CWE-405
Allowed-with-ReviewAsymmetric Resource Consumption (Amplification)
Abstraction: Class · Status: Incomplete
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
115 vulnerabilities reference this CWE, most recent first.
GHSA-97XG-2MGM-R8GR
Vulnerability from github – Published: 2026-02-10 06:30 – Updated: 2026-02-10 06:30SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.
{
"affected": [],
"aliases": [
"CVE-2026-0485"
],
"database_specific": {
"cwe_ids": [
"CWE-405"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T04:16:01Z",
"severity": "HIGH"
},
"details": "SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.",
"id": "GHSA-97xg-2mgm-r8gr",
"modified": "2026-02-10T06:30:37Z",
"published": "2026-02-10T06:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0485"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3678282"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-99CQ-XR7G-H22W
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2023-08-16 15:30Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.
{
"affected": [],
"aliases": [
"CVE-2019-11479"
],
"database_specific": {
"cwe_ids": [
"CWE-405",
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-19T00:15:00Z",
"severity": "HIGH"
},
"details": "Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.",
"id": "GHSA-99cq-xr7g-h22w",
"modified": "2023-08-16T15:30:16Z",
"published": "2022-05-24T16:48:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11479"
},
{
"type": "WEB",
"url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-06"
},
{
"type": "WEB",
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-253-03"
},
{
"type": "WEB",
"url": "https://www.synology.com/security/advisory/Synology_SA_19_28"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/905115"
},
{
"type": "WEB",
"url": "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4041-2"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4041-1"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K35421172?utm_source=f5support\u0026amp;utm_medium=RSS"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K35421172"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190625-0001"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0008"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10287"
},
{
"type": "WEB",
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193"
},
{
"type": "WEB",
"url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=967c05aee439e6e5d7d805e195b3a20ef5c433d6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5f3e2bf008c2221478101ee72f5cb4654b9fc363"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/vulnerabilities/tcpsack"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1699"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1602"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1594"
},
{
"type": "WEB",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/06/28/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/07/06/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/07/06/4"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108818"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9MG4-VWMM-MMJ9
Vulnerability from github – Published: 2026-03-20 15:31 – Updated: 2026-03-23 15:30Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.
{
"affected": [],
"aliases": [
"CVE-2025-46598"
],
"database_specific": {
"cwe_ids": [
"CWE-405"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-20T15:16:15Z",
"severity": "MODERATE"
},
"details": "Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.",
"id": "GHSA-9mg4-vwmm-mmj9",
"modified": "2026-03-23T15:30:33Z",
"published": "2026-03-20T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46598"
},
{
"type": "WEB",
"url": "https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-46598"
},
{
"type": "WEB",
"url": "https://github.com/bitcoin/bitcoin/releases"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-C5X9-G76V-5JF9
Vulnerability from github – Published: 2026-02-10 06:30 – Updated: 2026-02-10 06:30SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable and resulting in the denial of service of the Content Management Server (CMS). Successful exploitation impacts system availability, while confidentiality and integrity remain unaffected.
{
"affected": [],
"aliases": [
"CVE-2026-24324"
],
"database_specific": {
"cwe_ids": [
"CWE-405"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T04:16:04Z",
"severity": "MODERATE"
},
"details": "SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable and resulting in the denial of service of the Content Management Server (CMS). Successful exploitation impacts system availability, while confidentiality and integrity remain unaffected.",
"id": "GHSA-c5x9-g76v-5jf9",
"modified": "2026-02-10T06:30:39Z",
"published": "2026-02-10T06:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24324"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3695912"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CRH2-6H8J-H25C
Vulnerability from github – Published: 2026-09-16 15:31 – Updated: 2026-09-16 15:31In a query response, an attacker may send named multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
{
"affected": [],
"aliases": [
"CVE-2026-75029"
],
"database_specific": {
"cwe_ids": [
"CWE-405"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T15:17:43Z",
"severity": "MODERATE"
},
"details": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.",
"id": "GHSA-crh2-6h8j-h25c",
"modified": "2026-09-16T15:31:13Z",
"published": "2026-09-16T15:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75029"
},
{
"type": "WEB",
"url": "https://downloads.isc.org/isc/bind9/9.20.29"
},
{
"type": "WEB",
"url": "https://downloads.isc.org/isc/bind9/9.21.26"
},
{
"type": "WEB",
"url": "https://kb.isc.org/docs/cve-2026-75029"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-F58G-HMV8-G97M
Vulnerability from github – Published: 2026-09-07 15:33 – Updated: 2026-09-07 15:33commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
{
"affected": [],
"aliases": [
"CVE-2026-86432"
],
"database_specific": {
"cwe_ids": [
"CWE-405"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-07T13:20:42Z",
"severity": "MODERATE"
},
"details": "commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.",
"id": "GHSA-f58g-hmv8-g97m",
"modified": "2026-09-07T15:33:53Z",
"published": "2026-09-07T15:33:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-mj63-m3rc-8ppr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86432"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/commonmark-2.0.0-before-2.8.4-denial-of-service-via-xml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F5CH-PQM5-5632
Vulnerability from github – Published: 2024-08-15 18:31 – Updated: 2024-08-15 18:31IBM InfoSphere Information Server could allow an authenticated user to consume file space resources due to unrestricted file uploads. IBM X-Force ID: 298279.
