CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
6175 vulnerabilities reference this CWE, most recent first.
GHSA-3999-5FFV-WP2R
Vulnerability from github – Published: 2024-05-01 16:40 – Updated: 2024-05-01 16:40Summary
Attack scenario The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames. This vector is not bounded in length. Every time the Yamux protocol requires sending of a new frame, this frame gets appended to this vector. This can be remotely triggered in a number of ways, for example by:
- Opening a new libp2p Identify stream. This causes the node to send its Identify message. Of course, every other protocol that causes the sending of data also works. The larger the response, the more data is enqueued.
- Sending a Yamux Ping frame. This causes a Pong frame to be enqueued.
Under normal circumstances, this queue of pending frames would be drained once they’re sent out over the network. However, the attacker can use TCP’s receive window mechanism to prevent the victim from sending out any data: By not reading from the TCP connection, the receive window will never be increased, and the victim won’t be able to send out any new data (this is how TCP implements backpressure). Once this happens, Yamux’s queue of pending frames will start growing indefinitely. The queue will only be drained once the underlying TCP connection is closed.
Components https://github.com/libp2p/rust-yamux/blob/yamux-v0.13.1/yamux/src/connection.rs#L289
Details
This attack is inspired by the HTTP/2 Rapid Reset Attack (CVE 2023-44487), HTTP/2 Ping Flood (CVE-2019-9512), and the QUIC Path Validation attack (see my blog post: https://seemann.io/posts/2023-12-18-exploiting-quics-path-validation/).
Impact
An attacker can cause a remote node to run out of memory, which will result in the corresponding process getting terminated by the operating system.
Depending on the application protocols running on top of rust-libp2p, higher amplification factors are possible. For example, image a protocol that sends out 10 MB of data as a result of an incoming request. By issuing that request and sending a Yamux stream window update (together ~100-200 bytes), the victim would now enqueue the entire 10 MB into its frame buffer. Any block transfer / sync protocols might be good candidates.
In addition to consuming huge amounts of memory, this attack also drives up the victim's CPU load, such that the allocation of memory at some point becomes CPU-limited.
This was originally submitted by @marteen-seemann to the Ethereum Foundation bug bounty program.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "yamux"
},
"ranges": [
{
"events": [
{
"introduced": "0.13.0"
},
{
"fixed": "0.13.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-32984"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-01T16:40:49Z",
"nvd_published_at": "2024-05-01T11:15:47Z",
"severity": "HIGH"
},
"details": "### Summary\n\nAttack scenario\nThe Rust implementation of the Yamux stream multiplexer uses a vector for pending frames. This vector is not bounded in length. Every time the Yamux protocol requires sending of a new frame, this frame gets appended to this vector. This can be remotely triggered in a number of ways, for example by:\n\n1. Opening a new libp2p Identify stream. This causes the node to send its Identify message. Of course, every other protocol that causes the sending of data also works. The larger the response, the more data is enqueued.\n2. Sending a Yamux Ping frame. This causes a Pong frame to be enqueued.\n\nUnder normal circumstances, this queue of pending frames would be drained once they\u2019re sent out over the network. However, the attacker can use TCP\u2019s receive window mechanism to prevent the victim from sending out any data: By not reading from the TCP connection, the receive window will never be increased, and the victim won\u2019t be able to send out any new data (this is how TCP implements backpressure). Once this happens, Yamux\u2019s queue of pending frames will start growing indefinitely. The queue will only be drained once the underlying TCP connection is closed.\n\nComponents\nhttps://github.com/libp2p/rust-yamux/blob/yamux-v0.13.1/yamux/src/connection.rs#L289\n\n### Details\nThis attack is inspired by the HTTP/2 Rapid Reset Attack (CVE 2023-44487), HTTP/2 Ping Flood (CVE-2019-9512), and the QUIC Path Validation attack (see my blog post: https://seemann.io/posts/2023-12-18-exploiting-quics-path-validation/).\n\n### Impact\nAn attacker can cause a remote node to run out of memory, which will result in the corresponding process getting terminated by the operating system.\n\nDepending on the application protocols running on top of rust-libp2p, higher amplification factors are possible. For example, image a protocol that sends out 10 MB of data as a result of an incoming request. By issuing that request and sending a Yamux stream window update (together ~100-200 bytes), the victim would now enqueue the entire 10 MB into its frame buffer. Any block transfer / sync protocols might be good candidates.\n\nIn addition to consuming huge amounts of memory, this attack also drives up the victim\u0027s CPU load, such that the allocation of memory at some point becomes CPU-limited.\n\nThis was originally submitted by @marteen-seemann to the Ethereum Foundation bug bounty program.",
