Common Weakness Enumeration
CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5531 vulnerabilities reference this CWE, most recent first.
CVE-2015-9242 (GCVE-0-2015-9242)
Vulnerability from cvelistv5 – Published: 2018-05-29 20:00 – Updated: 2024-09-17 03:12
VLAI
EPSS
VEX
Summary
Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.
Severity
No CVSS data available.
CWE
- CWE-400 - Denial of Service (CWE-400)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/jfhbrook/node-ecstatic/pull/179 | x_refsource_MISC |
| https://bugs.chromium.org/p/v8/issues/detail?id=4640 | x_refsource_MISC |
| https://nodesecurity.io/advisories/64 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | ecstatic node module |
Affected:
<1.4.0
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:42.598Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.chromium.org/p/v8/issues/detail?id=4640"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/64"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ecstatic node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c1.4.0"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-29T19:57:02.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.chromium.org/p/v8/issues/detail?id=4640"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/64"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2015-9242",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ecstatic node module",
"version": {
"version_data": [
{
"version_value": "\u003c1.4.0"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/jfhbrook/node-ecstatic/pull/179",
"refsource": "MISC",
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"name": "https://bugs.chromium.org/p/v8/issues/detail?id=4640",
"refsource": "MISC",
"url": "https://bugs.chromium.org/p/v8/issues/detail?id=4640"
},
{
"name": "https://nodesecurity.io/advisories/64",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/64"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2015-9242",
"datePublished": "2018-05-29T20:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:12:59.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9241 (GCVE-0-2015-9241)
Vulnerability from cvelistv5 – Published: 2018-05-29 20:00 – Updated: 2024-09-16 17:03
VLAI
EPSS
VEX
Summary
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Severity
No CVSS data available.
CWE
- CWE-400 - Denial of Service (CWE-400)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/jfhbrook/node-ecstatic/pull/179 | x_refsource_MISC |
| https://github.com/hapijs/hapi/commit/aab2496e930… | x_refsource_MISC |
| https://nodesecurity.io/advisories/63 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | hapi node module |
Affected:
<11.1.3
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:41.875Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/63"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hapi node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c11.1.3"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain input passed into the If-Modified-Since or Last-Modified headers will cause an \u0027illegal access\u0027 exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-29T19:57:02.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/63"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2015-9241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hapi node module",
"version": {
"version_data": [
{
"version_value": "\u003c11.1.3"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain input passed into the If-Modified-Since or Last-Modified headers will cause an \u0027illegal access\u0027 exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/jfhbrook/node-ecstatic/pull/179",
"refsource": "MISC",
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"name": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580"
},
{
"name": "https://nodesecurity.io/advisories/63",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/63"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2015-9241",
"datePublished": "2018-05-29T20:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:03:05.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9239 (GCVE-0-2015-9239)
Vulnerability from cvelistv5 – Published: 2018-05-31 20:00 – Updated: 2024-09-16 19:36
VLAI
EPSS
VEX
Summary
ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
Severity
No CVSS data available.
CWE
- CWE-400 - Denial of Service (CWE-400)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://nodesecurity.io/advisories/51 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | ansi2html node module |
Affected:
All versions
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:42.619Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/51"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ansi2html node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-31T19:57:01.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/51"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2015-9239",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ansi2html node module",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://nodesecurity.io/advisories/51",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/51"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2015-9239",
"datePublished": "2018-05-31T20:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:36:41.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-10064 (GCVE-0-2014-10064)
Vulnerability from cvelistv5 – Published: 2018-05-31 20:00 – Updated: 2024-09-17 00:36
VLAI
EPSS
VEX
Summary
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
Severity
No CVSS data available.
CWE
- CWE-400 - Denial of Service (CWE-400)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://nodesecurity.io/advisories/28 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | qs node module |
Affected:
<1.0.0
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:02:38.236Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/28"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "qs node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c1.0.0"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-31T19:57:01.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/28"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2014-10064",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "qs node module",
"version": {
"version_data": [
{
"version_value": "\u003c1.0.0"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://nodesecurity.io/advisories/28",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/28"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2014-10064",
"datePublished": "2018-05-31T20:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:36:04.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-5418 (GCVE-0-2014-5418)
Vulnerability from cvelistv5 – Published: 2015-01-17 02:00 – Updated: 2025-11-04 23:30
VLAI
EPSS
VEX
Title
GE Multilink Uncontrolled Resource Consumption
Summary
GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets.
