CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5401 vulnerabilities reference this CWE, most recent first.
GHSA-XR7V-HJ32-MR4R
Vulnerability from github – Published: 2026-03-27 09:31 – Updated: 2026-06-30 03:36Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
{
"affected": [],
"aliases": [
"CVE-2026-27858"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-27T09:16:20Z",
"severity": "HIGH"
},
"details": "Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.\n Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.",
"id": "GHSA-xr7v-hj32-mr4r",
"modified": "2026-06-30T03:36:03Z",
"published": "2026-03-27T09:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27858"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27858.json"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452175"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-27858"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26564"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19455"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19453"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19364"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19149"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:18053"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17630"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17628"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17626"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17625"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17602"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13857"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13830"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13498"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XR94-CV8C-7R6V
Vulnerability from github – Published: 2024-01-12 09:30 – Updated: 2025-06-03 15:31Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.
{
"affected": [],
"aliases": [
"CVE-2023-34061"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-12T07:15:11Z",
"severity": "HIGH"
},
"details": "Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.",
"id": "GHSA-xr94-cv8c-7r6v",
"modified": "2025-06-03T15:31:15Z",
"published": "2024-01-12T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34061"
},
{
"type": "WEB",
"url": "https://www.cloudfoundry.org/blog/cve-2023-34061-gorouter-route-pruning"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XRHC-8RW6-G25J
Vulnerability from github – Published: 2025-12-08 18:30 – Updated: 2025-12-08 21:30In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2025-48590"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-08T17:16:16Z",
"severity": "MODERATE"
},
"details": "In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-xrhc-8rw6-g25j",
"modified": "2025-12-08T21:30:20Z",
"published": "2025-12-08T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48590"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/848f944921756467dba98069ea33531a2f180373"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2025-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XRMP-99WJ-P6JC
Vulnerability from github – Published: 2019-05-31 23:43 – Updated: 2021-08-04 21:21Versions of deap before 1.0.1 are vulnerable to prototype pollution.
Recommendation
Update to version 1.0.1 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "deap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2019-05-31T23:42:34Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Versions of `deap` before 1.0.1 are vulnerable to prototype pollution.\n\n\n## Recommendation\n\nUpdate to version 1.0.1 or later.",
"id": "GHSA-xrmp-99wj-p6jc",
"modified": "2021-08-04T21:21:43Z",
"published": "2019-05-31T23:43:09Z",
"references": [
{
"type": "WEB",
"url": "https://hackerone.com/reports/310446"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/npm:deap:20180415"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/611"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in deap"
}
GHSA-XRVJ-V92F-53GJ
Vulnerability from github – Published: 2026-06-08 23:43 – Updated: 2026-06-11 14:07Impact
An uncontrolled-resource-consumption (memory exhaustion) denial-of-service vulnerability (CWE-400 / CWE-789).
A client with push access could push a tiny crafted thin pack (~174 bytes) whose delta header declares a huge dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it would allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to the actual bytes received.
Who is impacted: Operators running a Dulwich-based Git server that exposes git-receive-pack (i.e. accepts pushes) - for example via dulwich.server functionality, the HTTP smart server, or anything built on ReceivePackHandler.
Patches
Patched in 1.2.5.
add_thin_pack now accepts a max_input_size keyword (bytes; 0/None = unlimited, matching git's semantics), and ReceivePackHandler reads receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a PackInputTooLarge exception is raised once the cap is exceeded - equivalent to git index-pack --max-input-size.
Users should upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in their server's repository config to a sane bound for their environment.
Workarounds
On unpatched versions, receive.maxInputSize has no effect, so it cannot be used as a workaround. Until upgrading, operators should:
- Restrict dulwich-receive-pack (push) access to trusted, authenticated clients only, or disable it entirely on servers that only need to serve fetches.
- Run the server under an OS-level memory limit (e.g. ulimit, cgroups/MemoryMax, or a container memory limit) so a malicious push is killed rather than taking down the host.
