CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5531 vulnerabilities reference this CWE, most recent first.
GHSA-238J-PXJV-RH2P
Vulnerability from github – Published: 2023-04-05 21:30 – Updated: 2023-04-12 21:30Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.
{
"affected": [],
"aliases": [
"CVE-2023-28342"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-05T19:15:00Z",
"severity": "HIGH"
},
"details": "Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.",
"id": "GHSA-238j-pxjv-rh2p",
"modified": "2023-04-12T21:30:20Z",
"published": "2023-04-05T21:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28342"
},
{
"type": "WEB",
"url": "https://manageengine.com"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/self-service-password/advisory/CVE-2023-28342.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-23CV-JH4V-VFFM
Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2022-07-07 23:10A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.All"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.1.0"
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0"
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.Http.Connections"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-0602"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-07T23:10:46Z",
"nvd_published_at": "2020-01-14T23:15:00Z",
"severity": "MODERATE"
},
"details": "A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka \u0027ASP.NET Core Denial of Service Vulnerability\u0027.",
"id": "GHSA-23cv-jh4v-vffm",
"modified": "2022-07-07T23:10:46Z",
"published": "2022-05-24T17:06:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0602"
},
{
"type": "WEB",
"url": "https://github.com/aspnet/Announcements/issues/402"
},
{
"type": "WEB",
"url": "https://github.com/github/advisory-database/issues/302"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0130"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0134"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0602"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Denial of service in ASP.NET Core"
}
GHSA-23FF-WFV3-XRVG
Vulnerability from github – Published: 2024-11-25 18:33 – Updated: 2025-07-23 21:36There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.
{
"affected": [],
"aliases": [
"CVE-2024-11498"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-25T14:15:06Z",
"severity": "MODERATE"
},
"details": "There exists a stack buffer overflow in libjxl.\u00a0A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit\u00a065fbec56bc578b6b6ee02a527be70787bbd053b0.",
"id": "GHSA-23ff-wfv3-xrvg",
"modified": "2025-07-23T21:36:43Z",
"published": "2024-11-25T18:33:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11498"
},
{
"type": "WEB",
"url": "https://github.com/libjxl/libjxl/pull/3943"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-23FP-FMRV-F5PX
Vulnerability from github – Published: 2021-12-10 17:22 – Updated: 2023-11-27 21:11A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.0-beta.18.3"
},
"package": {
"ecosystem": "npm",
"name": "strapi-admin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0-beta.18.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-8123"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2021-03-30T13:53:18Z",
"nvd_published_at": "2020-02-04T20:15:00Z",
"severity": "MODERATE"
},
"details": "A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.",
"id": "GHSA-23fp-fmrv-f5px",
"modified": "2023-11-27T21:11:47Z",
"published": "2021-12-10T17:22:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8123"
},
{
"type": "WEB",
"url": "https://github.com/strapi/strapi/commit/c0c191c08f05fe10d7a6b1bf9475c1a651a89362"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/768574"
},
{
"type": "PACKAGE",
"url": "https://github.com/strapi/strapi"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncontrolled Resource Consumption in strapi"
}
GHSA-23HF-JHWW-867G
Vulnerability from github – Published: 2022-05-13 01:24 – Updated: 2022-05-13 01:24The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call.
{
"affected": [],
"aliases": [
"CVE-2011-2491"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-03-01T12:37:00Z",
"severity": "MODERATE"
},
"details": "The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call.",
"id": "GHSA-23hf-jhww-867g",
"modified": "2022-05-13T01:24:47Z",
"published": "2022-05-13T01:24:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2491"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/0b760113a3a155269a3fba93a409c640031dd68f"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=709393"
},
{
"type": "WEB",
"url": "http://ftp.osuosl.org/pub/linux/kernel/v3.0/ChangeLog-3.0"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0b760113a3a155269a3fba93a409c640031dd68f"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0b760113a3a155269a3fba93a409c640031dd68f"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2011-1212.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2011/06/23/6"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-23JV-8GF4-7R88
Vulnerability from github – Published: 2026-06-03 00:30 – Updated: 2026-06-03 00:30A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.
