CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5570 vulnerabilities reference this CWE, most recent first.
GHSA-7J7J-CJF4-3C2X
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-08-06 00:00A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability.
{
"affected": [],
"aliases": [
"CVE-2021-20265"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-10T16:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability.",
"id": "GHSA-7j7j-cjf4-3c2x",
"modified": "2022-08-06T00:00:39Z",
"published": "2022-05-24T17:44:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20265"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908827"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa0dc04df259ba2df3ce1920e9690c7842f8fa4b"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7J8F-W9CG-569R
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35A vulnerability in the application server of the Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to malformed SIP INVITE traffic received on the CVP during communications with the Cisco Virtualized Voice Browser (VVB). An attacker could exploit this vulnerability by sending malformed SIP INVITE traffic to the targeted appliance. An exploit could allow the attacker to impact the availability of services and data on the device, causing a DoS condition. This vulnerability affects Cisco Unified CVP running any software release prior to 11.6(1). Cisco Bug IDs: CSCve85840.
{
"affected": [],
"aliases": [
"CVE-2018-0086"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-18T06:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the application server of the Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to malformed SIP INVITE traffic received on the CVP during communications with the Cisco Virtualized Voice Browser (VVB). An attacker could exploit this vulnerability by sending malformed SIP INVITE traffic to the targeted appliance. An exploit could allow the attacker to impact the availability of services and data on the device, causing a DoS condition. This vulnerability affects Cisco Unified CVP running any software release prior to 11.6(1). Cisco Bug IDs: CSCve85840.",
"id": "GHSA-7j8f-w9cg-569r",
"modified": "2022-05-13T01:35:51Z",
"published": "2022-05-13T01:35:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0086"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-cvp"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102745"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040220"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7JFP-3WF8-63W9
Vulnerability from github – Published: 2022-05-17 02:15 – Updated: 2025-04-20 03:41The TDStretch::acceptNewOverlapLength function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (memory allocation error and application crash) via a crafted wav file.
{
"affected": [],
"aliases": [
"CVE-2017-9259"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-27T06:29:00Z",
"severity": "MODERATE"
},
"details": "The TDStretch::acceptNewOverlapLength function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (memory allocation error and application crash) via a crafted wav file.",
"id": "GHSA-7jfp-3wf8-63w9",
"modified": "2025-04-20T03:41:30Z",
"published": "2022-05-17T02:15:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9259"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/42389"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Jul/62"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100095"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7JP6-RMG5-FJ58
Vulnerability from github – Published: 2023-08-22 21:30 – Updated: 2024-04-04 07:08GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.
{
"affected": [],
"aliases": [
"CVE-2022-48063"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-22T19:16:30Z",
"severity": "MODERATE"
},
"details": "GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.",
"id": "GHSA-7jp6-rmg5-fj58",
"modified": "2024-04-04T07:08:07Z",
"published": "2023-08-22T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48063"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231006-0008"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=29924"
},
{
"type": "WEB",
"url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=75393a2d54bcc40053e5262a3de9d70c5ebfbbfd"
},
{
"type": "WEB",
"url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75393a2d54bcc40053e5262a3de9d70c5ebfbbfd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7JVV-JG88-R4H8
Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-07-13 00:01Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.
{
"affected": [],
"aliases": [
"CVE-2021-32920"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-13T16:15:00Z",
"severity": "HIGH"
},
"details": "Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.",
"id": "GHSA-7jvv-jg88-r4h8",
"modified": "2022-07-13T00:01:25Z",
"published": "2022-05-24T19:02:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32920"
},
{
"type": "WEB",
"url": "https://blog.prosody.im/prosody-0.11.9-released"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6MFFBZWXKPZEVZNQSVJNCUE7WRF3T7DG"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GUN63AHEWB2WRROJHU3BVJRWLONCT2B7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LWJ2DG2DFJOEFEWOUN26IMYYWGSA2ZEE"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202105-15"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4916"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/13/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/14/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7M8F-HGJQ-8GC9
Vulnerability from github – Published: 2026-05-22 17:27 – Updated: 2026-05-22 17:27Vulnerability Description
In aiosend/webhook/base.py, the WebhookHandler.feed_update() method performs full deserialization of the incoming JSON via Pydantic before verifying the HMAC signature. Anyone can send a request with an arbitrary body — the server will parse it, spend CPU and memory, and only then reject it.
