CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5412 vulnerabilities reference this CWE, most recent first.
GHSA-CQF7-FF9H-7967
Vulnerability from github – Published: 2022-05-17 00:48 – Updated: 2024-09-18 16:17validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.8a1"
},
{
"fixed": "1.8.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-5145"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-03T19:54:38Z",
"nvd_published_at": "2015-07-14T17:59:00Z",
"severity": "HIGH"
},
"details": "`validators.URLValidator` in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.",
"id": "GHSA-cqf7-ff9h-7967",
"modified": "2024-09-18T16:17:40Z",
"published": "2022-05-17T00:48:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5145"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.8.3.txt#L63-L68"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-21.yaml"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201510-06"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20150924150801/http://www.securitytracker.com/id/1032820"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170526042302/http://www.securityfocus.com/bid/75691"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2015/jul/08/security-releases"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Django ReDoS in validators.URLValidator"
}
GHSA-CQGJ-H8VF-4W59
Vulnerability from github – Published: 2026-06-10 16:46 – Updated: 2026-06-10 16:46Impact
Bad clients that always send a fixed batch value while the server is using the acknowledgement extension can cause the unacknowledged message queue to grow indefinitely, eventually resulting in an OutOfMemoryError.
Such bad clients would always send:
{
"channel": "/meta/connect",
...
"ext": { "ack": 1 }
}
The server would never clear the unacknowledged message queue, and one bad client can cause a server outage.
Patches
5.0.x - https://github.com/cometd/cometd/pull/2168 6.0.x - https://github.com/cometd/cometd/pull/2169 8.0.x - https://github.com/cometd/cometd/pull/2118
Workarounds
Disable the acknowledgement extension.
Resources
https://github.com/cometd/cometd/discussions/2116 https://github.com/cometd/cometd/issues/2117
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.0.22"
},
"package": {
"ecosystem": "Maven",
"name": "org.cometd.java:cometd-java-server-common"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.23"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.0.18"
},
"package": {
"ecosystem": "Maven",
"name": "org.cometd.java:cometd-java-server-common"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.19"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.0.18"
},
"package": {
"ecosystem": "Maven",
"name": "org.cometd.java:cometd-java-server-common"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.19"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.0.8"
},
"package": {
"ecosystem": "Maven",
"name": "org.cometd.java:cometd-java-server-common"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-53114"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-10T16:46:28Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nBad clients that always send a fixed batch value while the server is using the acknowledgement extension can cause the unacknowledged message queue to grow indefinitely, eventually resulting in an OutOfMemoryError.\n\nSuch bad clients would always send:\n\n```json\n{\n \"channel\": \"/meta/connect\",\n ...\n \"ext\": { \"ack\": 1 }\n}\n```\n\nThe server would never clear the unacknowledged message queue, and one bad client can cause a server outage.\n\n### Patches\n5.0.x - https://github.com/cometd/cometd/pull/2168\n6.0.x - https://github.com/cometd/cometd/pull/2169\n8.0.x - https://github.com/cometd/cometd/pull/2118\n\n### Workarounds\nDisable the acknowledgement extension.\n\n### Resources\nhttps://github.com/cometd/cometd/discussions/2116\nhttps://github.com/cometd/cometd/issues/2117",
"id": "GHSA-cqgj-h8vf-4w59",
"modified": "2026-06-10T16:46:28Z",
"published": "2026-06-10T16:46:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cometd/cometd/security/advisories/GHSA-cqgj-h8vf-4w59"
},
{
"type": "WEB",
"url": "https://github.com/cometd/cometd/issues/2117"
},
{
"type": "WEB",
"url": "https://github.com/cometd/cometd/pull/2118"
},
{
"type": "WEB",
"url": "https://github.com/cometd/cometd/pull/2168"
},
{
"type": "WEB",
"url": "https://github.com/cometd/cometd/pull/2169"
},
{
"type": "PACKAGE",
"url": "https://github.com/cometd/cometd"
},
{
"type": "WEB",
"url": "https://github.com/cometd/cometd/discussions/2116"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Acknowledgement extension out of memory"
}
GHSA-CQH8-R8G2-2V3R
Vulnerability from github – Published: 2024-03-05 03:30 – Updated: 2024-08-01 15:31libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.
{
"affected": [],
"aliases": [
"CVE-2024-25269"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-05T01:15:06Z",
"severity": "HIGH"
},
"details": "libheif \u003c= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.",
"id": "GHSA-cqh8-r8g2-2v3r",
"modified": "2024-08-01T15:31:30Z",
"published": "2024-03-05T03:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25269"
},
{
"type": "WEB",
"url": "https://github.com/strukturag/libheif/issues/1073"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CQHQ-5MCX-C3M9
Vulnerability from github – Published: 2025-02-06 21:32 – Updated: 2025-02-07 18:31An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topologylnstance module, Routing module.
