CWE-410
AllowedInsufficient Resource Pool
Abstraction: Class · Status: Incomplete
The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
33 vulnerabilities reference this CWE, most recent first.
GHSA-R557-C6RF-9Q6W
Vulnerability from github – Published: 2024-11-23 03:31 – Updated: 2024-11-23 03:31ChargePoint Home Flex Bluetooth Low Energy Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of ChargePoint Home Flex charging devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the connection handling of the Bluetooth Low Energy interface. The issue results from limiting the number of active connections to the product. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-21455.
{
"affected": [],
"aliases": [
"CVE-2024-7392"
],
"database_specific": {
"cwe_ids": [
"CWE-410"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-22T22:15:18Z",
"severity": "MODERATE"
},
"details": "ChargePoint Home Flex Bluetooth Low Energy Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of ChargePoint Home Flex charging devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the connection handling of the Bluetooth Low Energy interface. The issue results from limiting the number of active connections to the product. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-21455.",
"id": "GHSA-r557-c6rf-9q6w",
"modified": "2024-11-23T03:31:58Z",
"published": "2024-11-23T03:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7392"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1047"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-WGMR-MF83-7X4J
Vulnerability from github – Published: 2022-07-07 20:55 – Updated: 2022-07-19 19:42Description
Invalid HTTP/2 requests (for example, invalid URIs) are incorrectly handled by writing a blocking error response directly from the selector thread. If the client manages to exhaust the HTTP/2 flow control window, or TCP congest the connection, the selector thread will be blocked trying to write the error response. If this is repeated for all the selector threads, the server becomes unresponsive, causing the denial of service.
Impact
A malicious client may render the server unresponsive.
Patches
The fix is available in Jetty versions 9.4.47. 10.0.10, 11.0.10.
Workarounds
No workaround available within Jetty itself. One possible workaround is to filter the requests before sending them to Jetty (for example in a proxy)
For more information
If you have any questions or comments about this advisory: * Email us at security@webtide.com.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.4.47"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-server"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-server"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-2048"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-410"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-07T20:55:40Z",
"nvd_published_at": "2022-07-07T21:15:00Z",
"severity": "HIGH"
},
"details": "### Description\nInvalid HTTP/2 requests (for example, invalid URIs) are incorrectly handled by writing a blocking error response directly from the selector thread.\nIf the client manages to exhaust the HTTP/2 flow control window, or TCP congest the connection, the selector thread will be blocked trying to write the error response.\nIf this is repeated for all the selector threads, the server becomes unresponsive, causing the denial of service.\n\n### Impact\nA malicious client may render the server unresponsive.\n\n### Patches\nThe fix is available in Jetty versions 9.4.47. 10.0.10, 11.0.10.\n\n### Workarounds\nNo workaround available within Jetty itself.\nOne possible workaround is to filter the requests before sending them to Jetty (for example in a proxy)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at security@webtide.com.\n",
"id": "GHSA-wgmr-mf83-7x4j",
"modified": "2022-07-19T19:42:51Z",
"published": "2022-07-07T20:55:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2048"
},
{
"type": "PACKAGE",
"url": "https://github.com/eclipse/jetty.project"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220901-0006"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5198"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/09/09/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service"
}
GHSA-XXPX-F58M-683F
Vulnerability from github – Published: 2025-04-02 03:31 – Updated: 2025-04-02 03:31Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
{
"affected": [],
"aliases": [
"CVE-2025-27694"
],
"database_specific": {
"cwe_ids": [
"CWE-410"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-02T01:15:37Z",
"severity": "MODERATE"
},
"details": "Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.",
"id": "GHSA-xxpx-f58m-683f",
"modified": "2025-04-02T03:31:42Z",
"published": "2025-04-02T03:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27694"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000296515/dsa-2025-135"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
Mitigation
Consider implementing a velocity check mechanism which would detect abusive behavior.
Mitigation
Consider load balancing as an option to handle heavy loads.
Mitigation
Make sure that resource handles are properly closed when no longer needed.
Mitigation
Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).
No CAPEC attack patterns related to this CWE.