Severity
No CVSS data available.
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | |
| http://www.gedigitalenergy.com/products/support/m… | x_refsource_CONFIRM |
| https://github.com/cisagov/CSAF/blob/develop/csaf… | |
| https://ics-cert.us-cert.gov/advisories/ICSA-15-013-04 | x_refsource_MISCx_transferred |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE | Multilink ML800/1200/1600/2400 |
Affected:
0 , ≤ 4.2.1
(custom)
|
|
| GE | ML810/3000/3100 series switch |
Affected:
0 , ≤ 5.2.0
(custom)
|
Date Public
2015-01-13 07:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:41:49.173Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-013-04"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Multilink ML800/1200/1600/2400",
"vendor": "GE",
"versions": [
{
"lessThanOrEqual": "4.2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ML810/3000/3100 series switch",
"vendor": "GE",
"versions": [
{
"lessThanOrEqual": "5.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eireann Leverett of IOActive"
}
],
"datePublic": "2015-01-13T07:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets.\u003c/p\u003e"
}
],
"value": "GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets."
}
],
"metrics": [
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T23:30:32.557Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-04a"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-013-04a.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGE recommends users update switch firmware to the \nlatest published version to resolve these vulnerabilities. The new \nfirmware will enable new keys to be calculated and exchanged, resolve \nthe slow data transfer and potential denial of service, and prevent the identified \ncross-site scripting vulnerabilities. The latest firmware is Version \n5.3.2 for the ML800, ML1200, ML1600 and ML2400 and Version 5.3.2-3K for \nthe ML810, ML3000, and ML3100. This firmware is available through the \n\u201cResources/Software\u201d link in the product web sites at \n\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.gedigitalenergy.com\"\u003ehttp://www.gedigitalenergy.com\u003c/a\u003e. This firmware is also available through \nthe EnerVista Launchpad device management tool.\u003c/p\u003e\n\u003cp\u003eGE recommends updating the switch over a serial connection to prevent an attacker from capturing the new key.\u003c/p\u003e\n\u003cp\u003ePlease refer to the GE advisory for specific information on how to \ninstall the firmware and change RSA key. The GE advisory is available \nat:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.gedigitalenergy.com/products/support/multilink/MLSB0415.pdf\"\u003ehttps://www.gedigitalenergy.com/products/support/multilink/MLSB0415.pdf\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "GE recommends users update switch firmware to the \nlatest published version to resolve these vulnerabilities. The new \nfirmware will enable new keys to be calculated and exchanged, resolve \nthe slow data transfer and potential denial of service, and prevent the identified \ncross-site scripting vulnerabilities. The latest firmware is Version \n5.3.2 for the ML800, ML1200, ML1600 and ML2400 and Version 5.3.2-3K for \nthe ML810, ML3000, and ML3100. This firmware is available through the \n\u201cResources/Software\u201d link in the product web sites at \n http://www.gedigitalenergy.com . This firmware is also available through \nthe EnerVista Launchpad device management tool.\n\n\nGE recommends updating the switch over a serial connection to prevent an attacker from capturing the new key.\n\n\nPlease refer to the GE advisory for specific information on how to \ninstall the firmware and change RSA key. The GE advisory is available \nat:\n\n\n https://www.gedigitalenergy.com/products/support/multilink/MLSB0415.pdf"
}
],
"source": {
"advisory": "ICSA-15-013-04",
"discovery": "EXTERNAL"
},
"title": "GE Multilink Uncontrolled Resource Consumption",
"x_generator": {
"engine": "Vulnogram 0.5.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2014-5418",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-15-013-04",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-013-04"
},
{
"name": "http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf",
"refsource": "CONFIRM",
"url": "http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2014-5418",
"datePublished": "2015-01-17T02:00:00.000Z",
"dateReserved": "2014-08-22T00:00:00.000Z",
"dateUpdated": "2025-11-04T23:30:32.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2014-3648 (GCVE-0-2014-3648)
Vulnerability from cvelistv5 – Published: 2022-07-01 13:16 – Updated: 2024-08-06 10:50
VLAI
EPSS
VEX
Summary
The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached or can slow the server down by purposefully wasting it's time with slow endpoints. Similarly, one can provide whatever HTTP end point they want. This turns the server into a DDOS vector or an anonymizer for the posting of malware and so on.
Severity
No CVSS data available.