{
"affected": [],
"aliases": [
"CVE-2024-57672"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-06T20:15:40Z",
"severity": "MODERATE"
},
"details": "An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topologylnstance module, Routing module.",
"id": "GHSA-cqhq-5mcx-c3m9",
"modified": "2025-02-07T18:31:20Z",
"published": "2025-02-06T21:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57672"
},
{
"type": "WEB",
"url": "https://github.com/floodlight/floodlight/issues/871"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CQJG-WHMM-8GV6
Vulnerability from github – Published: 2018-10-09 00:57 – Updated: 2023-09-07 20:33Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved.
Recommendation
Update to version 16.1.1 or later.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 16.1.0"
},
"package": {
"ecosystem": "npm",
"name": "hapi"
},
"ranges": [
{
"events": [
{
"introduced": "15.0.0"
},
{
"fixed": "16.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-16013"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:32:25Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Affected versions of `hapi` will crash or lock the event loop when a malformed `accept-encoding` header is recieved.\n\n\n## Recommendation\n\nUpdate to version 16.1.1 or later.",
"id": "GHSA-cqjg-whmm-8gv6",
"modified": "2023-09-07T20:33:05Z",
"published": "2018-10-09T00:57:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16013"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/hapi/issues/3466"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-cqjg-whmm-8gv6"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/335"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Denial of Service via malformed accept-encoding header in hapi"
}
GHSA-CQR7-78PJ-3G7J
Vulnerability from github – Published: 2017-10-24 18:33 – Updated: 2021-09-09 20:31Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak.
When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.
Recommendation
- Please upgrade to version 2.2.x or above as soon as possible.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "hapi"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3742"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:32:30Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak. \n\nWhen triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.\n\n\n\n## Recommendation\n\n- Please upgrade to version 2.2.x or above as soon as possible.",
"id": "GHSA-cqr7-78pj-3g7j",
"modified": "2021-09-09T20:31:02Z",
"published": "2017-10-24T18:33:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3742"
},
{
"type": "WEB",
"url": "https://github.com/spumko/hapi/issues/1427"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-cqr7-78pj-3g7j"
},
{
"type": "PACKAGE",
"url": "https://github.com/spumko/hapi"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/11"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/05/15/2"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "File Descriptor Leak Can Cause DoS Vulnerability in hapi"
}
GHSA-CQVH-4WV3-G3CJ
Vulnerability from github – Published: 2023-12-01 09:30 – Updated: 2023-12-01 09:30An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input.
{
"affected": [],
"aliases": [
"CVE-2023-4912"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-01T07:15:11Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input.",
"id": "GHSA-cqvh-4wv3-g3cj",
"modified": "2023-12-01T09:30:44Z",
"published": "2023-12-01T09:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4912"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2137421"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/424882"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-CQW2-WF8P-J3J7
Vulnerability from github – Published: 2022-05-13 01:40 – Updated: 2022-05-13 01:40A denial of service vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36592202.
{
"affected": [],
"aliases": [
"CVE-2017-0690"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-06T20:29:00Z",
"severity": "MODERATE"
},
"details": "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36592202.",
"id": "GHSA-cqw2-wf8p-j3j7",
"modified": "2022-05-13T01:40:28Z",
"published": "2022-05-13T01:40:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0690"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2017-07-01"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99478"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CR39-25J5-RXG9
Vulnerability from github – Published: 2025-08-12 18:31 – Updated: 2025-08-12 18:31Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
{
"affected": [],
"aliases": [
"CVE-2025-27250"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-12T17:15:36Z",
"severity": "MODERATE"
},
"details": "Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.",
"id": "GHSA-cr39-25j5-rxg9",
"modified": "2025-08-12T18:31:29Z",
"published": "2025-08-12T18:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27250"
},
{
"type": "WEB",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01317.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CR3F-PPW7-PMQF
Vulnerability from github – Published: 2022-05-24 16:46 – Updated: 2026-05-29 15:30An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle time impact when flooding the M221 ethernet interface while the Ethernet/IP adapter is activated.
{
"affected": [],
"aliases": [
"CVE-2018-7821"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-22T20:29:00Z",
"severity": "HIGH"
},
"details": "An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle time impact when flooding the M221 ethernet interface while the Ethernet/IP adapter is activated.",
"id": "GHSA-cr3f-ppw7-pmqf",
"modified": "2026-05-29T15:30:21Z",
"published": "2022-05-24T16:46:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7821"
},
{
"type": "WEB",
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.