCredentials: true also constitutes a CORS misconfiguration (forbidden by the CORS specification), though this is secondary to the memory leak.
Fix: Move router.Use(cors.New(...)) to the server initialization function (called once at startup), and remove setCorsHeader() from all handlers entirely:
// ✅ server.go — called once at startup
func (s *Server) initRouter() {
s.router.Use(cors.New(cors.Config{
AllowMethods: []string{"GET", "POST", "OPTIONS", "PUT", "PATCH", "DELETE"},
AllowOrigins: []string{"https://trusted-origin.example.com"},
AllowCredentials: false,
MaxAge: CorsConfigMaxAge,
}))
}
PoC
Environment:
- free5GC v4.2.1 (commit df535f55, build 2026-03-04)
- PCF container IP: 10.22.22.6, port 80
- Attacker: any container on the same Docker network (tested from UDM container)
- No authentication required (OAuth2 disabled)
Step 1 — Record memory baseline:
docker stats --no-stream | grep pcf
# Output: 24.86 MiB
Step 2 — Launch flood from attacker container:
for i in $(seq 1 5000); do
curl -s http://10.22.22.6/npcf-oam/v1/am-policy/imsi-222771234567890 > /dev/null &
[ $((i % 100)) -eq 0 ] && wait && echo "[*] $i req sent"
done
wait
Step 3 — Monitor memory growth:
watch -n 2 "docker stats --no-stream | grep pcf"
Results:
| Requests sent | PCF Memory | Delta |
|---|---|---|
| 0 (baseline) | 24.86 MiB | — |
| ~5,000 | 46.48 MiB | +21.62 MiB |
| ~10,000 | 58.59 MiB | +12.11 MiB |
| ~15,000 | 70.30 MiB | +11.71 MiB |
| ~100,000 (projected) | ~170+ MiB | OOM kill |
Memory never returns to baseline between request batches, confirming permanent retention by the router's middleware chain.
Impact
Vulnerability type: Uncontrolled Resource Consumption (Memory Exhaustion) leading to Denial of Service.
Who is impacted: Any deployment of free5GC where the PCF OAM interface is reachable from the internal 5G core network. Since all 5G core NFs share the same Docker network by default, any compromised or attacker-controlled NF container can trigger this vulnerability without credentials.
5G service impact: The PCF is responsible for providing AM (Access and Mobility) policies to the AMF and SM (Session Management) policies to the SMF. A DoS of the PCF prevents: - New UE registrations (AM policy creation fails) - New PDU session establishment (SM policy creation fails) - Policy updates for existing sessions
In a production deployment this would result in complete loss of 5G service for all subscribers served by the affected PCF instance.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/free5gc/pcf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41135"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-22T19:49:45Z",
"nvd_published_at": "2026-04-22T00:16:29Z",
"severity": "HIGH"
},
"details": "## Summary\n\nA memory leak vulnerability in the free5GC PCF (Policy Control Function) allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory growth by sending repeated HTTP requests to the OAM endpoint. The root cause is a `router.Use()` call inside an HTTP handler that registers a new CORS middleware on every incoming request, permanently growing the Gin router\u0027s handler chain. This leads to progressive memory exhaustion and eventual Denial of Service of the PCF, preventing all UEs from obtaining AM and SM policies and blocking 5G session establishment.\n\n## Details\n\n**File:** `free5gc/pcf/internal/sbi/api_oam.go` \n**Function:** `setCorsHeader()`, called by `HTTPOAMGetAmPolicy()`\n\nThe function `setCorsHeader()` invokes `s.router.Use()` on every incoming HTTP request:\n\n```go\nfunc (s *Server) setCorsHeader(c *gin.Context) {\n // BUG: router.Use() inside a handler \u2014 executes on every request\n s.router.Use(cors.New(cors.Config{\n AllowMethods: []string{\"GET\", \"POST\", \"OPTIONS\", \"PUT\", \"PATCH\", \"DELETE\"},\n AllowAllOrigins: true,\n AllowCredentials: true,\n MaxAge: CorsConfigMaxAge,\n }))\n // Redundant manual header setting\n c.Writer.Header().Set(\"Access-Control-Allow-Origin\", \"*\")\n c.Writer.Header().Set(\"Access-Control-Allow-Credentials\", \"true\")\n // ...\n}\n\nfunc (s *Server) HTTPOAMGetAmPolicy(c *gin.Context) {\n s.setCorsHeader(c) // \u2190 called on every GET /npcf-oam/v1/am-policy/:supi\n // ...\n}\n```\nIn the Gin framework, `router.Use()` appends a new `HandlerFunc` to the router\u0027s internal middleware slice. This operation is **not idempotent** \u2014 it does not replace existing middleware but appends a new instance on every call. After N requests, Gin executes N CORS middleware instances before reaching the actual handler:\n\nRequest N \u2192 [cors_mw_1 \u2192 cors_mw_2 \u2192 ... \u2192 cors_mw_N \u2192 actual_handler]\n\nSince `s.router` holds a permanent reference to the accumulated middleware slice, the Go garbage collector cannot free this memory. The additional issue of `AllowAllOrigins: true` combined with `AllowCredentials: true` also constitutes a CORS misconfiguration (forbidden by the CORS specification), though this is secondary to the memory leak.