CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5436 vulnerabilities reference this CWE, most recent first.
GHSA-R7JX-5M6M-CPG9
Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-04-07 12:34A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.
Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., child_process.exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.
Proof of Concept
(async () => {
const lib = await import('eazy-logger');
var someObj = {}
console.log("Before Attack: ", JSON.stringify({}.__proto__));
try {
// for multiple functions, uncomment only one for each execution.
lib.Logger (JSON.parse('{"__proto__":{"pollutedKey":123}}'))
} catch (e) { }
console.log("After Attack: ", JSON.stringify({}.__proto__));
delete Object.prototype.pollutedKey;
})();
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.0.1"
},
"package": {
"ecosystem": "npm",
"name": "eazy-logger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-57075"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-06T23:31:34Z",
"nvd_published_at": "2025-02-05T22:15:31Z",
"severity": "HIGH"
},
"details": "A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.\n\nAn attacker can supply a payload with `Object.prototype` setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., `child_process.exec`, `eval`), it could enable an attacker to execute arbitrary commands within the application\u0027s context.\n\n## Proof of Concept\n\n```js\n(async () =\u003e {\nconst lib = await import(\u0027eazy-logger\u0027);\nvar someObj = {}\nconsole.log(\"Before Attack: \", JSON.stringify({}.__proto__));\ntry {\n// for multiple functions, uncomment only one for each execution.\nlib.Logger (JSON.parse(\u0027{\"__proto__\":{\"pollutedKey\":123}}\u0027))\n} catch (e) { }\nconsole.log(\"After Attack: \", JSON.stringify({}.__proto__));\ndelete Object.prototype.pollutedKey;\n})();\n```",
"id": "GHSA-r7jx-5m6m-cpg9",
"modified": "2025-04-07T12:34:01Z",
"published": "2025-02-06T06:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57075"
},
{
"type": "WEB",
"url": "https://github.com/shakyShane/eazy-logger/commit/a8baa6fe441d19ffa9916eba367016b7937a28fd"
},
{
"type": "WEB",
"url": "https://gist.github.com/tariqhawis/c601f7f85146510ca899a7406a03aba5"
},
{
"type": "PACKAGE",
"url": "https://github.com/shakyShane/eazy-logger"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "eazy-logger prototype pollution"
}
GHSA-R7M3-V6C2-V4VR
Vulnerability from github – Published: 2026-05-28 21:32 – Updated: 2026-05-28 21:32Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.
{
"affected": [],
"aliases": [
"CVE-2026-33464"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T20:16:23Z",
"severity": "MODERATE"
},
"details": "Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.",
"id": "GHSA-r7m3-v6c2-v4vr",
"modified": "2026-05-28T21:32:03Z",
"published": "2026-05-28T21:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33464"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-1-security-update-esa-2026-32/386548"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R7M4-F9H5-GR79
Vulnerability from github – Published: 2024-10-14 21:07 – Updated: 2025-11-03 22:48Impact
Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.
Patches
- https://github.com/jetty/jetty.project/pull/9715
- https://github.com/jetty/jetty.project/pull/9716
Workarounds
The session usage is intrinsic to the design of the PushCacheFilter. The issue can be avoided by: + not using the PushCacheFilter. Push has been deprecated by the various IETF specs and early hints responses should be used instead. + reducing the reducing the idle timeout on unauthenticated sessions will reduce the time such session stay in memory. + configuring a session cache to use session passivation, so that sessions are not stored in memory, but rather in a database or file system that may have significantly more capacity than memory.
References
- https://github.com/jetty/jetty.project/pull/10756
- https://github.com/jetty/jetty.project/pull/10755
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.0.17"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty:jetty-servlets"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 11.0.17"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty:jetty-servlets"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 12.0.3"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty:jetty-servlets"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-6762"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-14T21:07:29Z",
"nvd_published_at": "2024-10-14T16:15:03Z",
"severity": "LOW"
},
"details": "### Impact\n Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server\u2019s memory.\n\n### Patches\n* https://github.com/jetty/jetty.project/pull/9715\n* https://github.com/jetty/jetty.project/pull/9716\n\n### Workarounds\nThe session usage is intrinsic to the design of the PushCacheFilter. The issue can be avoided by:\n + not using the PushCacheFilter. Push has been deprecated by the various IETF specs and early hints responses should be used instead.\n + reducing the reducing the idle timeout on unauthenticated sessions will reduce the time such session stay in memory.\n + configuring a session cache to use [session passivation](https://jetty.org/docs/jetty/12/programming-guide/server/session.html), so that sessions are not stored in memory, but rather in a database or file system that may have significantly more capacity than memory.\n\n### References\n* https://github.com/jetty/jetty.project/pull/10756\n* https://github.com/jetty/jetty.project/pull/10755",
"id": "GHSA-r7m4-f9h5-gr79",
"modified": "2025-11-03T22:48:56Z",
"published": "2024-10-14T21:07:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-r7m4-f9h5-gr79"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6762"
},
{
"type": "WEB",
"url": "https://github.com/jetty/jetty.project/pull/10755"
},
{
"type": "WEB",
"url": "https://github.com/jetty/jetty.project/pull/10756"
},
{
"type": "WEB",
"url": "https://github.com/jetty/jetty.project/pull/9715"
},
{
"type": "WEB",
"url": "https://github.com/jetty/jetty.project/pull/9716"
},
{
"type": "PACKAGE",
"url": "https://github.com/jetty/jetty.project"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/24"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Eclipse Jetty\u0027s PushSessionCacheFilter can cause remote DoS attacks"
}
GHSA-R7PQ-69H8-PG3G
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-05-24 19:05An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
{
"affected": [],
"aliases": [
"CVE-2021-33818"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-18T19:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.",
"id": "GHSA-r7pq-69h8-pg3g",
"modified": "2022-05-24T19:05:38Z",
"published": "2022-05-24T19:05:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33818"
},
{
"type": "WEB",
"url": "https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33818.md"
},
{
"type": "WEB",
"url": "https://github.com/shekyan/slowhttptest"
},
{
"type": "WEB",
"url": "https://store.ui.com/collections/unifi-protect-cameras/products/unifi-video-g3-flex-camera"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-R7QV-F5P4-F3QR
Vulnerability from github – Published: 2023-08-22 21:30 – Updated: 2024-04-04 07:05An issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data allows attackers to read or write to system memory or cause a denial of service.