"id": "GHSA-3999-5ffv-wp2r",
"modified": "2024-05-01T16:40:49Z",
"published": "2024-05-01T16:40:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/libp2p/rust-yamux/security/advisories/GHSA-3999-5ffv-wp2r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32984"
},
{
"type": "WEB",
"url": "https://github.com/libp2p/rust-yamux/commit/460baf2ccb7d5982b266cb3cb9c0bdf75b4fb779"
},
{
"type": "WEB",
"url": "https://github.com/sigp/rust-yamux/commit/6689e227a48258a52347cd1d984adfc94afc6f7a"
},
{
"type": "PACKAGE",
"url": "https://github.com/libp2p/rust-yamux"
},
{
"type": "WEB",
"url": "https://github.com/libp2p/rust-yamux/blob/yamux-v0.13.1/yamux/src/connection.rs#L289"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Yamux Memory Exhaustion Vulnerability via Active::pending_frames property "
}
GHSA-399H-RRQC-RPGV
Vulnerability from github – Published: 2025-12-01 18:30 – Updated: 2026-01-26 15:30When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
{
"affected": [],
"aliases": [
"CVE-2025-13836"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-01T18:16:04Z",
"severity": "MODERATE"
},
"details": "When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.",
"id": "GHSA-399h-rrqc-rpgv",
"modified": "2026-01-26T15:30:30Z",
"published": "2025-12-01T18:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13836"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/119451"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/119454"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c"
},
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-39FP-MC5W-P8HH
Vulnerability from github – Published: 2026-06-30 12:31 – Updated: 2026-07-20 09:31Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via deeply nested bencoded input.
bdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by value while the list and dictionary branches capture the whole remainder, so every live recursion frame keeps its own copy of the shrinking buffer (O(N^2) bytes for an N-deep input). The decoder runs on every untrusted bencode source: .torrent files, BEP09 metadata fetched from peers, DHT messages, and tracker responses.
A bencoded input of roughly 150,000 nested lists (about 150 KB on the wire) drives multi-gigabyte peak memory, so one short message from any peer, or one crafted .torrent file or magnet link, terminates the client.
{
"affected": [],
"aliases": [
"CVE-2026-57081"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T12:16:25Z",
"severity": "HIGH"
},
"details": "Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via deeply nested bencoded input.\n\nbdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by value while the list and dictionary branches capture the whole remainder, so every live recursion frame keeps its own copy of the shrinking buffer (O(N^2) bytes for an N-deep input). The decoder runs on every untrusted bencode source: .torrent files, BEP09 metadata fetched from peers, DHT messages, and tracker responses.\n\nA bencoded input of roughly 150,000 nested lists (about 150 KB on the wire) drives multi-gigabyte peak memory, so one short message from any peer, or one crafted .torrent file or magnet link, terminates the client.",
"id": "GHSA-39fp-mc5w-p8hh",
"modified": "2026-07-20T09:31:05Z",
"published": "2026-06-30T12:31:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-mv44-v82p-89xv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57081"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/SANKO/Net-BitTorrent-v2.1.0/changes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-39JM-FM9J-JG9P
Vulnerability from github – Published: 2022-05-13 01:46 – Updated: 2024-03-21 03:33** DISPUTED ** BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses (as defined in RFC 1812 section 5.3.7). This product enables net.ipv4.conf.all.log_martians by default. NOTE: the vendor reports "It has been proved that this vulnerability has no foundation and it is totally fake and based on false assumptions."