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://issues.redhat.com/browse/AEROGEAR-6091 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Jboss Aerogear |
Affected:
Jboss Aerogear 1.0.0.final
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:50:18.312Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://issues.redhat.com/browse/AEROGEAR-6091"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Jboss Aerogear",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Jboss Aerogear 1.0.0.final"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can\u0027t be reached or can slow the server down by purposefully wasting it\u0027s time with slow endpoints. Similarly, one can provide whatever HTTP end point they want. This turns the server into a DDOS vector or an anonymizer for the posting of malware and so on."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-01T13:16:16.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://issues.redhat.com/browse/AEROGEAR-6091"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-3648",
"datePublished": "2022-07-01T13:16:16.000Z",
"dateReserved": "2014-05-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T10:50:18.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2343 (GCVE-0-2014-2343)
Vulnerability from cvelistv5 – Published: 2014-05-30 23:00 – Updated: 2025-10-02 22:19
VLAI
EPSS
VEX
Title
Triangle MicroWorks SCADA Data Gateway Resource Exhaustion
Summary
Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service (excessive data processing) via a crafted DNP request over a serial line.
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.trianglemicroworks.com/products/scada-… | x_refsource_MISC |
| https://www.cisa.gov/news-events/ics-advisories/i… | |
| http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01 | x_refsource_MISCx_transferred |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Triangle MicroWorks | SCADA Data Gateway |
Affected:
0 , < v3.00.0635
(custom)
|
Date Public
2014-05-29 06:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.054Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SCADA Data Gateway",
"vendor": "Triangle MicroWorks",
"versions": [
{
"lessThan": "v3.00.0635",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Crain of Automatak and Chris Sistrunk of Mandiant"
}
],
"datePublic": "2014-05-29T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\nTriangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service (excessive data processing) via a crafted DNP request over a serial line.\n\n\u003c/p\u003e"
}
],
"value": "Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service (excessive data processing) via a crafted DNP request over a serial line."
}
],
"metrics": [
{
"cvssV2_0": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 1.2,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:H/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-02T22:19:28.957Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTriangle MicroWorks has produced an update and release notes describing the mitigation. Please contact Triangle MicroWorks Support for details on specific platform updates here:\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.trianglemicroworks.com/SupportPage.htm\"\u003ehttp://www.trianglemicroworks.com/SupportPage.htm\u003c/a\u003e\u003c/p\u003e\u003cp\u003eRelease notes are found here:\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new\"\u003ehttp://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new\u003c/a\u003e\u003c/p\u003e\u003cp\u003eTriangle MicroWorks recommends following the International Electrotechnical Commission (IEC) Technical Specification TS 62351 to reduce the risk from vulnerability. More information on recommended implementation practices for Triangle MicroWorks products is available by contacting your product representative.\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Triangle MicroWorks has produced an update and release notes describing the mitigation. Please contact Triangle MicroWorks Support for details on specific platform updates here:\n\n http://www.trianglemicroworks.com/SupportPage.htm \n\nRelease notes are found here:\n\n http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new \n\nTriangle MicroWorks recommends following the International Electrotechnical Commission (IEC) Technical Specification TS 62351 to reduce the risk from vulnerability. More information on recommended implementation practices for Triangle MicroWorks products is available by contacting your product representative."
}
],
"source": {
"advisory": "ICSA-14-149-01",
"discovery": "EXTERNAL"
},
"title": "Triangle MicroWorks SCADA Data Gateway Resource Exhaustion",
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2014-2342",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new",
"refsource": "MISC",
"url": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new"
},
{
"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01",
"refsource": "MISC",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2014-2343",
"datePublished": "2014-05-30T23:00:00.000Z",
"dateReserved": "2014-03-13T00:00:00.000Z",
"dateUpdated": "2025-10-02T22:19:28.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2342 (GCVE-0-2014-2342)
Vulnerability from cvelistv5 – Published: 2014-05-30 23:00 – Updated: 2025-10-02 22:17
VLAI
EPSS
VEX
Title
Triangle MicroWorks SCADA Data Gateway Resource Exhaustion
Summary
Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.trianglemicroworks.com/products/scada-… | x_refsource_MISC |
| https://www.cisa.gov/news-events/ics-advisories/i… | |
| http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01 | x_refsource_MISCx_transferred |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Triangle MicroWorks | SCADA Data Gateway |
Affected:
0 , < v3.00.0635
(custom)
|
Date Public
2014-05-29 06:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.053Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SCADA Data Gateway",
"vendor": "Triangle MicroWorks",
"versions": [
{
"lessThan": "v3.00.0635",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Crain of Automatak and Chris Sistrunk of Mandiant"
}
],
"datePublic": "2014-05-29T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTriangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.\u003c/p\u003e"
}
],
"value": "Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet."