{
"affected": [],
"aliases": [
"CVE-2020-19726"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-22T19:16:05Z",
"severity": "HIGH"
},
"details": "An issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data allows attackers to read or write to system memory or cause a denial of service.",
"id": "GHSA-r7qv-f5p4-f3qr",
"modified": "2024-04-04T07:05:44Z",
"published": "2023-08-22T21:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19726"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=26240"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=26241"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R7X6-6CMJ-2972
Vulnerability from github – Published: 2024-08-06 15:30 – Updated: 2024-08-06 18:30PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,
{
"affected": [],
"aliases": [
"CVE-2024-30170"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-06T14:16:03Z",
"severity": "HIGH"
},
"details": "PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,",
"id": "GHSA-r7x6-6cmj-2972",
"modified": "2024-08-06T18:30:56Z",
"published": "2024-08-06T15:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30170"
},
{
"type": "WEB",
"url": "https://info.ssh.com/improper-input-validation-faq"
},
{
"type": "WEB",
"url": "https://privx.docs.ssh.com/docs/security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R82F-C679-WQMP
Vulnerability from github – Published: 2025-07-07 15:30 – Updated: 2025-07-07 15:30MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than anticipated, memory consumption can increase, potentially impacting server stability and availability. This issue affects MongoDB Server v8.0 versions prior to 8.0.10
{
"affected": [],
"aliases": [
"CVE-2025-6712"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-07T15:15:28Z",
"severity": "MODERATE"
},
"details": "MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than anticipated, memory consumption can increase, potentially impacting server stability and availability. This issue affects MongoDB Server v8.0 versions prior to 8.0.10",
"id": "GHSA-r82f-c679-wqmp",
"modified": "2025-07-07T15:30:40Z",
"published": "2025-07-07T15:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6712"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/SERVER-106751"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R84P-88G2-2VX2
Vulnerability from github – Published: 2022-05-13 00:01 – Updated: 2024-03-11 18:49The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.0-M15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0-M1"
},
{
"fixed": "10.0.21"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.13"
},
{
"fixed": "9.0.63"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.38"
},
{
"fixed": "8.5.79"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-29885"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-11T18:49:58Z",
"nvd_published_at": "2022-05-12T08:15:00Z",
"severity": "HIGH"
},
"details": "The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.",
"id": "GHSA-r84p-88g2-2vx2",
"modified": "2024-03-11T18:49:58Z",
"published": "2022-05-13T00:01:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29885"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/0fa7721f11d565a2cd2e44366c388ad6a3e6357d"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/36826ea638457d7e17876a70f89cb435b6db0d91"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/b679bc627f5a4ea6510af95adfb7476b07eba890"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/eaafd28296c54d983e28a47953c1f5cb2c334f48"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220629-0002"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5265"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption"
}
GHSA-R87G-78MX-3WG4
Vulnerability from github – Published: 2026-06-03 00:30 – Updated: 2026-07-10 17:15A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.2.39 will fix this issue. The patch is named 4ce845f8749b6a159b57b38dcc3357f7222a8078. It is suggested to upgrade the affected component.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@wonderwhy-er/desktop-commander"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.39"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-10691"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-10T17:15:12Z",
"nvd_published_at": "2026-06-03T00:16:30Z",
"severity": "LOW"
},
"details": "A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.2.39 will fix this issue. The patch is named 4ce845f8749b6a159b57b38dcc3357f7222a8078. It is suggested to upgrade the affected component.",
"id": "GHSA-r87g-78mx-3wg4",
"modified": "2026-07-10T17:15:12Z",
"published": "2026-06-03T00:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10691"
},
{
"type": "WEB",
"url": "https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/375"
},
{
"type": "WEB",
"url": "https://github.com/wonderwhy-er/DesktopCommanderMCP/pull/400"
},
{
"type": "WEB",
"url": "https://github.com/wonderwhy-er/DesktopCommanderMCP/commit/4ce845f8749b6a159b57b38dcc3357f7222a8078"
},
{
"type": "PACKAGE",
"url": "https://github.com/wonderwhy-er/DesktopCommanderMCP"
},
{
"type": "WEB",
"url": "https://github.com/wonderwhy-er/DesktopCommanderMCP/releases/tag/v0.2.39"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-10691"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/830746"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367960"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367960/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption"
}
GHSA-R894-PXPX-J3M6
Vulnerability from github – Published: 2024-04-25 18:30 – Updated: 2024-04-25 18:30A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.
{
"affected": [],
"aliases": [
"CVE-2024-3508"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-25T18:15:09Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.",
"id": "GHSA-r894-pxpx-j3m6",
"modified": "2024-04-25T18:30:40Z",
"published": "2024-04-25T18:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3508"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-3508"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274109"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.