Skip to content
Noroxi

CWE-400 · 4,079 records

Uncontrolled resource consumption

Why does it happen?

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

How to prevent it

  1. 01Set depth, length and time limits in parsers.
  2. 02Truncate user input before writing it to logs.
  3. 03Set alert thresholds for CPU and memory usage.

Vulnerable and fixed code

A representative teaching example. Highlighted lines mark where the bug and the fix are.

Vulnerable

ts
function expand(node) {  return node.children.map(expand);}

Fixed

ts
const MAX_DEPTH = 32;function expand(node, depth = 0) {  if (depth > MAX_DEPTH) throw new Error("too deep");  return node.children.map((c) => expand(c, depth + 1));}

Is this pattern in your code?

We look for this class specifically as part of our Source code review service. Findings are delivered with line numbers.

Source code reviewRequest a quote

CVEs in this class

4,086 records

  • CVE-2023-44487
    90Now

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmwareOct 10, 2023

  • CVE-2026-45498
    79This week

    Microsoft Defender Denial of Service Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 63%

    microsoft · defender antimalware platformMay 20, 2026

  • CVE-2026-28318
    74This week

    SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 48%

    solarwinds · serv-uJun 4, 2026

  • CVE-2020-3566
    65This week

    Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

    HighCVSS 8.6KEVWeaponizedEPSS 3%

    cisco · ios xrAug 29, 2020

  • CVE-2020-3569
    65This week

    Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities

    HighCVSS 8.6KEVWeaponizedEPSS 3%

    cisco · ios xrSep 22, 2020

  • CVE-2023-38180
    64This week

    .NET and Visual Studio Denial of Service Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 14%

    microsoft · .netAug 8, 2023

  • CVE-2011-3192
    61This week

    The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a deni

    HighCVSS 7.8WeaponizedEPSS 98%

    apache · http serverAug 29, 2011

  • CVE-2018-1000115
    60This week

    Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP

    HighCVSS 7.5WeaponizedEPSS 88%

    memcached · memcachedMar 5, 2018

  • CVE-2019-5645
    60This week

    Rapid7 Metasploit HTTP Handler Denial of Service

    HighCVSS 7.5WeaponizedEPSS 49%

    rapid7 · metasploitSep 1, 2020

  • CVE-2017-16086
    60This week

    ua-parser is a port of Browserscope's user agent parser.

    HighCVSS 7.5WeaponizedEPSS 9%

    ua-parser project · ua-parserJun 6, 2018

  • CVE-2016-10542
    60This week

    ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455".

    HighCVSS 7.5WeaponizedEPSS 7%

    ws project · wsMay 31, 2018

  • CVE-2004-1464
    60This week

    Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a craf

    MediumCVSS 5.9KEVWeaponizedEPSS 4%

    cisco · iosDec 31, 2004

  • CVE-2023-45288
    57Plan

    HTTP/2 CONTINUATION flood in net/http

    HighCVSS 7.5Proof of conceptEPSS 89%

    go standard library · net/httpApr 4, 2024

  • CVE-2019-9515
    56Plan

    Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 87%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9512
    55Plan

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 83%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9514
    55Plan

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 82%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9513
    54Plan

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

    HighCVSS 7.5Proof of conceptEPSS 81%

    apple · swiftnioAug 13, 2019

  • CVE-2023-28342
    54Plan

    Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.

    HighCVSS 7.5No exploitEPSS 78%

    zohocorp · manageengine adselfservice plusApr 5, 2023

  • CVE-2021-21341
    53Plan

    XStream can cause a Denial of Service

    HighCVSS 7.5Proof of conceptEPSS 77%

    xstream · xstreamMar 23, 2021

  • CVE-2003-0714
    53Plan

    The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion)

    HighCVSS 7.5WeaponizedEPSS 77%

    microsoft · exchange serverNov 17, 2003

  • CVE-2021-22883
    53Plan

    Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an

    HighCVSS 7.5No exploitEPSS 77%

    nodejs · node.jsMar 3, 2021

  • CVE-2023-50868
    52Plan

    The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a den

    HighCVSS 7.5Proof of conceptEPSS 74%

    netapp · hci baseboard management controllerFeb 14, 2024

  • CVE-2022-29885
    52Plan

    EncryptInterceptor does not provide complete protection on insecure networks

    HighCVSS 7.5Proof of conceptEPSS 73%

    apache · tomcatMay 12, 2022

  • CVE-2019-0199
    52Plan

    The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames

    HighCVSS 7.5No exploitEPSS 72%

    apache · tomcatApr 10, 2019

  • CVE-2017-3144
    52Plan

    Failure to properly clean up closed OMAPI connections can exhaust available sockets

    HighCVSS 7.5No exploitEPSS 72%

    isc · dhcpJan 16, 2019

All vulnerability classes