\n\n**Fix:** Move `router.Use(cors.New(...))` to the server initialization function (called once at startup), and remove `setCorsHeader()` from all handlers entirely:\n\n```go\n// \u2705 server.go \u2014 called once at startup\nfunc (s *Server) initRouter() {\n s.router.Use(cors.New(cors.Config{\n AllowMethods: []string{\"GET\", \"POST\", \"OPTIONS\", \"PUT\", \"PATCH\", \"DELETE\"},\n AllowOrigins: []string{\"https://trusted-origin.example.com\"},\n AllowCredentials: false,\n MaxAge: CorsConfigMaxAge,\n }))\n}\n```\n## PoC\n\n**Environment:**\n- free5GC v4.2.1 (commit `df535f55`, build `2026-03-04`)\n- PCF container IP: `10.22.22.6`, port `80`\n- Attacker: any container on the same Docker network (tested from UDM container)\n- No authentication required (OAuth2 disabled)\n\n**Step 1** \u2014 Record memory baseline:\n```bash\ndocker stats --no-stream | grep pcf\n# Output: 24.86 MiB\n```\n\n**Step 2** \u2014 Launch flood from attacker container:\n```bash\nfor i in $(seq 1 5000); do\n curl -s http://10.22.22.6/npcf-oam/v1/am-policy/imsi-222771234567890 \u003e /dev/null \u0026\n [ $((i % 100)) -eq 0 ] \u0026\u0026 wait \u0026\u0026 echo \"[*] $i req sent\"\ndone\nwait\n```\n\n**Step 3** \u2014 Monitor memory growth:\n```bash\nwatch -n 2 \"docker stats --no-stream | grep pcf\"\n```\n\n**Results:**\n\n| Requests sent | PCF Memory | Delta |\n|---------------|------------|------------|\n| 0 (baseline) | 24.86 MiB | \u2014 |\n| ~5,000 | 46.48 MiB | +21.62 MiB |\n| ~10,000 | 58.59 MiB | +12.11 MiB |\n| ~15,000 | 70.30 MiB | +11.71 MiB |\n| ~100,000 (projected) | ~170+ MiB | OOM kill |\n\nMemory never returns to baseline between request batches, confirming permanent retention by the router\u0027s middleware chain.\n\n## Impact\n\n**Vulnerability type:** Uncontrolled Resource Consumption (Memory Exhaustion) leading to Denial of Service.\n\n**Who is impacted:** Any deployment of free5GC where the PCF OAM interface is reachable from the internal 5G core network. Since all 5G core NFs share the same Docker network by default, any compromised or attacker-controlled NF container can trigger this vulnerability without credentials.\n\n**5G service impact:** The PCF is responsible for providing AM (Access and Mobility) policies to the AMF and SM (Session Management) policies to the SMF. A DoS of the PCF prevents:\n- New UE registrations (AM policy creation fails)\n- New PDU session establishment (SM policy creation fails)\n- Policy updates for existing sessions\n\nIn a production deployment this would result in complete loss of 5G service for all subscribers served by the affected PCF instance.",
"id": "GHSA-98cp-84m9-q3qp",
"modified": "2026-04-22T19:49:45Z",
"published": "2026-04-22T19:49:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-98cp-84m9-q3qp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41135"
},
{
"type": "PACKAGE",
"url": "https://github.com/free5gc/free5gc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service"
}
GHSA-98HG-H5W7-368P
Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
{
"affected": [],
"aliases": [
"CVE-2018-8005"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-29T13:29:00Z",
"severity": "MODERATE"
},
"details": "When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.",
"id": "GHSA-98hg-h5w7-368p",
"modified": "2022-05-13T01:53:28Z",
"published": "2022-05-13T01:53:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8005"
},
{
"type": "WEB",
"url": "https://github.com/apache/trafficserver/pull/3106"
},
{
"type": "WEB",
"url": "https://github.com/apache/trafficserver/pull/3124"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/55d225af92887bfed0194400fd1b718622cca4140fc7318d982e25ca@%3Cusers.trafficserver.apache.org%3E"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4282"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105187"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-98J8-C9Q4-R38G
Vulnerability from github – Published: 2022-02-10 00:20 – Updated: 2024-11-13 22:13Impact
The implementation of StringNGrams can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow:
import tensorflow as tf
tf.raw_ops.StringNGrams(
data=['123456'],
data_splits=[0,1],
separator='a'*15,
ngram_widths=[],
left_pad='',
right_pad='',
pad_width=-5,
preserve_short_sequences=True)
We are missing a validation on pad_witdh and that result in computing a negative value for ngram_width which is later used to allocate parts of the output.
