CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5401 vulnerabilities reference this CWE, most recent first.
GHSA-JQX5-H2HW-5Q4F
Vulnerability from github – Published: 2022-05-04 00:28 – Updated: 2024-03-05 18:57The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.poi:poi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10-beta1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.poi:poi-scratchpad"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10-beta1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-0213"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-13T18:56:25Z",
"nvd_published_at": "2012-08-07T21:55:00Z",
"severity": "MODERATE"
},
"details": "The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.",
"id": "GHSA-jqx5-h2hw-5q4f",
"modified": "2024-03-05T18:57:35Z",
"published": "2022-05-04T00:28:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0213"
},
{
"type": "WEB",
"url": "https://github.com/apache/poi/commit/25bc679244188d63de690354db0e3f301291e252"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=799078"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/poi"
},
{
"type": "WEB",
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0044"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-August/084609.html"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21996759"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2012/dsa-2468"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Denial of Service in Apache POI"
}
GHSA-JR22-8QGM-4Q87
Vulnerability from github – Published: 2024-03-02 00:31 – Updated: 2026-05-08 18:24Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f2qx-66wf-wvvx. This link is maintained to preserve external references.
Original Description
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpseclib/phpseclib"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.36"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpseclib/phpseclib"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.47"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpseclib/phpseclib"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.23"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-04T20:42:19Z",
"nvd_published_at": "2024-03-01T23:15:08Z",
"severity": "HIGH"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-f2qx-66wf-wvvx. This link is maintained to preserve external references.\n\n### Original Description\nAn issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).",
"id": "GHSA-jr22-8qgm-4q87",
"modified": "2026-05-08T18:24:10Z",
"published": "2024-03-02T00:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27355"
},
{
"type": "WEB",
"url": "https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59"
},
{
"type": "WEB",
"url": "https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2024-27355.yaml"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-jr22-8qgm-4q87"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpseclib/phpseclib"
},
{
"type": "WEB",
"url": "https://github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: phpseclib does not properly limit the ASN1 OID length",
"withdrawn": "2026-05-08T18:24:10Z"
}
GHSA-JR6H-R7VG-F9MC
Vulnerability from github – Published: 2022-10-12 12:00 – Updated: 2025-06-09 18:35An issue in the fetch() method in the BasicProfile class of org.ini4j before v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.ini4j:ini4j"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.5.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-41404"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-18T17:07:30Z",
"nvd_published_at": "2022-10-11T23:15:00Z",
"severity": "HIGH"
},
"details": "An issue in the fetch() method in the BasicProfile class of org.ini4j before v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.",
"id": "GHSA-jr6h-r7vg-f9mc",
"modified": "2025-06-09T18:35:25Z",
"published": "2022-10-12T12:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41404"
},
{
"type": "WEB",
"url": "https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2022/CVE-2022-41404"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00037.html"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/ini4j/bugs/56"
},
{
"type": "WEB",
"url": "https://sourceforge.net/projects/ini4j"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "org.ini4j allows attackers to cause a Denial of Service (DoS) "
}
GHSA-JR77-8GX4-H5QH
Vulnerability from github – Published: 2022-11-11 12:00 – Updated: 2022-11-16 00:04Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. This issue has been patched in version 2.1.1.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/shamaton/msgpack/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-41719"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-16T00:04:13Z",
"nvd_published_at": "2022-11-10T20:15:00Z",
"severity": "HIGH"
},
"details": "Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. This issue has been patched in version 2.1.1.",
"id": "GHSA-jr77-8gx4-h5qh",
"modified": "2022-11-16T00:04:13Z",
"published": "2022-11-11T12:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41719"
},
{
"type": "WEB",
"url": "https://github.com/shamaton/msgpack/issues/31"
},
{
"type": "WEB",
"url": "https://github.com/shamaton/msgpack/pull/32"
},
{
"type": "PACKAGE",
"url": "https://github.com/shamaton/msgpack"
},
{
"type": "WEB",
"url": "https://github.com/shamaton/msgpack/releases/tag/v2.1.1"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0972"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "MessagePack for Golang subject to DoS via Unmarshal panic"
}
GHSA-JR79-GH2G-M9RV
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12.9 for Windows, tvOS 12. Unexpected interaction causes an ASSERT failure.
{
"affected": [],
"aliases": [
"CVE-2018-4474"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-27T20:15:00Z",
"severity": "HIGH"
},
"details": "A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12.9 for Windows, tvOS 12. Unexpected interaction causes an ASSERT failure.",
"id": "GHSA-jr79-gh2g-m9rv",
"modified": "2022-05-24T17:32:14Z",
"published": "2022-05-24T17:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4474"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209106"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209107"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209108"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209109"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209140"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209141"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JR7J-5WRW-QXV3
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35Receipt of a specific MPLS packet may cause MPC7/8/9, PTX-FPC3 (FPC-P1, FPC-P2) line cards or PTX1K to crash and restart. By continuously sending specific MPLS packets, an attacker can repeatedly crash the line cards or PTX1K causing a sustained Denial of Service. Affected releases are Juniper Networks Junos OS with MPC7/8/9 or PTX-FPC3 (FPC-P1, FPC-P2) installed and PTX1K: 15.1F versions prior to 15.1F6-S10; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 16.1 versions prior to 16.1R3-S8, 16.1R4-S9, 16.1R5-S4, 16.1R6-S3, 16.1R7; 16.1X65 versions prior to 16.1X65-D46; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S4, 17.2R2-S4, 17.2R3; 17.2X75 versions prior to 17.2X75-D70, 17.2X75-D90; 17.3 versions prior to 17.3R1-S4, 17.3R2, 17.4 versions prior to 17.4R1-S2, 17.4R2. Refer to KB25385 for more information about PFE line cards.