{
"affected": [],
"aliases": [
"CVE-2017-7397"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-03T20:59:00Z",
"severity": "HIGH"
},
"details": "** DISPUTED ** BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses (as defined in RFC 1812 section 5.3.7). This product enables net.ipv4.conf.all.log_martians by default. NOTE: the vendor reports \"It has been proved that this vulnerability has no foundation and it is totally fake and based on false assumptions.\"",
"id": "GHSA-39jm-fm9j-jg9p",
"modified": "2024-03-21T03:33:13Z",
"published": "2022-05-13T01:46:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7397"
},
{
"type": "WEB",
"url": "https://backbox.org/portal/blog/false-cve-backbox-46-unmasked"
},
{
"type": "WEB",
"url": "https://cxsecurity.com/issue/WLB-2017040001"
},
{
"type": "WEB",
"url": "https://forum.backbox.org/security-advisories/waiting-verification-backbox-os-denial-of-service/msg10218"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41781"
},
{
"type": "WEB",
"url": "http://www.exploitalert.com/view-details.html?id=26361"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-39Q4-P535-C852
Vulnerability from github – Published: 2021-06-10 17:25 – Updated: 2023-09-07 21:45The package locutus before 2.0.15 is vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "locutus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23392"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-09T20:22:09Z",
"nvd_published_at": "2021-06-08T08:15:00Z",
"severity": "HIGH"
},
"details": "The package locutus before 2.0.15 is vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.",
"id": "GHSA-39q4-p535-c852",
"modified": "2023-09-07T21:45:40Z",
"published": "2021-06-10T17:25:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23392"
},
{
"type": "WEB",
"url": "https://github.com/locutusjs/locutus/pull/446"
},
{
"type": "WEB",
"url": "https://github.com/locutusjs/locutus/commit/eb863321990e7e5514aa14f68b8d9978ece9e65e"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-LOCUTUS-1090597"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncontrolled Resource Consumption in locutus"
}
GHSA-39Q6-V89P-42VG
Vulnerability from github – Published: 2026-02-11 15:30 – Updated: 2026-02-12 15:32An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
{
"affected": [],
"aliases": [
"CVE-2025-54149"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-11T13:15:54Z",
"severity": "MODERATE"
},
"details": "An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.\n\nWe have already fixed the vulnerability in the following version:\nQsync Central 5.0.0.4 ( 2026/01/20 ) and later",
"id": "GHSA-39q6-v89p-42vg",
"modified": "2026-02-12T15:32:42Z",
"published": "2026-02-11T15:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54149"
},
{
"type": "WEB",
"url": "https://www.qnap.com/en/security-advisory/qsa-26-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-39QC-96H7-956F
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2024-05-20 21:30Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Specific Go Packages Affected
golang.org/x/net/http2
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/net"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20190813141303-74dc4d7220e7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-9514"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-08T00:30:39Z",
"nvd_published_at": "2019-08-13T21:15:00Z",
"severity": "HIGH"
},
"details": "Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.\n\n### Specific Go Packages Affected\ngolang.org/x/net/http2",
"id": "GHSA-39qc-96h7-956f",
"modified": "2024-05-20T21:30:41Z",
"published": "2022-05-24T16:53:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9514"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2594"
},
{
"type": "WEB",
"url": "https://go.dev/cl/190137"
},
{
"type": "WEB",
"url": "https://go.dev/issue/33606"
},
{
"type": "WEB",
"url": "https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/605641"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10296"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0536"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Aug/24"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Aug/31"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Aug/43"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Sep/18"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190823-0001"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190823-0004"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190823-0005"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K01988340"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K01988340?utm_source=f5support\u0026amp;utm_medium=RSS"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4308-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4503"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4508"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4520"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4669"
},
{
"type": "WEB",
"url": "https://www.synology.com/security/advisory/Synology_SA_19_33"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2661"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2682"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2690"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2726"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2766"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2769"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2796"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2861"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2925"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2939"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2955"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2966"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3131"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3245"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3265"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3892"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3906"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4018"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4019"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4020"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4021"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4040"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4041"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4042"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4045"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4269"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4273"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4352"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0406"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0727"
},
{
"type": "WEB",
"url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/Aug/16"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/08/20/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/18/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "golang.org/x/net/http vulnerable to a reset flood"
}
GHSA-39QR-RC93-VHQM
Vulnerability from github – Published: 2026-05-11 16:17 – Updated: 2026-06-08 23:49Summary
The apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(&request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory.