Patches
We have patched the issue in GitHub commit f68fdab93fb7f4ddb4eb438c8fe052753c9413e8.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.7.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.7.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.7.0"
]
}
],
"aliases": [
"CVE-2022-21733"
],
"database_specific": {
"cwe_ids": [
"CWE-190",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-02-03T19:23:04Z",
"nvd_published_at": "2022-02-03T12:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact \nThe [implementation of `StringNGrams`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/string_ngrams_op.cc#L29-L161) can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow:\n\n```python\nimport tensorflow as tf\n\ntf.raw_ops.StringNGrams(\n data=[\u0027123456\u0027],\n data_splits=[0,1],\n separator=\u0027a\u0027*15,\n ngram_widths=[],\n left_pad=\u0027\u0027,\n right_pad=\u0027\u0027,\n pad_width=-5, \n preserve_short_sequences=True)\n```\n\nWe are missing a validation on `pad_witdh` and that result in computing a negative value for `ngram_width` which is later used to allocate parts of the output.\n\n### Patches\nWe have patched the issue in GitHub commit [f68fdab93fb7f4ddb4eb438c8fe052753c9413e8](https://github.com/tensorflow/tensorflow/commit/f68fdab93fb7f4ddb4eb438c8fe052753c9413e8).\n\nThe fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.",
"id": "GHSA-98j8-c9q4-r38g",
"modified": "2024-11-13T22:13:06Z",
"published": "2022-02-10T00:20:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-98j8-c9q4-r38g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21733"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/commit/f68fdab93fb7f4ddb4eb438c8fe052753c9413e8"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-57.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-112.yaml"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/string_ngrams_op.cc#L29-L161"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Memory exhaustion in Tensorflow"
}
GHSA-98JH-839R-XP86
Vulnerability from github – Published: 2023-11-17 06:31 – Updated: 2024-06-20 18:34An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available memory.
{
"affected": [],
"aliases": [
"CVE-2023-41102"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-17T06:15:34Z",
"severity": "HIGH"
},
"details": "An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available memory.",
"id": "GHSA-98jh-839r-xp86",
"modified": "2024-06-20T18:34:07Z",
"published": "2023-11-17T06:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41102"
},
{
"type": "WEB",
"url": "https://github.com/openNDS/openNDS/commit/31dbf4aa069c5bb39a7926d86036ce3b04312b51"
},
{
"type": "WEB",
"url": "https://github.com/openwrt/routing/commit/ad787a920ccb9dacf5b01d52bce36ac14a5ecd89"
},
{
"type": "WEB",
"url": "https://github.com/openNDS/openNDS/releases/tag/v10.1.3"
},
{
"type": "WEB",
"url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-98M8-9QP9-Q867
Vulnerability from github – Published: 2025-05-13 00:31 – Updated: 2025-11-03 21:33A logic issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5. Processing a maliciously crafted image may lead to a denial-of-service.
{
"affected": [],
"aliases": [
"CVE-2025-31226"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-12T22:15:23Z",
"severity": "MODERATE"
},
"details": "A logic issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5. Processing a maliciously crafted image may lead to a denial-of-service.",
"id": "GHSA-98m8-9qp9-q867",
"modified": "2025-11-03T21:33:52Z",
"published": "2025-05-13T00:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31226"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122404"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122405"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122716"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122720"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122721"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122722"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/10"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/12"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/5"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/6"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-98VV-PW6R-Q6Q4
Vulnerability from github – Published: 2021-09-07 23:08 – Updated: 2024-10-09 21:02The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pillow"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "8.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23437"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-07T15:15:55Z",
"nvd_published_at": "2021-09-03T16:15:00Z",
"severity": "HIGH"
},
"details": "The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.",
"id": "GHSA-98vv-pw6r-q6q4",
"modified": "2024-10-09T21:02:05Z",
"published": "2021-09-07T23:08:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23437"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-98vv-pw6r-q6q4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-317.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/python-pillow/Pillow"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT"
},
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202211-10"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Uncontrolled Resource Consumption in pillow"
}
GHSA-98WX-FQ4R-JFM2
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-08-06 00:00An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauthenticated attacker to send crafted PUB messages that consume excessive memory if the CURVE/ZAP authentication is disabled on the server, causing a denial of service. The highest threat from this vulnerability is to system availability.
{
"affected": [],
"aliases": [
"CVE-2021-20237"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-28T11:15:00Z",
"severity": "HIGH"
},
"details": "An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ\u0027s src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauthenticated attacker to send crafted PUB messages that consume excessive memory if the CURVE/ZAP authentication is disabled on the server, causing a denial of service. The highest threat from this vulnerability is to system availability.",
"id": "GHSA-98wx-fq4r-jfm2",
"modified": "2022-08-06T00:00:47Z",
"published": "2022-05-24T19:03:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-4p5v-h92w-6wxw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20237"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921989"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.