}
],
"metrics": [
{
"cvssV2_0": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-02T22:17:05.858Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTriangle MicroWorks has produced an update and release notes describing the mitigation. Please contact Triangle MicroWorks Support for details on specific platform updates here:\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.trianglemicroworks.com/SupportPage.htm\"\u003ehttp://www.trianglemicroworks.com/SupportPage.htm\u003c/a\u003e\u003c/p\u003e\u003cp\u003eRelease notes are found here:\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new\"\u003ehttp://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new\u003c/a\u003e\u003c/p\u003e\u003cp\u003eTriangle MicroWorks recommends following the International Electrotechnical Commission (IEC) Technical Specification TS 62351 to reduce the risk from vulnerability. More information on recommended implementation practices for Triangle MicroWorks products is available by contacting your product representative.\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Triangle MicroWorks has produced an update and release notes describing the mitigation. Please contact Triangle MicroWorks Support for details on specific platform updates here:\n\n http://www.trianglemicroworks.com/SupportPage.htm \n\nRelease notes are found here:\n\n http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new \n\nTriangle MicroWorks recommends following the International Electrotechnical Commission (IEC) Technical Specification TS 62351 to reduce the risk from vulnerability. More information on recommended implementation practices for Triangle MicroWorks products is available by contacting your product representative."
}
],
"source": {
"advisory": "ICSA-14-149-01",
"discovery": "EXTERNAL"
},
"title": "Triangle MicroWorks SCADA Data Gateway Resource Exhaustion",
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2014-2342",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new",
"refsource": "MISC",
"url": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new"
},
{
"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01",
"refsource": "MISC",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2014-2342",
"datePublished": "2014-05-30T23:00:00.000Z",
"dateReserved": "2014-03-13T00:00:00.000Z",
"dateUpdated": "2025-10-02T22:17:05.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GHSA-224F-WM46-5P4R
Vulnerability from github – Published: 2026-02-13 18:31 – Updated: 2026-02-13 21:31
VLAI
Details
An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.
Severity
6.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-66676"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-13T18:16:17Z",
"severity": "MODERATE"
},
"details": "An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.",
"id": "GHSA-224f-wm46-5p4r",
"modified": "2026-02-13T21:31:36Z",
"published": "2026-02-13T18:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66676"
},
{
"type": "WEB",
"url": "https://github.com/cwjchoi01/CVE-2025-66676"
},
{
"type": "WEB",
"url": "https://www.iobit.com/en/iobit-unlocker.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-224P-V68G-5G8F
Vulnerability from github – Published: 2025-08-26 18:45 – Updated: 2025-08-26 18:45
VLAI
Summary
GraphQL Armor Max-Depth Plugin Bypass via fragment caching
Details
Summary
A query depth restriction using the max-depth can be bypassed if ignoreIntrospection is enabled (which is the default configuration) by naming your query/fragment __schema.
Details
In the countDepth function, we have the following code that calculates the depth of a used fragment:
} else if (node.kind == Kind.FRAGMENT_SPREAD) {
if (this.visitedFragments.has(node.name.value)) {
return this.visitedFragments.get(node.name.value) ?? 0;
} else {
this.visitedFragments.set(node.name.value, -1);
}
const fragment = this.context.getFragment(node.name.value);
if (fragment) {
let fragmentDepth;
if (this.config.flattenFragments) {
fragmentDepth = this.countDepth(fragment, parentDepth);
} else {
fragmentDepth = this.countDepth(fragment, parentDepth + 1);
}
depth = Math.max(depth, fragmentDepth);
if (this.visitedFragments.get(node.name.value) === -1) {
this.visitedFragments.set(node.name.value, fragmentDepth);
}
}
}
which will calculate the depth of the fragment used in the current node, store the value in this.visitedFragments and re-use it in the future to avoid re-calculating the depth for the same fragment.
The issue arises when the same fragment is used multiple times, at different depths. The current caching takes into account the depth of the first occurrence, which means if the fragment is re-used later in a higher depth, this cached value is not updated.
