CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5569 vulnerabilities reference this CWE, most recent first.
GHSA-8VWF-PHWX-JWQP
Vulnerability from github – Published: 2022-05-13 01:08 – Updated: 2022-05-13 01:08In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a "4.01 Unauthorized" response is mishandled. NOTE: the vendor states "While this is an interesting attack, there is no plan for maintainer to fix, as we are migrating to IoTivity Lite."
{
"affected": [],
"aliases": [
"CVE-2019-9750"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-13T19:29:00Z",
"severity": "CRITICAL"
},
"details": "In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a \"4.01 Unauthorized\" response is mishandled. NOTE: the vendor states \"While this is an interesting attack, there is no plan for maintainer to fix, as we are migrating to IoTivity Lite.\"",
"id": "GHSA-8vwf-phwx-jwqp",
"modified": "2022-05-13T01:08:20Z",
"published": "2022-05-13T01:08:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9750"
},
{
"type": "WEB",
"url": "https://jira.iotivity.org/browse/IOT-3267"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8W29-WH58-HRM4
Vulnerability from github – Published: 2025-04-01 00:30 – Updated: 2025-11-03 21:33An uncontrolled format string issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to cause a denial-of-service.
{
"affected": [],
"aliases": [
"CVE-2025-24199"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T23:15:18Z",
"severity": "MODERATE"
},
"details": "An uncontrolled format string issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to cause a denial-of-service.",
"id": "GHSA-8w29-wh58-hrm4",
"modified": "2025-11-03T21:33:18Z",
"published": "2025-04-01T00:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24199"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122373"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122374"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122375"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/10"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/8"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8W49-H785-MJ3C
Vulnerability from github – Published: 2024-11-22 20:26 – Updated: 2025-11-04 16:54The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.
See also CVE-2024-7592 for a similar vulnerability in cpython.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.4.1"
},
"package": {
"ecosystem": "PyPI",
"name": "tornado"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-52804"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-22T20:26:41Z",
"nvd_published_at": "2024-11-22T16:15:34Z",
"severity": "HIGH"
},
"details": "The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.\n\nSee also CVE-2024-7592 for a similar vulnerability in cpython.",
"id": "GHSA-8w49-h785-mj3c",
"modified": "2025-11-04T16:54:32Z",
"published": "2024-11-22T20:26:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52804"
},
{
"type": "WEB",
"url": "https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533"
},
{
"type": "PACKAGE",
"url": "https://github.com/tornadoweb/tornado"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00000.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Tornado has an HTTP cookie parsing DoS vulnerability"
}
GHSA-8W57-JFPM-945M
Vulnerability from github – Published: 2019-06-11 16:16 – Updated: 2023-04-11 00:26Versions of http-proxy-agent before 2.1.0 are vulnerable to denial of service and uninitialized memory leak when unsanitized options are passed to Buffer. An attacker may leverage these unsanitized options to consume system resources.
Recommendation
Update to version 2.1.0 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "http-proxy-agent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2019-06-11T16:11:38Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Versions of `http-proxy-agent` before 2.1.0 are vulnerable to denial of service and uninitialized memory leak when unsanitized options are passed to `Buffer`. An attacker may leverage these unsanitized options to consume system resources.\n\n\n## Recommendation\n\nUpdate to version 2.1.0 or later.",
"id": "GHSA-8w57-jfpm-945m",
"modified": "2023-04-11T00:26:58Z",
"published": "2019-06-11T16:16:07Z",
"references": [
{
"type": "WEB",
"url": "https://hackerone.com/reports/321631"
},
{
"type": "WEB",
"url": "https://github.com/TooTallNate/node-http-proxy-agent/blob/2.0.0/index.js#L80"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/607"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Denial of Service in http-proxy-agent"
}
GHSA-8W7M-W749-RX98
Vulnerability from github – Published: 2026-01-20 16:30 – Updated: 2026-02-02 22:21Summary
Websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu.
Additionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/pterodactyl/wings"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.12.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-69199"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-20T16:30:40Z",
"nvd_published_at": "2026-01-19T20:15:48Z",
"severity": "HIGH"
},
"details": "### Summary\nWebsockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu.\n\nAdditionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings.",
"id": "GHSA-8w7m-w749-rx98",
"modified": "2026-02-02T22:21:53Z",
"published": "2026-01-20T16:30:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-8w7m-w749-rx98"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69199"
},
{
"type": "WEB",
"url": "https://github.com/pterodactyl/panel/commit/09caa0d4995bd924b53b9a9e9b4883ac27bd5607"
},
{
"type": "PACKAGE",
"url": "https://github.com/pterodactyl/panel"
},
{
"type": "WEB",
"url": "https://github.com/pterodactyl/panel/releases/tag/v1.12.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks"
}
GHSA-8WCC-M6J2-QXVM
Vulnerability from github – Published: 2024-12-16 19:33 – Updated: 2024-12-23 17:13Summary
ASA-2024-0012
Name: ASA-2024-0012, Transaction decoding may result in a stack overflow Component: Cosmos SDK Criticality: High (Considerable Impact, and Possible Likelihood per ACMv1.2) Affected versions: cosmos-sdk versions <= v0.50.10, <= v0.47.14 Affected users: Chain Builders + Maintainers, Validators, node operators
ASA-2024-0013
Name: ASA-2024-0013: CosmosSDK: Transaction decoding may result in resource exhaustion
Component: Cosmos SDK
Criticality: High (Considerable Impact, and Possible Likelihood per ACMv1.2)
Affected versions: cosmos-sdk versions <= v0.50.10, <= v0.47.14
Affected users: Chain Builders + Maintainers, Validators, node operators
Impact
ASA-2024-0012
When decoding a maliciously formed packet with a deeply-nested structure, it may be possible for a stack overflow to occur and result in a network halt. This was addressed by adding a recursion limit while decoding the packet.
ASA-2024-0013
Nested messages in a transaction can consume exponential cpu and memory on UnpackAny calls. Themax_tx_bytes sets a limit for external TX but is not applied for internal messages emitted by wasm contracts or a malicious validator block. This may result in a node crashing due to resource exhaustion. This was addressed by adding additional validation to prevent this condition.
Patches
The issues above are resolved in Cosmos SDK versions v0.47.15 or v0.50.11. Please upgrade ASAP.
Timeline for ASA-2024-0012
- October 1, 2024, 12:29pm UTC: Issue reported to the Cosmos Bug Bounty program
- October 1, 2024, 2:47pm UTC: Issue triaged by Amulet on-call, and distributed to Core team
- December 9, 2024, 11:13am UTC: Core team completes patch for issue
- Dec 14, 2024,16:00 UTC: Pre-notification delivered
- Dec 16, 2024, 16:00 UTC: Patch made available
This issue was reported to the Cosmos Bug Bounty Program on HackerOne on October 1, 2024.
Timeline for ASA-2024-0013
- October 19, 2024, 8:12pm UTC: Issue reported to the Cosmos Bug Bounty program
- October 19, 2024, 8:28pm UTC: Issue triaged by Amulet on-call, and distributed to Core team
- December 11, 2024, 3:31pm UTC: Core team completes patch for issue
- Dec 14, 2024, 16:00 UTC: Pre-notification delivered
- Dec 16, 2024, 16:00 UTC: Patch made available
This issue was reported by LonelySloth to the Cosmos Bug Bounty Program on HackerOne on October 19, 2024.
If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.
