Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-400 (未加控制的资源消耗(资源穷尽)) — Vulnerability Class 1396

1396 vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)). AI Chinese analysis included.

CWE-400 represents a critical resource management weakness where software fails to properly control the allocation and maintenance of finite system resources, such as memory, CPU cycles, or file descriptors. Attackers typically exploit this vulnerability by triggering actions that consume excessive resources, leading to denial-of-service conditions that degrade performance or crash the application entirely. This often occurs through crafted inputs that force infinite loops, excessive data processing, or unbounded memory allocation. To mitigate this risk, developers must implement strict resource limits, including timeouts, maximum iteration counts, and memory caps. Additionally, employing robust input validation and monitoring tools helps detect abnormal consumption patterns early. By enforcing these controls, engineers ensure that applications remain resilient against resource exhaustion attacks, maintaining availability and stability even under malicious stress or unexpected load spikes.

MITRE CWE Description
The product does not properly control the allocation and maintenance of a limited resource.
Common Consequences (2)
AvailabilityDoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
If an attacker can trigger the allocation of the limited resources, but the number or size of the resources is not controlled, then the most common result is denial of service. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding envir…
Access Control, OtherBypass Protection Mechanism, Other
In some cases it may be possible to force the product to "fail open" in the event of resource exhaustion. The state of the product -- and possibly the security functionality - may then be compromised.
Mitigations (4)
Architecture and DesignDesign throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perha…
Architecture and DesignMitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to preven…
Architecture and DesignEnsure that protocols have specific limits of scale placed on them.
ImplementationEnsure that all failures in resource allocation place the system into a safe posture.
Examples (2)
The following example demonstrates the weakness.
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }
Bad · Java
This code allocates a socket and forks each time it receives a new connection.
sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2025-9278 ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities — ArmorStart® LT 6.5AIMediumAI2026-01-20
CVE-2025-9466 ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities — ArmorStart® LT 7.5AIHighAI2026-01-20
CVE-2025-9465 ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities — ArmorStart® LT 7.5AIHighAI2026-01-20
CVE-2025-9464 Rockwell Automation ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities — ArmorStart® LT 7.5AIHighAI2026-01-20
CVE-2026-1174 birkir prime GraphQL Alias graphql resource consumption — prime 5.3 Medium2026-01-19
CVE-2026-21696 Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered — wings 7.1AIHighAI2026-01-19
CVE-2025-69199 Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances — panel 7.5AIHighAI2026-01-19
CVE-2025-69198 Pterodactyl's improper resource locking allows raced queries to create more resources than alloted — panel 6.5AIMediumAI2026-01-19
CVE-2026-23842 ChatterBot has Denial of Service via Database Connection Pool Exhaustion — ChatterBot 7.5 High2026-01-19
CVE-2025-15532 Open5GS Timer resource consumption — Open5GS 5.3 Medium2026-01-17
CVE-2026-0992 Libxml2: libxml2: denial of service via crafted xml catalogs — Red Hat Hardened Images 2.9 Low2026-01-15
CVE-2026-22239 Email Sending Vulnerability in BLUVOYIX — BLUVOYIX 7.2AIHighAI2026-01-14
CVE-2025-40944 Siemens多款产品 资源管理错误漏洞 — SIMATIC ET 200AL IM 157-1 PN 7.5 High2026-01-13
CVE-2026-22690 pypdf has possible long runtimes for missing /Root object with large /Size values — pypdf--2026-01-10
CVE-2026-22542 DENIAL OF SERVICE FOR CONCURRENT CONNECTIONS ON TELNET — QC 60/90/120 6.5 -2026-01-07
CVE-2026-22541 DENIAL OF SERVICE VIA ICMP PACKETS — QC 60/90/120 9.1 -2026-01-07
CVE-2026-22540 DENIAL OF SERVICE VIA ARP PACKETS — QC60/90/120 8.1 -2026-01-07
CVE-2026-21452 MessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload Allocation — msgpack-java 7.5 High2026-01-02
CVE-2025-68272 Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding — signalk-server 7.5 High2026-01-01
CVE-2025-59529 simple protocol server ignores accepts unlimited connections and logs failures without limit — avahi 5.5 Medium2025-12-18
CVE-2025-8872 A specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted — EOS 6.5 Medium2025-12-16
CVE-2023-53873 SyncBreeze 15.2.24 Denial of Service via Login Endpoint Overflow — SyncBreeze 7.5AIHighAI2025-12-15
CVE-2025-67731 Servify Express does not enforce rate limiting when parsing JSON — servify-express 7.5AIHighAI2025-12-12
CVE-2025-67725 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing — tornado 7.5 High2025-12-12
CVE-2024-58306 minaliC 2.0.0 Denial of Service Vulnerability via Large GET Request — minaliC 7.5AIHighAI2025-12-11
CVE-2025-66453 Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function — rhino 7.5AIHighAI2025-12-03
CVE-2025-66303 Grav is vulnerable to a DOS on the admin panel — grav 4.9 Medium2025-12-01
CVE-2025-58436 OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack — cups 5.1 Medium2025-11-29
CVE-2020-36872 BACnet Test Server 1.01 Malformed BVLC Length DoS — BACnet Test Server 7.5AIHighAI2025-11-26
CVE-2025-66019 pypdf manipulated LZWDecode streams can exhaust RAM — pypdf 4.3AIMediumAI2025-11-25

Vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)) represent 1396 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.