Common Weakness Enumeration
CWE-1049
AllowedExcessive Data Query Operations in a Large Data Table
Abstraction: Base · Status: Incomplete
The product performs a data query with a large number of joins and sub-queries on a large data table.
6 vulnerabilities reference this CWE, most recent first.
CVE-2025-0190 (GCVE-0-2025-0190)
Vulnerability from cvelistv5 – Published: 2025-03-20 10:08 – Updated: 2025-03-20 19:03
VLAI
EPSS
VEX
Title
Denial of Service in aimhubio/aim
Summary
In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1049 - Excessive Data Query Operations in a Large Data Table
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aimhubio | aimhubio/aim |
Affected:
unspecified , ≤ latest
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0190",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-20T17:55:00.702376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T19:03:20.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "aimhubio/aim",
"vendor": "aimhubio",
"versions": [
{
"lessThanOrEqual": "latest",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1049",
"description": "CWE-1049 Excessive Data Query Operations in a Large Data Table",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T10:08:48.087Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntr_ai"
},
"references": [
{
"url": "https://huntr.com/bounties/38d151f1-abb4-443a-86b0-6c26f0c6cb70"
}
],
"source": {
"advisory": "38d151f1-abb4-443a-86b0-6c26f0c6cb70",
"discovery": "EXTERNAL"
},
"title": "Denial of Service in aimhubio/aim"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntr_ai",
"cveId": "CVE-2025-0190",
"datePublished": "2025-03-20T10:08:48.087Z",
"dateReserved": "2025-01-03T01:25:21.021Z",
"dateUpdated": "2025-03-20T19:03:20.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5192 (GCVE-0-2023-5192)
Vulnerability from cvelistv5 – Published: 2023-09-26 07:34 – Updated: 2024-09-24 14:21
VLAI
EPSS
VEX
Title
Excessive Data Query Operations in a Large Data Table in pimcore/demo
Summary
Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1049 - Excessive Data Query Operations in a Large Data Table
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| pimcore | pimcore/demo |
Affected:
unspecified , < 10.3.0
(custom)
|
|
| pimcore | pimcore |
Affected:
0 , < 10.3.0
(custom)
cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:52:07.853Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://huntr.dev/bounties/65c954f2-79c3-4672-8846-a3035e7a1db7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/pimcore/demo/commit/a2a7ff3b565882aefb759804aac4a51afb458f1f"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "pimcore",
"vendor": "pimcore",
"versions": [
{
"lessThan": "10.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5192",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-24T14:12:54.546761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-24T14:21:53.364Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pimcore/demo",
"vendor": "pimcore",
"versions": [
{
"lessThan": "10.3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1049",
"description": "CWE-1049 Excessive Data Query Operations in a Large Data Table",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-26T07:34:27.103Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"url": "https://huntr.dev/bounties/65c954f2-79c3-4672-8846-a3035e7a1db7"
},
{
"url": "https://github.com/pimcore/demo/commit/a2a7ff3b565882aefb759804aac4a51afb458f1f"
}
],
"source": {
"advisory": "65c954f2-79c3-4672-8846-a3035e7a1db7",
"discovery": "EXTERNAL"
},
"title": "Excessive Data Query Operations in a Large Data Table in pimcore/demo"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2023-5192",
"datePublished": "2023-09-26T07:34:27.103Z",
"dateReserved": "2023-09-26T07:34:14.104Z",
"dateUpdated": "2024-09-24T14:21:53.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-8460 (GCVE-0-2019-8460)
Vulnerability from cvelistv5 – Published: 2019-08-26 19:18 – Updated: 2024-08-04 21:17
VLAI
EPSS
VEX
Summary
OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.
Severity
No CVSS data available.
