CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
6465 vulnerabilities reference this CWE, most recent first.
GHSA-3MC7-4Q67-W48M
Vulnerability from github – Published: 2022-08-31 00:00 – Updated: 2024-03-15 19:06The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.yaml:snakeyaml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.31"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25857"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-09T17:53:43Z",
"nvd_published_at": "2022-08-30T05:15:00Z",
"severity": "HIGH"
},
"details": "The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.",
"id": "GHSA-3mc7-4q67-w48m",
"modified": "2024-03-15T19:06:43Z",
"published": "2022-08-31T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857"
},
{
"type": "WEB",
"url": "https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174"
},
{
"type": "WEB",
"url": "https://bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174"
},
{
"type": "WEB",
"url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525"
},
{
"type": "PACKAGE",
"url": "https://github.com/snakeyaml/snakeyaml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240315-0010"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncontrolled Resource Consumption in snakeyaml"
}
GHSA-3MHW-F79R-CRMM
Vulnerability from github – Published: 2024-05-08 18:30 – Updated: 2025-03-26 15:32An issue in Open5GS v.2.7.0 allows an attacker to cause a denial of service via the 64 unsuccessful UE/gnb registration
{
"affected": [],
"aliases": [
"CVE-2024-33382"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-08T17:15:07Z",
"severity": "MODERATE"
},
"details": "An issue in Open5GS v.2.7.0 allows an attacker to cause a denial of service via the 64 unsuccessful UE/gnb registration",
"id": "GHSA-3mhw-f79r-crmm",
"modified": "2025-03-26T15:32:29Z",
"published": "2024-05-08T18:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33382"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/issues/2733"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-3MJG-24Q2-WGH5
Vulnerability from github – Published: 2025-12-08 18:30 – Updated: 2025-12-08 21:30In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2025-48603"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-08T17:16:17Z",
"severity": "MODERATE"
},
"details": "In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-3mjg-24q2-wgh5",
"modified": "2025-12-08T21:30:21Z",
"published": "2025-12-08T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48603"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/b4c6786312a217ad9dfd97041b2f1e2f77e39b94"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2025-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3MQX-HC7R-V3C4
Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existing but invalid XML file which would be opened and never closed, possibly producing a Denial of Service.
{
"affected": [],
"aliases": [
"CVE-2018-10864"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-13T17:29:00Z",
"severity": "MODERATE"
},
"details": "An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existing but invalid XML file which would be opened and never closed, possibly producing a Denial of Service.",
"id": "GHSA-3mqx-hc7r-v3c4",
"modified": "2022-05-13T01:34:56Z",
"published": "2022-05-13T01:34:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10864"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2373"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2018-10864"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1593627"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10864"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3MXC-8P66-5XWJ
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28In libmkvextractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-141860394
{
"affected": [],
"aliases": [
"CVE-2020-0287"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-17T21:15:00Z",
"severity": "MODERATE"
},
"details": "In libmkvextractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-141860394",
"id": "GHSA-3mxc-8p66-5xwj",
"modified": "2022-05-24T17:28:35Z",
"published": "2022-05-24T17:28:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0287"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/android-11"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3P27-QVP9-27QF
Vulnerability from github – Published: 2026-08-26 14:30 – Updated: 2026-08-26 14:31Impact
Wasmtime's native implementation of WASIp1 suffers from a leak in the fd_renumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of descriptors used by the host. This behavior means that while fd_renumber works correctly from a guest's perspective it ends up leaking resources in the host that aren't cleaned up until the corresponding Store is destroyed. This means that guests can, in a loop, use fd_renumber to cause hosts to exhaust resources or exhaust file descriptors.
This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose fd_renumber are affected. Runtimes are additionally only affected if they expose the ability to acquire a file descriptor, such as opening a file. For runtimes that deny access to files they are unaffected.
Patches
Wasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue.
Workarounds
There are no workarounds for this issue and hosts are recommended to update.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "wasmtime-wasi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "24.0.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "wasmtime-wasi"
},
"ranges": [
{
"events": [
{
"introduced": "45.0.0"
},
{
"fixed": "45.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "wasmtime-wasi"
},
"ranges": [
{
"events": [
{
"introduced": "25.0.0"
},
{
"fixed": "36.0.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "wasmtime-wasi"
},
"ranges": [
{
"events": [
{
"introduced": "37.0.0"
},
{
"fixed": "44.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54786"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-26T14:30:10Z",
"nvd_published_at": "2026-07-01T21:17:03Z",
"severity": "LOW"
},
"details": "### Impact\n\nWasmtime\u0027s native implementation of WASIp1 suffers from a leak in the `fd_renumber` function where the file descriptor being renumbered to is not properly closed. Wasmtime\u0027s implementation erroneously only updated the table of descriptors for WASIp1 and didn\u0027t update the underlying table of descriptors used by the host. This behavior means that while `fd_renumber` works correctly from a guest\u0027s perspective it ends up leaking resources in the host that aren\u0027t cleaned up until the corresponding `Store` is destroyed. This means that guests can, in a loop, use `fd_renumber` to cause hosts to exhaust resources or exhaust file descriptors.\n\nThis bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose `fd_renumber` are affected. Runtimes are additionally only affected if they expose the ability to acquire a file descriptor, such as opening a file. For runtimes that deny access to files they are unaffected.\n\n### Patches\n\nWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue.\n\n### Workarounds\n\nThere are no workarounds for this issue and hosts are recommended to update.",
"id": "GHSA-3p27-qvp9-27qf",
"modified": "2026-08-26T14:31:17Z",
"published": "2026-08-26T14:30:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3p27-qvp9-27qf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54786"
},
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/pull/13650"
},
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/commit/100bfe27253d2ce5154ddddf66d06e30f3fa6824"
},
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/commit/36b305d827149ac0336ddcbc0a378c303339d195"
},
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/commit/72493b11ed5df382c92a9dfb8b6bc064e471f1cd"