So, for example, sending the following query with a max depth of 6:
query {
books {
author {
...Test
}
}
books {
author {
books {
author {
...Test
}
}
}
}
}
fragment Test on Author {
books {
title
}
}
The first use of Test fragment does not exceed the defined limit, and this depth will be cached.
In the second use, the fragment is reused in a greater depth, but the countDepth function will still use the depth cached, without accounting for the increased depth.
PoC
Max depth: 6
query {
books {
author {
...Test
}
}
books {
author {
books {
author {
...Test
}
}
}
}
}
fragment Test on Author {
books {
title
}
}
Impact
This issue affects applications using the GraphQL Armor Depth Limit plugin.
Fix
This is fixed in PR#824. We now store only the additional depth contributed by the fragment and add it to the parent depth where the fragment is used (parentDepth).
Severity
5.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.4.1"
},
"package": {
"ecosystem": "npm",
"name": "@escape.tech/graphql-armor-max-depth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-26T18:45:55Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nA query depth restriction using the max-depth can be bypassed if `ignoreIntrospection` is enabled (which is the default configuration) by naming your query/fragment `__schema`.\n\n### Details\nIn the `countDepth` function, we have the following code that calculates the depth of a used fragment:\n\n```typescript\n } else if (node.kind == Kind.FRAGMENT_SPREAD) {\n if (this.visitedFragments.has(node.name.value)) {\n return this.visitedFragments.get(node.name.value) ?? 0;\n } else {\n this.visitedFragments.set(node.name.value, -1);\n }\n const fragment = this.context.getFragment(node.name.value);\n if (fragment) {\n let fragmentDepth;\n if (this.config.flattenFragments) {\n fragmentDepth = this.countDepth(fragment, parentDepth);\n } else {\n fragmentDepth = this.countDepth(fragment, parentDepth + 1);\n }\n depth = Math.max(depth, fragmentDepth);\n if (this.visitedFragments.get(node.name.value) === -1) {\n this.visitedFragments.set(node.name.value, fragmentDepth);\n }\n }\n }\n```\n\nwhich will calculate the depth of the fragment used in the current node, store the value in `this.visitedFragments` and re-use it in the future to avoid re-calculating the depth for the same fragment.\n\nThe issue arises when the same fragment is used multiple times, **at different depths**. The current caching takes into account the depth of the first occurrence, which means if the fragment is re-used later in a higher depth, this cached value is not updated.\n\nSo, for example, sending the following query with a max depth of `6`:\n\n```graphql\nquery {\n books {\n author {\n ...Test\n }\n }\n books {\n author {\n books {\n author {\n ...Test\n }\n }\n }\n }\n}\nfragment Test on Author {\n books {\n title\n }\n}\n```\n\nThe first use of `Test` fragment does not exceed the defined limit, and this depth will be cached.\n\nIn the second use, the fragment is reused in a greater depth, but the `countDepth` function will still use the depth cached, without accounting for the increased depth.\n\n### PoC\n\nMax depth: `6`\n\n```graphql\nquery {\n books {\n author {\n ...Test\n }\n }\n books {\n author {\n books {\n author {\n ...Test\n }\n }\n }\n }\n}\nfragment Test on Author {\n books {\n title\n }\n}\n```\n\n### Impact\n\nThis issue affects applications using the GraphQL Armor Depth Limit plugin.\n\n### Fix\n\nThis is fixed in [PR#824](https://github.com/Escape-Technologies/graphql-armor/pull/824). We now store only the additional depth contributed by the fragment and add it to the parent depth where the fragment is used (`parentDepth`).",
"id": "GHSA-224p-v68g-5g8f",
"modified": "2025-08-26T18:45:55Z",
"published": "2025-08-26T18:45:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Escape-Technologies/graphql-armor/security/advisories/GHSA-224p-v68g-5g8f"
},
{
"type": "WEB",
"url": "https://github.com/Escape-Technologies/graphql-armor/pull/824"
},
{
"type": "WEB",
"url": "https://github.com/Escape-Technologies/graphql-armor/commit/998986109f8c2313bd61325ddfe7f5dcd48f9232"
},
{
"type": "PACKAGE",
"url": "https://github.com/Escape-Technologies/graphql-armor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "GraphQL Armor Max-Depth Plugin Bypass via fragment caching"
}
Mitigation
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
Architecture and Design
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Implementation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.