Resources
- git's receive.maxInputSize / git index-pack --max-input-size documentation
- Reported by Liyi, Ziyue, Strick, Maurice and Chenchen @ University of Sydney
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "dulwich"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.0"
},
{
"fixed": "1.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47734"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-789"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-08T23:43:42Z",
"nvd_published_at": "2026-06-10T23:16:48Z",
"severity": "MODERATE"
},
"details": "## Impact\n\nAn uncontrolled-resource-consumption (memory exhaustion) denial-of-service vulnerability (CWE-400 / CWE-789).\n\nA client with push access could push a tiny crafted thin pack (~174 bytes) whose delta header declares a huge dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it would allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to the actual bytes received.\n\nWho is impacted: Operators running a Dulwich-based Git server that exposes git-receive-pack (i.e. accepts pushes) -\nfor example via dulwich.server functionality, the HTTP smart server, or anything built on ReceivePackHandler. \n\n## Patches\n\nPatched in 1.2.5.\n\nadd_thin_pack now accepts a max_input_size keyword (bytes; 0/None = unlimited, matching git\u0027s semantics), and ReceivePackHandler reads receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a PackInputTooLarge exception is raised once the cap is exceeded - equivalent to git index-pack --max-input-size.\n\nUsers should upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in their server\u0027s repository config to a sane bound for their environment.\n\n## Workarounds\n\nOn unpatched versions, receive.maxInputSize has no effect, so it cannot be used as a workaround. Until upgrading, operators should:\n\n- Restrict dulwich-receive-pack (push) access to trusted, authenticated clients only, or disable it entirely on servers that only need to serve fetches.\n- Run the server under an OS-level memory limit (e.g. ulimit, cgroups/MemoryMax, or a container memory limit) so a malicious push is killed rather than taking down the host.\n\n## Resources\n\n- git\u0027s receive.maxInputSize / git index-pack --max-input-size documentation \n- Reported by Liyi, Ziyue, Strick, Maurice and Chenchen @ University of Sydney",
"id": "GHSA-xrvj-v92f-53gj",
"modified": "2026-06-11T14:07:18Z",
"published": "2026-06-08T23:43:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-xrvj-v92f-53gj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47734"
},
{
"type": "PACKAGE",
"url": "https://github.com/jelmer/dulwich"
},
{
"type": "WEB",
"url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Dulwich has unbounded memory allocation in receive-pack from crafted thin packs"
}
GHSA-XRVM-QCMP-42VC
Vulnerability from github – Published: 2023-02-06 21:30 – Updated: 2025-03-26 15:32An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.
{
"affected": [],
"aliases": [
"CVE-2022-42950"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-06T21:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.",
"id": "GHSA-xrvm-qcmp-42vc",
"modified": "2025-03-26T15:32:16Z",
"published": "2023-02-06T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42950"
},
{
"type": "WEB",
"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html"
},
{
"type": "WEB",
"url": "https://forums.couchbase.com/tags/security"
},
{
"type": "WEB",
"url": "https://www.couchbase.com/alerts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XRW6-GWF8-VVR9
Vulnerability from github – Published: 2026-04-08 19:52 – Updated: 2026-04-09 19:05Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that cause unhandled exceptions on the SynchronizationContext.
Patches
The vulnerabilities are fixed in version 0.92.0. For Tmds.DBus.Protocol, the fixes are also backported to 0.21.3.