},
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/commit/e9fbe974c9698edef117323d981e13caf2097c13"
},
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/commit/f069f125cb77a4a3dced19a77d73790610678622"
},
{
"type": "PACKAGE",
"url": "https://github.com/bytecodealliance/wasmtime"
},
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.10"
},
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.11"
},
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v44.0.3"
},
{
"type": "WEB",
"url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.2"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0182.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
"type": "CVSS_V4"
}
],
"summary": "Wasmtime has a leak in WASIp1 `fd_renumber` implementation"
}
GHSA-3P35-64MH-V96V
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2025-01-14 21:31Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
{
"affected": [],
"aliases": [
"CVE-2019-9513"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-13T21:15:00Z",
"severity": "HIGH"
},
"details": "Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.",
"id": "GHSA-3p35-64mh-v96v",
"modified": "2025-01-14T21:31:39Z",
"published": "2022-05-24T16:53:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Aug/40"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Sep/1"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190823-0002"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190823-0005"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K02591030"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K02591030?utm_source=f5support\u0026amp%3Butm_medium=RSS"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K02591030?utm_source=f5support\u0026amp;utm_medium=RSS"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4099-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4505"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4511"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4669"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "https://www.synology.com/security/advisory/Synology_SA_19_33"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2692"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2745"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2746"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2775"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2799"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2925"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2939"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2949"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2955"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2966"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3041"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3932"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3933"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3935"
},
{
"type": "WEB",
"url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/605641"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10296"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3P6R-X275-5X98
Vulnerability from github – Published: 2026-08-06 12:31 – Updated: 2026-08-06 18:30An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
{
"affected": [],
"aliases": [
"CVE-2026-64958"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-06T11:16:30Z",
"severity": "HIGH"
},
"details": "An incomplete fix for\u00a0CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.",
"id": "GHSA-3p6r-x275-5x98",
"modified": "2026-08-06T18:30:44Z",
"published": "2026-08-06T12:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64958"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/trsnkxc2f21585zlt819blvchgl6oykb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3PCQ-34W5-P4G2
Vulnerability from github – Published: 2021-10-21 17:49 – Updated: 2022-08-15 20:14Impact
This is a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects.
Patches
The problem has been patched in 1.0.4.
Workarounds
There is no workaround aside from upgrading to 1.0.4.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "modern-async"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-41167"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2021-10-20T17:39:03Z",
"nvd_published_at": "2021-10-20T19:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThis is a bug affecting two of the functions in this library: `forEachSeries` and `forEachLimit`. They should limit the concurrency of some actions but, in practice, they don\u0027t. Any code calling these functions will be written thinking they would limit the concurrency but they won\u0027t. This could lead to potential security issues in other projects.\n\n### Patches\n\nThe problem has been patched in 1.0.4.\n\n### Workarounds\n\nThere is no workaround aside from upgrading to 1.0.4.\n",
"id": "GHSA-3pcq-34w5-p4g2",
"modified": "2022-08-15T20:14:42Z",
"published": "2021-10-21T17:49:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41167"
},
{
"type": "WEB",
"url": "https://github.com/nicolas-van/modern-async/issues/5"
},
{
"type": "WEB",
"url": "https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436"
},
{
"type": "PACKAGE",
"url": "https://github.com/nicolas-van/modern-async"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "modern-async\u0027s `forEachSeries` and `forEachLimit` functions do not limit the number of requests"
}
GHSA-3PJV-R7W4-2CF5
Vulnerability from github – Published: 2023-12-20 21:12 – Updated: 2023-12-21 15:53Impact
A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable.
Patches
Patches are available for Grails 3 and later.
Workarounds
No workaround is possible except to avoid data binding to request data.
References
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.grails:grails-databinding"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.1.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.grails:grails-databinding"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.grails:grails-databinding"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.grails:grails-databinding"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "3.3.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-46131"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-20T21:12:09Z",
"nvd_published_at": "2023-12-21T00:15:25Z",
"severity": "MODERATE"
},
"details": "### Impact\nA specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable.\n\n### Patches\nPatches are available for Grails 3 and later.\n\n### Workarounds\nNo workaround is possible except to avoid data binding to request data.\n\n### References\n\n- [Blog post](https://grails.org/blog/2023-12-20-cve-data-binding-dos.html)\n- [Discussion](https://github.com/grails/grails-core/issues/13302)\n- [Mitre CVD record](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46131)\n",
"id": "GHSA-3pjv-r7w4-2cf5",
"modified": "2023-12-21T15:53:49Z",
"published": "2023-12-20T21:12:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grails/grails-core/security/advisories/GHSA-3pjv-r7w4-2cf5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46131"
},
{
"type": "WEB",
"url": "https://github.com/grails/grails-core/issues/13302"
},
{
"type": "WEB",
"url": "https://github.com/grails/grails-core/commit/74326bdd2cf7dcb594092165e9464520f8366c60"
},
{
"type": "WEB",
"url": "https://github.com/grails/grails-core/commit/c401faaa6c24c021c758b95f72304a0e855a8db3"
},
{
"type": "PACKAGE",
"url": "https://github.com/grails/grails-core"
},
{
"type": "WEB",
"url": "https://grails.org/blog/2023-12-20-cve-data-binding-dos.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Grails data binding causes JVM crash and/or other denial of service"
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.