Vulnerable Code
# aiosend/webhook/base.py — feed_update()
update = Update.model_validate(body, context={"client": self}) # parsing — always
if not self._check_signature(body, headers): # auth — too late
return False
Additional aggravating factor: CryptoPayObject is declared with ConfigDict(extra="allow") — all arbitrary fields from the body are stored in memory without any limits.
Minimal PoC
Requests with deliberately invalid signatures (zero credentials):
| extra_fields | body_size | parse_time | status |
|---|---|---|---|
| 0 | 336 B | 26 µs | 403 REJECTED |
| 1,000 | 82 KB | 257 µs | 403 REJECTED |
| 5,000 | 410 KB | 1,183 µs | 403 REJECTED |
| 10,000 | 820 KB | 2,552 µs | 403 REJECTED |
| 10,000 (×512B) | 5.3 MB | 7,490 µs | 403 REJECTED |
All requests were rejected — but the server already performed parsing for each one. 10 parallel threads with 5 MB bodies = >75 ms of CPU spent on requests that will never be authorized.
Affected Components
aiosend/webhook/base.py—WebhookHandler.feed_update()aiosend/types/base.py—CryptoPayObject(extra="allow")- All adapters:
AiohttpManager,FastAPIManager,FlaskManager
Exploitation Conditions
- Attacker: anyone with network access to the webhook endpoint
- Authentication: not required
- Body size limit: absent at the library level (Flask and FastAPI have no default limit)
The advisory was translated using Copilot.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "aiosend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-22T17:27:56Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "# Vulnerability Description\n\nIn `aiosend/webhook/base.py`, the `WebhookHandler.feed_update()` method performs full deserialization of the incoming JSON via Pydantic **before** verifying the HMAC signature. Anyone can send a request with an arbitrary body \u2014 the server will parse it, spend CPU and memory, and only then reject it.\n\n## Vulnerable Code\n\n```python\n# aiosend/webhook/base.py \u2014 feed_update()\nupdate = Update.model_validate(body, context={\"client\": self}) # parsing \u2014 always\nif not self._check_signature(body, headers): # auth \u2014 too late\n return False\n```\n\nAdditional aggravating factor: `CryptoPayObject` is declared with `ConfigDict(extra=\"allow\")` \u2014 all arbitrary fields from the body are stored in memory without any limits.\n\n## Minimal PoC\n\nRequests with deliberately invalid signatures (zero credentials):\n\n| extra_fields | body_size | parse_time | status |\n|---|---|---|---|\n| 0 | 336 B | 26 \u00b5s | **403 REJECTED** |\n| 1,000 | 82 KB | 257 \u00b5s | **403 REJECTED** |\n| 5,000 | 410 KB | 1,183 \u00b5s | **403 REJECTED** |\n| 10,000 | 820 KB | 2,552 \u00b5s | **403 REJECTED** |\n| 10,000 (\u00d7512B) | 5.3 MB | 7,490 \u00b5s | **403 REJECTED** |\n\nAll requests were rejected \u2014 but the server already performed parsing for each one. 10 parallel threads with 5 MB bodies = \u003e75 ms of CPU spent on requests that will never be authorized.\n\n## Affected Components\n\n- `aiosend/webhook/base.py` \u2014 `WebhookHandler.feed_update()`\n- `aiosend/types/base.py` \u2014 `CryptoPayObject` (`extra=\"allow\"`)\n- All adapters: `AiohttpManager`, `FastAPIManager`, `FlaskManager`\n\n## Exploitation Conditions\n\n- **Attacker**: anyone with network access to the webhook endpoint\n- **Authentication**: not required\n- **Body size limit**: absent at the library level (Flask and FastAPI have no default limit)\n\n---\nThe advisory was translated using Copilot.",
"id": "GHSA-7m8f-hgjq-8gc9",
"modified": "2026-05-22T17:27:56Z",
"published": "2026-05-22T17:27:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vovchic17/aiosend/security/advisories/GHSA-7m8f-hgjq-8gc9"
},
{
"type": "PACKAGE",
"url": "https://github.com/vovchic17/aiosend"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler"
}
GHSA-7MC5-CHHP-FMC3
Vulnerability from github – Published: 2018-10-09 00:30 – Updated: 2020-08-31 18:11Affected versions of negotiator are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted Accept-Language header value.