Workarounds
There are no known workarounds. Users should upgrade to a patched version.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Tmds.DBus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.92.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Tmds.DBus.Protocol"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Tmds.DBus.Protocol"
},
"ranges": [
{
"events": [
{
"introduced": "0.22.0"
},
{
"fixed": "0.92.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-39959"
],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-08T19:52:58Z",
"nvd_published_at": "2026-04-09T17:16:30Z",
"severity": "HIGH"
},
"details": "Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that cause unhandled exceptions on the SynchronizationContext.\n\n### Patches\n\nThe vulnerabilities are fixed in version 0.92.0.\nFor Tmds.DBus.Protocol, the fixes are also backported to 0.21.3.\n\n### Workarounds\n\nThere are no known workarounds. Users should upgrade to a patched version.",
"id": "GHSA-xrw6-gwf8-vvr9",
"modified": "2026-04-09T19:05:46Z",
"published": "2026-04-08T19:52:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tmds/Tmds.DBus/security/advisories/GHSA-xrw6-gwf8-vvr9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39959"
},
{
"type": "PACKAGE",
"url": "https://github.com/tmds/Tmds.DBus"
},
{
"type": "WEB",
"url": "https://github.com/tmds/Tmds.DBus/releases/tag/rel%2F0.21.3"
},
{
"type": "WEB",
"url": "https://github.com/tmds/Tmds.DBus/releases/tag/rel%2F0.92.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service"
}
GHSA-XRX9-GJ26-5WX9
Vulnerability from github – Published: 2022-10-07 07:33 – Updated: 2022-10-07 07:33Impact
Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase(). The same issue happens with uppercase().
Patches
v1.5.1
References
huntr.dev report Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking
For more information
If you have any questions or comments about this advisory: * Open an issue in v8n issues list * Email us at brunodev02221@gmail.com
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "v8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-35923"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-07T07:33:44Z",
"nvd_published_at": "2022-08-02T20:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nInefficient regular expression complexity of `lowercase()` and `uppercase()` regex could lead to a denial of service attack. With a formed payload `\u0027a\u0027 + \u0027a\u0027.repeat(i) + \u0027A\u0027`, only 32 characters payload could take 29443 ms time execution when testing `lowercase()`. The same issue happens with `uppercase()`.\n\n### Patches\nv1.5.1\n\n### References\n[huntr.dev report](https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609)\n[_Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking_](https://snyk.io/blog/redos-and-catastrophic-backtracking/)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [v8n issues list](https://github.com/imbrn/v8n)\n* Email us at [brunodev02221@gmail.com](mailto:brunodev02221@gmail.com)\n",
"id": "GHSA-xrx9-gj26-5wx9",
"modified": "2022-10-07T07:33:44Z",
"published": "2022-10-07T07:33:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35923"
},
{
"type": "WEB",
"url": "https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9"
},
{
"type": "PACKAGE",
"url": "https://github.com/imbrn/v8n"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "v8n vulnerable to Inefficient Regular Expression Complexity"
}
GHSA-XV8V-5726-PQ4V
Vulnerability from github – Published: 2022-05-14 00:54 – Updated: 2024-02-15 18:30An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
{
"affected": [],
"aliases": [
"CVE-2018-20169"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-17T07:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.",
"id": "GHSA-xv8v-5726-pq4v",
"modified": "2024-02-15T18:30:39Z",
"published": "2022-05-14T00:54:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20169"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/704620afc70cf47abb9d6a1a57f3825d2bca49cf"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3309"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3517"
},
{
"type": "WEB",
"url": "https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.9"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3879-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3879-2"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4094-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4118-1"
},
{
"type": "WEB",
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=704620afc70cf47abb9d6a1a57f3825d2bca49cf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XVCR-5PXV-HXGC
Vulnerability from github – Published: 2022-05-14 01:00 – Updated: 2022-05-14 01:00An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.
{
"affected": [],
"aliases": [
"CVE-2018-5819"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-20T18:29:00Z",
"severity": "HIGH"
},
"details": "An error within the \"parse_sinar_ia()\" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.",
"id": "GHSA-xvcr-5pxv-hxgc",
"modified": "2022-05-14T01:00:54Z",
"published": "2022-05-14T01:00:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5819"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"
},
{
"type": "WEB",
"url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-27"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3989-1"
},
{
"type": "WEB",
"url": "https://www.libraw.org/news/libraw-0-19-2-release"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.