{
"affected": [],
"aliases": [
"CVE-2018-0030"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-11T18:29:00Z",
"severity": "HIGH"
},
"details": "Receipt of a specific MPLS packet may cause MPC7/8/9, PTX-FPC3 (FPC-P1, FPC-P2) line cards or PTX1K to crash and restart. By continuously sending specific MPLS packets, an attacker can repeatedly crash the line cards or PTX1K causing a sustained Denial of Service. Affected releases are Juniper Networks Junos OS with MPC7/8/9 or PTX-FPC3 (FPC-P1, FPC-P2) installed and PTX1K: 15.1F versions prior to 15.1F6-S10; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 16.1 versions prior to 16.1R3-S8, 16.1R4-S9, 16.1R5-S4, 16.1R6-S3, 16.1R7; 16.1X65 versions prior to 16.1X65-D46; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S4, 17.2R2-S4, 17.2R3; 17.2X75 versions prior to 17.2X75-D70, 17.2X75-D90; 17.3 versions prior to 17.3R1-S4, 17.3R2, 17.4 versions prior to 17.4R1-S2, 17.4R2. Refer to KB25385 for more information about PFE line cards.",
"id": "GHSA-jr7j-5wrw-qxv3",
"modified": "2022-05-13T01:35:58Z",
"published": "2022-05-13T01:35:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0030"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/JSA10864"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/KB25385"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041325"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JR9F-6CWX-MFJG
Vulnerability from github – Published: 2024-07-31 21:32 – Updated: 2024-07-31 21:32A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API request.
{
"affected": [],
"aliases": [
"CVE-2022-4003"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T21:15:14Z",
"severity": "LOW"
},
"details": "A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API request.",
"id": "GHSA-jr9f-6cwx-mfjg",
"modified": "2024-07-31T21:32:38Z",
"published": "2024-07-31T21:32:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4003"
},
{
"type": "WEB",
"url": "https://en-us.support.motorola.com/app/answers/detail/a_id/176952/~/motorola-q14-mesh-router-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-JRF8-CMGG-GV2M
Vulnerability from github – Published: 2021-08-25 20:53 – Updated: 2023-06-13 20:29native_cpuid::cpuid_count() exposes the unsafe __cpuid_count() intrinsic from core::arch::x86 or core::arch::x86_64 as a safe function, and uses it internally, without checking the safety requirement:
- The CPU the program is currently running on supports the function being called.
CPUID is available in most, but not all, x86/x86_64 environments. The crate compiles only on these architectures, so others are unaffected. This issue is mitigated by the fact that affected programs are expected to crash deterministically every time.
The flaw has been fixed in v9.0.0, by intentionally breaking compilation when targeting SGX or 32-bit x86 without SSE. This covers all affected CPUs.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "raw-cpuid"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-26307"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-657"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T18:02:32Z",
"nvd_published_at": "2021-01-29T03:15:00Z",
"severity": "MODERATE"
},
"details": "native_cpuid::cpuid_count() exposes the unsafe __cpuid_count() intrinsic from core::arch::x86 or core::arch::x86_64 as a safe function, and uses it internally, without checking the safety requirement:\n\n* The CPU the program is currently running on supports the function being called.\n\nCPUID is available in most, but not all, x86/x86_64 environments. The crate compiles only on these architectures, so others are unaffected. This issue is mitigated by the fact that affected programs are expected to crash deterministically every time.\n\nThe flaw has been fixed in v9.0.0, by intentionally breaking compilation when targeting SGX or 32-bit x86 without SSE. This covers all affected CPUs.",
"id": "GHSA-jrf8-cmgg-gv2m",
"modified": "2023-06-13T20:29:54Z",
"published": "2021-08-25T20:53:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26307"
},
{
"type": "WEB",
"url": "https://github.com/gz/rust-cpuid/issues/40"
},
{
"type": "WEB",
"url": "https://github.com/gz/rust-cpuid/issues/41"
},
{
"type": "WEB",
"url": "https://github.com/RustSec/advisory-db/pull/614"
},
{
"type": "WEB",
"url": "https://github.com/gz/rust-cpuid/commit/91b676eecd01f2163e2984215e2c0ac89e30ce75"
},
{
"type": "PACKAGE",
"url": "https://github.com/gz/rust-cpuid"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2021-0013.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Error on unsupported architectures in raw-cpuid"
}
GHSA-JRFJ-98QG-QJGV
Vulnerability from github – Published: 2022-01-27 14:42 – Updated: 2023-01-24 15:46In api.rb in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "sidekiq"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "sidekiq"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-23837"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-24T22:50:23Z",
"nvd_published_at": "2022-01-21T21:15:00Z",
"severity": "HIGH"
},
"details": "In `api.rb` in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.",
"id": "GHSA-jrfj-98qg-qjgv",
"modified": "2023-01-24T15:46:01Z",
"published": "2022-01-27T14:42:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23837"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/pull/495"
},
{
"type": "WEB",
"url": "https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956"
},
{
"type": "WEB",
"url": "https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md"
},
{
"type": "PACKAGE",
"url": "https://github.com/mperham/sidekiq"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Denial of service in sidekiq"
}
GHSA-JRG5-JW7R-RXG9
Vulnerability from github – Published: 2025-06-19 12:30 – Updated: 2025-06-20 15:30ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2025-49763"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-19T10:15:21Z",
"severity": "HIGH"
},
"details": "ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.\n\nUsers can use a new setting for the plugin (--max-inclusion-depth) to limit it.\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.\n\nUsers are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.",
"id": "GHSA-jrg5-jw7r-rxg9",
"modified": "2025-06-20T15:30:36Z",
"published": "2025-06-19T12:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49763"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.