CWE-1050
AllowedExcessive Platform Resource Consumption within a Loop
Abstraction: Base · Status: Incomplete
The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
24 vulnerabilities reference this CWE, most recent first.
GHSA-H4WV-G838-66G3
Vulnerability from github – Published: 2026-04-02 15:31 – Updated: 2026-04-04 06:00A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.5.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-4634"
],
"database_specific": {
"cwe_ids": [
"CWE-1050"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-04T06:00:47Z",
"nvd_published_at": "2026-04-02T13:16:27Z",
"severity": "HIGH"
},
"details": "A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.",
"id": "GHSA-h4wv-g838-66g3",
"modified": "2026-04-04T06:00:47Z",
"published": "2026-04-02T15:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4634"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/47716"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/b455ee4f28abb6f2120aff72fd179589cc5267a0"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6475"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6476"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6477"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6478"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-4634"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450250"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Keycloak: Application-Level DoS via Scope Processing"
}
GHSA-M2Q5-XHQG-92R2
Vulnerability from github – Published: 2026-01-05 21:30 – Updated: 2026-01-05 23:15A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@evershop/evershop"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-67419"
],
"database_specific": {
"cwe_ids": [
"CWE-1050"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-05T23:15:20Z",
"nvd_published_at": "2026-01-05T20:16:03Z",
"severity": "HIGH"
},
"details": "A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server\u0027s resources via the \"GET /images\" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.",
"id": "GHSA-m2q5-xhqg-92r2",
"modified": "2026-01-05T23:15:20Z",
"published": "2026-01-05T21:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67419"
},
{
"type": "WEB",
"url": "https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2025-67419"
},
{
"type": "PACKAGE",
"url": "https://github.com/evershopcommerce/evershop"
},
{
"type": "WEB",
"url": "https://pages.dos-m0nk3y.com/blog/EverShop%202.1.0%20-%20Unauthenticated%20DoS/#denial-of-service-dos-cve-2025-67419"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "evershop allows unauthenticated attackers to exhaust application server\u0027s resources via \"GET /images\" API"
}
GHSA-WXC4-F4M6-WWQV
Vulnerability from github – Published: 2021-12-20 16:55 – Updated: 2023-02-09 17:45The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "gopkg.in/yaml.v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-yaml/yaml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-11254"
],
"database_specific": {
"cwe_ids": [
"CWE-1050"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-07T17:24:04Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.",
"id": "GHSA-wxc4-f4m6-wwqv",
"modified": "2023-02-09T17:45:10Z",
"published": "2021-12-20T16:55:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11254"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/89535"
},
{
"type": "WEB",
"url": "https://github.com/go-yaml/yaml/pull/555"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/pull/87467/commits/b86df2bec4f377afc0ca03482ffad2f0a49a83b8"
},
{
"type": "WEB",
"url": "https://github.com/go-yaml/yaml/commit/53403b58ad1b561927d19068c655246f2db79d48"
},
{
"type": "WEB",
"url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18496"
},
{
"type": "WEB",
"url": "https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2020-0036"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200413-0003"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Excessive Platform Resource Consumption within a Loop in Kubernetes"
}
GHSA-X4GP-83HC-J86G
Vulnerability from github – Published: 2026-08-28 12:30 – Updated: 2026-08-28 12:30Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover files increase disk consumption. Both can cause degradation of service for mail delivery. Monitor system for abnormal CPU usage and disk consumption. Update to non-vulnerable version. No publicly available exploits are known.
{
"affected": [],
"aliases": [
"CVE-2026-52681"
],
"database_specific": {
"cwe_ids": [
"CWE-1050"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-28T12:16:30Z",
"severity": "LOW"
},
"details": "Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover files increase disk consumption. Both can cause degradation of service for mail delivery. Monitor system for abnormal CPU usage and disk consumption. Update to non-vulnerable version. No publicly available exploits are known.",
"id": "GHSA-x4gp-83hc-j86g",
"modified": "2026-08-28T12:30:25Z",
"published": "2026-08-28T12:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52681"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.