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/openbsd/src/commit/ed8fdce754a… | x_refsource_MISC |
| https://ftp.openbsd.org/pub/OpenBSD/patches/6.5/c… | x_refsource_MISC |
| https://security.netapp.com/advisory/ntap-2019090… | x_refsource_CONFIRM |
| https://research.checkpoint.com/tcp-sack-security… | x_refsource_MISC |
| https://us-cert.cisa.gov/ics/advisories/icsa-19-253-03 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:17:31.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openbsd/src/commit/ed8fdce754a5d8d14c09e989d8877707bd43906f"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/6.5/common/006_tcpsack.patch.sig"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20190905-0001/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-19-253-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenBSD",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "All, including latest - 6.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenBSD kernel version \u003c= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1049",
"description": "CWE-1049",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-02T16:16:54.000Z",
"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"shortName": "checkpoint"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbsd/src/commit/ed8fdce754a5d8d14c09e989d8877707bd43906f"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/6.5/common/006_tcpsack.patch.sig"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20190905-0001/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-19-253-03"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@checkpoint.com",
"ID": "CVE-2019-8460",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenBSD",
"version": {
"version_data": [
{
"version_value": "All, including latest - 6.5"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenBSD kernel version \u003c= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-1049"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/openbsd/src/commit/ed8fdce754a5d8d14c09e989d8877707bd43906f",
"refsource": "MISC",
"url": "https://github.com/openbsd/src/commit/ed8fdce754a5d8d14c09e989d8877707bd43906f"
},
{
"name": "https://ftp.openbsd.org/pub/OpenBSD/patches/6.5/common/006_tcpsack.patch.sig",
"refsource": "MISC",
"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/6.5/common/006_tcpsack.patch.sig"
},
{
"name": "https://security.netapp.com/advisory/ntap-20190905-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20190905-0001/"
},
{
"name": "https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460/",
"refsource": "MISC",
"url": "https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460/"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-19-253-03",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-19-253-03"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"assignerShortName": "checkpoint",
"cveId": "CVE-2019-8460",
"datePublished": "2019-08-26T19:18:49.000Z",
"dateReserved": "2019-02-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:17:31.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GHSA-9Q38-5HH6-P5GW
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2024-04-04 01:48
VLAI
Details
Reuven Plevinsky and Tal Vainshtein of Check Point Software Technologies Ltd. discovered that OpenBSD kernel (all versions, including 6.5) can be forced to create long chains of TCP SACK holes that cause very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2019-8460"
],
"database_specific": {
"cwe_ids": [
"CWE-1049"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-26T20:15:00Z",
"severity": "HIGH"
},
"details": "Reuven Plevinsky and Tal Vainshtein of Check Point Software Technologies Ltd. discovered that OpenBSD kernel (all versions, including 6.5) can be forced to create long chains of TCP SACK holes that cause very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.",
"id": "GHSA-9q38-5hh6-p5gw",
"modified": "2024-04-04T01:48:13Z",
"published": "2022-05-24T16:54:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8460"
},
{
"type": "WEB",
"url": "https://github.com/openbsd/src/commit/ed8fdce754a5d8d14c09e989d8877707bd43906f"
},
{
"type": "WEB",
"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/6.5/common/006_tcpsack.patch.sig"
},
{
"type": "WEB",
"url": "https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190905-0001"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-19-253-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FM93-G6XP-35XQ
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-22 00:34
VLAI
Summary
Aim Excessive Data Query Operations in a Large Data Table vulnerability
Details
In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of Text objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "aim"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.25.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-0190"
],
"database_specific": {
"cwe_ids": [
"CWE-1049"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-22T00:34:31Z",
"nvd_published_at": "2025-03-20T10:15:51Z",
"severity": "HIGH"
},
"details": "In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.",
"id": "GHSA-fm93-g6xp-35xq",
"modified": "2025-03-22T00:34:31Z",
"published": "2025-03-20T12:32:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0190"
},
{
"type": "PACKAGE",
"url": "https://github.com/aimhubio/aim"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/38d151f1-abb4-443a-86b0-6c26f0c6cb70"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Aim Excessive Data Query Operations in a Large Data Table vulnerability"
}
GHSA-P76J-H4M8-HX5C
Vulnerability from github – Published: 2023-09-27 15:30 – Updated: 2023-09-29 20:14
VLAI
Summary
Pimcore Demo Allows GraphQL Introspection
Details
Introspection is enabled on demo.pimcore.fun. The demo site has graphql as a feature for users, but allows users to run instropection queries, which presents a potential schema information disclosure vulnerability.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pimcore/demo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-5192"
],
"database_specific": {
"cwe_ids": [
"CWE-1049",
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-27T20:24:29Z",
"nvd_published_at": "2023-09-27T15:19:42Z",
"severity": "MODERATE"
},
"details": "Introspection is enabled on `demo.pimcore.fun`. The demo site has graphql as a feature for users, but allows users to run instropection queries, which presents a potential schema information disclosure vulnerability.",
"id": "GHSA-p76j-h4m8-hx5c",
"modified": "2023-09-29T20:14:00Z",
"published": "2023-09-27T15:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5192"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/demo/pull/437"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/demo/commit/a2a7ff3b565882aefb759804aac4a51afb458f1f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pimcore/demo"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/65c954f2-79c3-4672-8846-a3035e7a1db7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Pimcore Demo Allows GraphQL Introspection"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.