{
"affected": [],
"aliases": [
"CVE-2024-40705"
],
"database_specific": {
"cwe_ids": [
"CWE-405"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T17:15:17Z",
"severity": "MODERATE"
},
"details": "IBM InfoSphere Information Server could allow an authenticated user to consume file space resources due to unrestricted file uploads. IBM X-Force ID: 298279.",
"id": "GHSA-f5ch-pqm5-5632",
"modified": "2024-08-15T18:31:51Z",
"published": "2024-08-15T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40705"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/298279"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7160855"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F83F-XPX7-FFPW
Vulnerability from github – Published: 2025-12-05 18:18 – Updated: 2025-12-05 18:18Function identity.extractIssuerURL currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods.
As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)
Details See identity.extractIssuerURL
Impact Excessive memory allocation
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.8.2"
},
"package": {
"ecosystem": "Go",
"name": "github.com/sigstore/fulcio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66506"
],
"database_specific": {
"cwe_ids": [
"CWE-405"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-05T18:18:26Z",
"nvd_published_at": "2025-12-04T22:15:49Z",
"severity": "HIGH"
},
"details": "Function [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) its argument (which is untrusted data) on periods.\n\nAs a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to `extractIssuerURL` incurs allocations to the tune of O(n) bytes (where n stands for the length of the function\u0027s argument), with a constant factor of about 16. Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html)\n\nDetails\nSee [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45)\n\nImpact\nExcessive memory allocation",
"id": "GHSA-f83f-xpx7-ffpw",
"modified": "2025-12-05T18:18:26Z",
"published": "2025-12-05T18:18:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66506"
},
{
"type": "WEB",
"url": "https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a"
},
{
"type": "PACKAGE",
"url": "https://github.com/sigstore/fulcio"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Fulcio allocates excessive memory during token parsing"
}
GHSA-G2PG-6438-JWPF
Vulnerability from github – Published: 2026-01-15 22:15 – Updated: 2026-01-15 22:15Summary
Certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the ArrayBuffer hydration expecting base64 encoded strings as input, but not checking the assumption before decoding the input.
Details
The parser's ArrayBuffer hydration logic does not properly validate input before processing. Specially crafted inputs can cause disproportionate memory allocation or CPU usage on the receiving system.
Impact
This is a denial of service vulnerability affecting systems that use devalue.parse to handle data from potentially untrusted sources.
Affected systems should upgrade to patched versions immediately.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "devalue"
},
"ranges": [
{
"events": [
{
"introduced": "5.1.0"
},
{
"fixed": "5.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-22775"
],
"database_specific": {
"cwe_ids": [
"CWE-405"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-15T22:15:18Z",
"nvd_published_at": "2026-01-15T19:16:05Z",
"severity": "HIGH"
},
"details": "## Summary\n\nCertain inputs can cause `devalue.parse` to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using `devalue.parse` on externally-supplied data. The root cause is the `ArrayBuffer` hydration expecting base64 encoded strings as input, but not checking the assumption before decoding the input.\n\n## Details\n\nThe parser\u0027s `ArrayBuffer` hydration logic does not properly validate input before processing. Specially crafted inputs can cause disproportionate memory allocation or CPU usage on the receiving system.\n\n## Impact\n\nThis is a denial of service vulnerability affecting systems that use `devalue.parse` to handle data from potentially untrusted sources.\n\nAffected systems should upgrade to patched versions immediately.",
"id": "GHSA-g2pg-6438-jwpf",
"modified": "2026-01-15T22:15:18Z",
"published": "2026-01-15T22:15:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sveltejs/devalue/security/advisories/GHSA-g2pg-6438-jwpf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22775"
},
{
"type": "WEB",
"url": "https://github.com/sveltejs/devalue/commit/11755849fa0634ae294a15ec0aef2f43efcad7c4"
},
{
"type": "PACKAGE",
"url": "https://github.com/sveltejs/devalue"
},
{
"type": "WEB",
"url": "https://github.com/sveltejs/devalue/releases/tag/v5.6.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse"
}
GHSA-GQHX-WXJR-RPHX
Vulnerability from github – Published: 2023-06-26 21:30 – Updated: 2024-09-16 15:32An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
{
"affected": [],
"aliases": [
"CVE-2023-2992"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-405"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-26T20:15:09Z",
"severity": "HIGH"
},
"details": "An unauthenticated \u00a0denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.",
"id": "GHSA-gqhx-wxjr-rphx",
"modified": "2024-09-16T15:32:44Z",
"published": "2023-06-26T21:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2992"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-127357"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
An application must make resources available to a client commensurate with the client's access level.
Mitigation
An application must, at all times, keep track of allocated resources and meter their usage appropriately.
Mitigation
Consider disabling resource-intensive algorithms on the server side, such as Diffie-Hellman key exchange.
No CAPEC attack patterns related to this CWE.