CWE-400: Uncontrolled Resource Consumption

Weakness type from the CWE catalogue

What the weakness means

The product does not properly control the allocation and maintenance of a limited resource.

Definition as published by MITRE, in English.

1,698 vulnerabilities in the service point to this weakness

CVE-2021-44228 Actively exploited Critical 10.0

Apache Log4j2 Remote Code Execution Vulnerability

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker contro…
CVE-2020-3569 Actively exploited High 8.6

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Int…
CVE-2020-3566 Actively exploited High 8.6

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected dev…
CVE-2026-28318 Actively exploited High 7.5

SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure custo…
CVE-2026-45498 Actively exploited High 7.5

Microsoft Defender Denial of Service Vulnerability

Microsoft Defender Denial of Service Vulnerability
CVE-2023-44487 Actively exploited High 7.5

HTTP/2 Rapid Reset Attack Vulnerability

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-38180 Actively exploited High 7.5

Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability
CVE-2004-1464 Actively exploited Medium 5.9

Cisco IOS Denial-of-Service Vulnerability

Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.
CVE-2026-60719 Critical 9.9

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable v…
CVE-2026-46775 Critical 9.9

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network acce…
CVE-2025-70327 Critical 9.8

TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The ip parameter is retrieved via websGetVar …
CVE-2025-61303 Critical 9.8

Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a vulnerability in its Windows behavioral analysis engine that allows a submitted malware samp…
CVE-2025-43193 Critical 9.8

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause a denial-of-service.
CVE-2025-24264 Critical 9.8

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processi…
CVE-2025-24269 Critical 9.8

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to cause unexpected system termination.
CVE-2025-24260 Critical 9.8

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker in a privileged position may be able to perfor…
CVE-2025-24247 Critical 9.8

A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker may be able to cause unexpected app termin…
CVE-2025-24211 Critical 9.8

This issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visio…
CVE-2025-24190 Critical 9.8

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, vision…
CVE-2024-45166 Critical 9.8

An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a me…
CVE-2026-61186 Critical 9.4

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability al…
CVE-2026-51106 Critical 9.3

An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component
CVE-2026-55450 Critical 9.3

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for a…
CVE-2026-22542 Critical 9.2

An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service.
CVE-2026-22540 Critical 9.2

The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be operating correctly for the charger to als…

Sources and freshness

CVE

What it is: A reference number naming one specific vulnerability, for example CVE-2024-9474.
What it tells you: Which vulnerability we are talking about, and in which product.
What it does NOT tell you: Nothing about how serious it is, whether anyone is exploiting it, or whether it concerns you.
Why it matters: Without a shared number, vendor, authority and tooling cannot discuss the same flaw.
Used with the others: The number is the key. NVD, KEV and EPSS all describe the same CVE.

NVD CWE CISA KEV EPSS

How to read this together

No single value should be used on its own. A high CVSS score does not mean a vulnerability is being exploited, and a low one does not mean it is harmless. The four sources answer four different questions.

CVE names the specific vulnerability.
NVD adds severity and technical detail about it.
CWE describes the type of mistake behind it.
CISA KEV shows that it is already being exploited.
EPSS estimates how likely exploitation is soon.

The order that decides what is urgent

Do you actually have the product?
Is the version you run affected?
Is it listed in CISA KEV?
Does it have a high EPSS score?
Is the system reachable from the internet or from others?
How important is the system to the business?
Are there compensating controls already in place?

The first two questions are not about the vulnerability at all. They are about you, and they remove most of the list before you start.

A short example

Fix this week

CVSS 6,5 (medium)

In CISA KEV: yes
EPSS: 94 per cent
A firewall facing the internet

Can be scheduled

CVSS 9,8 (critical)

In CISA KEV: no
EPSS: 0,04 per cent
A test server with no internet access

Sorted by CVSS alone, the one on the right comes first. It is the more serious flaw in theory. But the one on the left is being used against real organisations right now, and it sits where an attacker can reach it. That is the one to fix first.

The critical one still has to be fixed. It just does not have to be fixed today.

This product uses the NVD API but is not endorsed or certified by the NVD. CVE and the CVE logo are registered trademarks of The MITRE Corporation; CVE records are used under the CVE Terms of Use. CWE is a trademark of The MITRE Corporation, used per the CWE Terms of Use. KEV data from CISA (CC0). Exploitation probability from EPSS, a FIRST.org project. Open-source package data from OSV and the GitHub Advisory Database (CC-BY 4.0).

Scores and vectors are shown as published by the sources. The ordering of results is Berigo's own editorial assessment, described on the search page, and is not NVD data. An empty result never means a system is safe.