This causes the Linux OOM Killer to instantly terminate the entire bird-lg-go daemon, resulting in a severe Remote Denial of Service (RDoS).
Details
In api.go:
```go
func apiHandler(w http.ResponseWriter, r *http.Request) {
var request apiRequest
// VULNERABILITY: No http.MaxBytesReader protection before JSON decode
err := json.NewDecoder(r.Body).Decode(&request)
// ...
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/xddxdd/bird-lg-go"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260507060110-0ff87024cb9e"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45047"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-11T16:17:48Z",
"nvd_published_at": "2026-05-27T18:16:24Z",
"severity": "HIGH"
},
"details": "### Summary\nThe `apiHandler` (and similarly `webHandlerTelegramBot`) processes user-provided JSON payloads by directly using `json.NewDecoder(r.Body).Decode(\u0026request)` without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go\u0027s JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host\u0027s physical RAM or container limits, leading to an unrecoverable `fatal error: runtime: out of memory`. \n\nThis causes the Linux OOM Killer to instantly terminate the entire `bird-lg-go` daemon, resulting in a severe Remote Denial of Service (RDoS).\n\n### Details\nIn `api.go`:\n```go\nfunc apiHandler(w http.ResponseWriter, r *http.Request) {\n var request apiRequest\n // VULNERABILITY: No http.MaxBytesReader protection before JSON decode\n err := json.NewDecoder(r.Body).Decode(\u0026request) \n // ...",
"id": "GHSA-39qr-rc93-vhqm",
"modified": "2026-06-08T23:49:47Z",
"published": "2026-05-11T16:17:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45047"
},
{
"type": "WEB",
"url": "https://github.com/xddxdd/bird-lg-go/commit/0ff87024cb9ed01fc5f5fdc6f4603fce4c123922"
},
{
"type": "PACKAGE",
"url": "https://github.com/xddxdd/bird-lg-go"
},
{
"type": "WEB",
"url": "https://github.com/xddxdd/bird-lg-go/releases/tag/v1.4.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding"
}
GHSA-3C38-VCC6-HF2H
Vulnerability from github – Published: 2026-05-12 21:31 – Updated: 2026-05-12 21:31CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
{
"affected": [],
"aliases": [
"CVE-2026-34678"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T20:16:38Z",
"severity": "MODERATE"
},
"details": "CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.",
"id": "GHSA-3c38-vcc6-hf2h",
"modified": "2026-05-12T21:31:34Z",
"published": "2026-05-12T21:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34678"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3C7C-P4M9-GWHC
Vulnerability from github – Published: 2023-02-24 00:30 – Updated: 2025-03-17 21:30Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.
{
"affected": [],
"aliases": [
"CVE-2023-23296"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-23T23:15:00Z",
"severity": "MODERATE"
},
"details": "Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.",
"id": "GHSA-3c7c-p4m9-gwhc",
"modified": "2025-03-17T21:30:23Z",
"published": "2023-02-24T00:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23296"
},
{
"type": "WEB",
"url": "https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.