{
"affected": [],
"aliases": [
"CVE-2026-10650"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-02T22:16:16Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.",
"id": "GHSA-23jv-8gf4-7r88",
"modified": "2026-06-03T00:30:25Z",
"published": "2026-06-03T00:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10650"
},
{
"type": "WEB",
"url": "https://github.com/warmcat/libwebsockets/commit/3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498"
},
{
"type": "WEB",
"url": "https://github.com/biniamf/pocs/blob/main/libwebsockets_sshd-parse-ic-unbounded-alloc/poc_sshd_unbounded_alloc.py"
},
{
"type": "WEB",
"url": "https://github.com/biniamf/pocs/tree/main/libwebsockets_sshd-parse-ic-unbounded-alloc"
},
{
"type": "WEB",
"url": "https://github.com/warmcat/libwebsockets"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-10650"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/830261"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367955"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367955/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-23JV-V6QJ-3FHH
Vulnerability from github – Published: 2021-05-18 18:19 – Updated: 2023-09-29 15:52HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.
Specific Go Packages Affected
github.com/hashicorp/consul/agent/consul
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7219"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-13T15:07:53Z",
"nvd_published_at": "2020-01-31T13:15:00Z",
"severity": "HIGH"
},
"details": "HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.\n\n### Specific Go Packages Affected\ngithub.com/hashicorp/consul/agent/consul",
"id": "GHSA-23jv-v6qj-3fhh",
"modified": "2023-09-29T15:52:57Z",
"published": "2021-05-18T18:19:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7219"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/consul/issues/7159"
},
{
"type": "WEB",
"url": "https://www.hashicorp.com/blog/category/consul"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Denial of Service (DoS) in HashiCorp Consul"
}
GHSA-23X8-G5MH-PHMC
Vulnerability from github – Published: 2024-05-20 12:30 – Updated: 2026-05-12 12:31In the Linux kernel, the following vulnerability has been resolved:
HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already has its own locking for that.
More importantly, this flag can cause a lock-up: if the flag is set in i2c_hid_xfer() and an interrupt happens, the interrupt handler (i2c_hid_irq) will check this flag and return immediately without doing anything, then the interrupt handler will be invoked again in an infinite loop.
Since interrupt handler is an RT task, it takes over the CPU and the flag-clearing task never gets scheduled, thus we have a lock-up.
Delete this unnecessary flag.
{
"affected": [],
"aliases": [
"CVE-2024-35997"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-20T10:15:13Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up\n\nThe flag I2C_HID_READ_PENDING is used to serialize I2C operations.\nHowever, this is not necessary, because I2C core already has its own\nlocking for that.\n\nMore importantly, this flag can cause a lock-up: if the flag is set in\ni2c_hid_xfer() and an interrupt happens, the interrupt handler\n(i2c_hid_irq) will check this flag and return immediately without doing\nanything, then the interrupt handler will be invoked again in an\ninfinite loop.\n\nSince interrupt handler is an RT task, it takes over the CPU and the\nflag-clearing task never gets scheduled, thus we have a lock-up.\n\nDelete this unnecessary flag.",
"id": "GHSA-23x8-g5mh-phmc",
"modified": "2026-05-12T12:31:52Z",
"published": "2024-05-20T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35997"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0561b65fbd53d3e788c5b0222d9112ca016fd6a1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/21bfca822cfc1e71796124e93b46e0d9fa584401"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/29e94f295bad5be59cf4271a93e22cdcf5536722"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/418c5575d56410c6e186ab727bf32ae32447d497"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5095b93021b899f54c9355bebf36d78854c33a22"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b65fb50e04a95eec34a9d1bc138454a98a5578d8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c448a9fd50f77e8fb9156ff64848aa4295eb3003"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2457-2263-MM9F
Vulnerability from github – Published: 2022-01-21 23:19 – Updated: 2022-01-19 19:56Impact
Sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state.
Patches
The problem is patched in Micronaut 3.2.7 and above.