Recommendation
Update to version 0.6.1 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "negotiator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-10539"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:22:57Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Affected versions of `negotiator` are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted `Accept-Language` header value.\n\n\n\n\n## Recommendation\n\nUpdate to version 0.6.1 or later.",
"id": "GHSA-7mc5-chhp-fmc3",
"modified": "2020-08-31T18:11:01Z",
"published": "2018-10-09T00:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10539"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-7mc5-chhp-fmc3"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/106"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Regular Expression Denial of Service in negotiator"
}
GHSA-7MC5-X7XH-682H
Vulnerability from github – Published: 2022-09-27 00:00 – Updated: 2025-05-05 18:32A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.
{
"affected": [],
"aliases": [
"CVE-2022-3204"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-26T14:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability named \u0027Non-Responsive Delegation Attack\u0027 (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.",
"id": "GHSA-7mc5-x7xh-682h",
"modified": "2025-05-05T18:32:25Z",
"published": "2022-09-27T00:00:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3204"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00024.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35QGS5FBQTG3DBSK7QV67PA64P24ABHY"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4EU6DMJXQFMAIE6SLAH4H5RNRU6VQL"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/35QGS5FBQTG3DBSK7QV67PA64P24ABHY"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4EU6DMJXQFMAIE6SLAH4H5RNRU6VQL"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202212-02"
},
{
"type": "WEB",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7MCH-5P8P-X68J
Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2022-05-24 17:17A ZTE product is impacted by a resource management error vulnerability. An attacker could exploit this vulnerability to cause a denial of service by issuing a specific command. This affects: ZXCTN 6500 version V2.10.00R3B87.
{
"affected": [],
"aliases": [
"CVE-2020-6866"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-30T22:15:00Z",
"severity": "MODERATE"
},
"details": "A ZTE product is impacted by a resource management error vulnerability. An attacker could exploit this vulnerability to cause a denial of service by issuing a specific command. This affects: ZXCTN 6500 version V2.10.00R3B87.",
"id": "GHSA-7mch-5p8p-x68j",
"modified": "2022-05-24T17:17:03Z",
"published": "2022-05-24T17:17:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6866"
},
{
"type": "WEB",
"url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012803"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7MGW-WJG9-2H5F
Vulnerability from github – Published: 2022-05-13 01:01 – Updated: 2022-05-13 01:01An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A large amount of simultaneous TCP connections causes the APID daemon to repeatedly fork, causing the daemon to run out of memory and trigger a device reboot. An attacker needs network connectivity to the device to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2017-2889"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-07T16:29:00Z",
"severity": "HIGH"
},
"details": "An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A large amount of simultaneous TCP connections causes the APID daemon to repeatedly fork, causing the daemon to run out of memory and trigger a device reboot. An attacker needs network connectivity to the device to trigger this vulnerability.",
"id": "GHSA-7mgw-wjg9-2h5f",
"modified": "2022-05-13T01:01:16Z",
"published": "2022-05-13T01:01:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2889"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0396"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.