If you have questions about Interchain security efforts, please reach out to our official communication channel at security@interchain.io. For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/cosmos/cosmos-sdk"
},
"ranges": [
{
"events": [
{
"introduced": "0.50.0-alpha.0"
},
{
"fixed": "0.50.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/cosmos/cosmos-sdk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.47.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "cosmossdk.io/x/tx"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-16T19:33:30Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary \n\n### ASA-2024-0012\nName: ASA-2024-0012, Transaction decoding may result in a stack overflow\nComponent: Cosmos SDK\nCriticality: High (Considerable Impact, and Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: cosmos-sdk versions \u003c= v0.50.10, \u003c= v0.47.14\nAffected users: Chain Builders + Maintainers, Validators, node operators\n\n### ASA-2024-0013\nName: ASA-2024-0013: CosmosSDK: Transaction decoding may result in resource exhaustion \nComponent: Cosmos SDK\nCriticality: High (Considerable Impact, and Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: cosmos-sdk versions \u003c= v0.50.10, \u003c= v0.47.14\nAffected users: Chain Builders + Maintainers, Validators, node operators\n\n\n\n### Impact\n\n### ASA-2024-0012\n\nWhen decoding a maliciously formed packet with a deeply-nested structure, it may be possible for a stack overflow to occur and result in a network halt. This was addressed by adding a recursion limit while decoding the packet.\n\n### ASA-2024-0013\n\nNested messages in a transaction can consume exponential cpu and memory on `UnpackAny` calls. The`max_tx_bytes` sets a limit for external TX but is not applied for internal messages emitted by wasm contracts or a malicious validator block. This may result in a node crashing due to resource exhaustion. This was addressed by adding additional validation to prevent this condition.\n\n\n### Patches\n\nThe issues above are resolved in Cosmos SDK versions v0.47.15 or v0.50.11.\nPlease upgrade ASAP.\n\n### Timeline for ASA-2024-0012\n\n* October 1, 2024, 12:29pm UTC: Issue reported to the Cosmos Bug Bounty program\n* October 1, 2024, 2:47pm UTC: Issue triaged by Amulet on-call, and distributed to Core team\n* December 9, 2024, 11:13am UTC: Core team completes patch for issue\n* Dec 14, 2024,16:00 UTC: Pre-notification delivered\n* Dec 16, 2024, 16:00 UTC: Patch made available\n\nThis issue was reported to the Cosmos Bug Bounty Program on HackerOne on October 1, 2024.\n\n### Timeline for ASA-2024-0013\n\n* October 19, 2024, 8:12pm UTC: Issue reported to the Cosmos Bug Bounty program\n* October 19, 2024, 8:28pm UTC: Issue triaged by Amulet on-call, and distributed to Core team\n* December 11, 2024, 3:31pm UTC: Core team completes patch for issue\n* Dec 14, 2024, 16:00 UTC: Pre-notification delivered\n* Dec 16, 2024, 16:00 UTC: Patch made available\n\nThis issue was reported by LonelySloth to the Cosmos Bug Bounty Program on HackerOne on October 19, 2024. \n\n\nIf you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation\u2019s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security. ",
"id": "GHSA-8wcc-m6j2-qxvm",
"modified": "2024-12-23T17:13:22Z",
"published": "2024-12-16T19:33:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-8wcc-m6j2-qxvm"
},
{
"type": "WEB",
"url": "https://github.com/cosmos/cosmos-sdk/commit/c6b1bdcd5628e3e425a3f02881d3c7db1d7af653"
},
{
"type": "PACKAGE",
"url": "https://github.com/cosmos/cosmos-sdk"
},
{
"type": "WEB",
"url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.15"
},
{
"type": "WEB",
"url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion "
}
GHSA-8WJH-3X3G-6PJF
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2025-04-20 03:31NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.