Workarounds
The default content type binder can be replaced in an existing Micronaut application to mitigate the issue:
package example;
import java.util.List;
import io.micronaut.context.annotation.Replaces;
import io.micronaut.core.convert.ConversionService;
import io.micronaut.http.MediaType;
import io.micronaut.http.bind.DefaultRequestBinderRegistry;
import io.micronaut.http.bind.binders.RequestArgumentBinder;
import jakarta.inject.Singleton;
@Singleton
@Replaces(DefaultRequestBinderRegistry.class)
class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry {
public FixedRequestBinderRegistry(ConversionService conversionService,
List<RequestArgumentBinder> binders) {
super(conversionService, binders);
}
@Override
protected void registerDefaultConverters(ConversionService<?> conversionService) {
super.registerDefaultConverters(conversionService);
conversionService.addConverter(CharSequence.class, MediaType.class, charSequence -> {
try {
return MediaType.of(charSequence);
} catch (IllegalArgumentException e) {
return null;
}
});
}
}
References
Commit that introduced the vulnerability https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3
For more information
If you have any questions or comments about this advisory:
- Open an issue in Micronaut Core
- Email us at info@micronaut.io
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.micronaut:micronaut-http"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-21700"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-19T19:56:29Z",
"nvd_published_at": "2022-01-18T23:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nSending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously used in static state.\n\n### Patches\n\nThe problem is patched in Micronaut 3.2.7 and above.\n\n### Workarounds\n\nThe default content type binder can be replaced in an existing Micronaut application to mitigate the issue:\n\n```java\npackage example;\n\nimport java.util.List;\nimport io.micronaut.context.annotation.Replaces;\nimport io.micronaut.core.convert.ConversionService;\nimport io.micronaut.http.MediaType;\nimport io.micronaut.http.bind.DefaultRequestBinderRegistry;\nimport io.micronaut.http.bind.binders.RequestArgumentBinder;\nimport jakarta.inject.Singleton;\n\n@Singleton\n@Replaces(DefaultRequestBinderRegistry.class)\nclass FixedRequestBinderRegistry extends DefaultRequestBinderRegistry {\n\n public FixedRequestBinderRegistry(ConversionService conversionService,\n List\u003cRequestArgumentBinder\u003e binders) {\n super(conversionService, binders);\n }\n\n @Override\n protected void registerDefaultConverters(ConversionService\u003c?\u003e conversionService) {\n super.registerDefaultConverters(conversionService);\n conversionService.addConverter(CharSequence.class, MediaType.class, charSequence -\u003e {\n try {\n return MediaType.of(charSequence);\n } catch (IllegalArgumentException e) {\n return null;\n }\n });\n }\n}\n```\n\n### References\n\nCommit that introduced the vulnerability https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [Micronaut Core](https://github.com/micronaut-projects/micronaut-core/issues)\n* Email us at [info@micronaut.io](mailto:info@micronaut.io)\n",
"id": "GHSA-2457-2263-mm9f",
"modified": "2022-01-19T19:56:29Z",
"published": "2022-01-21T23:19:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-2457-2263-mm9f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21700"
},
{
"type": "WEB",
"url": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3"
},
{
"type": "WEB",
"url": "https://github.com/micronaut-projects/micronaut-core"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Memory leak in micronaut-core"
}
GHSA-2467-JR62-J23F
Vulnerability from github – Published: 2025-06-19 21:31 – Updated: 2025-06-19 21:31A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.
{
"affected": [],
"aliases": [
"CVE-2025-6274"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-19T19:15:22Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect \"real world wasm programs\". Therefore, this entry might get disputed as well in the future.",
"id": "GHSA-2467-jr62-j23f",
"modified": "2025-06-19T21:31:19Z",
"published": "2025-06-19T21:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6274"
},
{
"type": "WEB",
"url": "https://github.com/WebAssembly/wabt/issues/2598"
},
{
"type": "WEB",
"url": "https://github.com/user-attachments/files/20191325/wabt_crash_4.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.313278"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.313278"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.593016"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.