{
"affected": [],
"aliases": [
"CVE-2016-7426"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-01-13T16:59:00Z",
"severity": "HIGH"
},
"details": "NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.",
"id": "GHSA-8wjh-3x3g-6pjf",
"modified": "2025-04-20T03:31:11Z",
"published": "2022-05-13T01:25:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7426"
},
{
"type": "WEB",
"url": "https://bto.bluecoat.com/security-advisory/sa139"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03706en_us"
},
{
"type": "WEB",
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3707-2"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/633847"
},
{
"type": "WEB",
"url": "http://nwtime.org/ntp428p9_release"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0252.html"
},
{
"type": "WEB",
"url": "http://support.ntp.org/bin/view/Main/NtpBug3071"
},
{
"type": "WEB",
"url": "http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94451"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037354"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WP5-GW2F-GP9F
Vulnerability from github – Published: 2025-07-15 21:31 – Updated: 2025-07-15 21:31Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
{
"affected": [],
"aliases": [
"CVE-2025-50089"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-15T20:15:44Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
"id": "GHSA-8wp5-gw2f-gp9f",
"modified": "2025-07-15T21:31:42Z",
"published": "2025-07-15T21:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50089"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WX3-324G-W4QQ
Vulnerability from github – Published: 2023-10-17 14:24 – Updated: 2023-10-17 14:24Impact
An issue has been identified with how OpenSearch handled incoming requests on the HTTP layer. An unauthenticated user could force an OpenSearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests.
The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-13 (CVE-2023-31418).
Mitigation
Versions 1.3.14 and 2.11.0 contain a fix for this issue.
For more information
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.opensearch.plugin:opensearch-security"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.14.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.opensearch.plugin:opensearch-security"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0.0"
},
{
"fixed": "2.11.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-17T14:24:48Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nAn issue has been identified with how OpenSearch handled incoming requests on the HTTP layer. An unauthenticated user could force an OpenSearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests.\n\nThe issue was identified by Elastic Engineering and corresponds to security advisory [ESA-2023-13](https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616) (CVE-2023-31418).\n\n### Mitigation\nVersions 1.3.14 and 2.11.0 contain a fix for this issue.\n\n### For more information\nIf you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to\u00a0[aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.",
"id": "GHSA-8wx3-324g-w4qq",
"modified": "2023-10-17T14:24:48Z",
"published": "2023-10-17T14:24:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/opensearch-project/security/security/advisories/GHSA-8wx3-324g-w4qq"
},
{
"type": "PACKAGE",
"url": "https://github.com/opensearch-project/security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenSearch uncontrolled resource consumption"
}
GHSA-8WXP-XXP2-RCGX
Vulnerability from github – Published: 2026-05-08 20:44 – Updated: 2026-06-08 23:54Impact
The Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected.
Patches
This issue will be fixed in the following versions: - v1.14.2 - v1.13.3 - v1.12.4
Users running versions below these should upgrade accordingly.
Workarounds
No known workarounds. Upgrade to the patched versions listed above.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "volcano.sh/volcano"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.12.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "volcano.sh/volcano"
},
"ranges": [
{
"events": [
{
"introduced": "1.13.0"
},
{
"fixed": "1.13.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "volcano.sh/volcano"
},
"ranges": [
{
"events": [
{
"introduced": "1.14.0"
},
{
"fixed": "1.14.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44247"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T20:44:54Z",
"nvd_published_at": "2026-05-27T22:16:35Z",
"severity": "MODERATE"
},
"details": "### Impact\nThe Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected.\n\n### Patches\nThis issue will be fixed in the following versions:\n- v1.14.2\n- v1.13.3\n- v1.12.4\n\nUsers running versions below these should upgrade accordingly.\n\n### Workarounds\nNo known workarounds. Upgrade to the patched versions listed above.",
"id": "GHSA-8wxp-xxp2-rcgx",
"modified": "2026-06-08T23:54:51Z",
"published": "2026-05-08T20:44:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/volcano-sh/volcano/security/advisories/GHSA-8wxp-xxp2-rcgx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44247"
},
{
"type": "PACKAGE",
"url": "https://github.com/volcano-sh/volcano"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Volcano\u0027s webhook server vulnerable to OOM due to unbounded HTTP request body size"
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.