CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
6394 vulnerabilities reference this CWE, most recent first.
GHSA-GH4C-79CJ-JR5J
Vulnerability from github – Published: 2026-09-16 15:31 – Updated: 2026-09-16 15:31A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sse_parser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. This patch is called ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186. Applying a patch is advised to resolve this issue.
{
"affected": [],
"aliases": [
"CVE-2026-92363"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T14:17:16Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sse_parser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. This patch is called ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186. Applying a patch is advised to resolve this issue.",
"id": "GHSA-gh4c-79cj-jr5j",
"modified": "2026-09-16T15:31:12Z",
"published": "2026-09-16T15:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92363"
},
{
"type": "WEB",
"url": "https://github.com/ag-ui-protocol/ag-ui/issues/2440"
},
{
"type": "WEB",
"url": "https://github.com/ag-ui-protocol/ag-ui/pull/2501"
},
{
"type": "WEB",
"url": "https://github.com/ag-ui-protocol/ag-ui/commit/ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186"
},
{
"type": "WEB",
"url": "https://github.com/ag-ui-protocol/ag-ui"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-92363"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/934957"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/405449"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/405449/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GH68-JM46-84RF
Vulnerability from github – Published: 2024-02-04 21:30 – Updated: 2025-11-04 21:31libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
{
"affected": [],
"aliases": [
"CVE-2023-52425"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-04T20:15:46Z",
"severity": "HIGH"
},
"details": "libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.",
"id": "GHSA-gh68-jm46-84rf",
"modified": "2025-11-04T21:31:05Z",
"published": "2024-02-04T21:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52425"
},
{
"type": "WEB",
"url": "https://github.com/libexpat/libexpat/pull/789"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240614-0003"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/03/20/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GH9Q-2XRM-X6QV
Vulnerability from github – Published: 2025-03-03 20:53 – Updated: 2025-11-04 00:32There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem.
Details
CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service.
Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.
Affected versions
cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.
Credits
Thanks to lio346 for discovering this issue. Also thanks to mame for fixing this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "cgi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.5.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "cgi"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.6"
},
{
"fixed": "0.3.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.3.6"
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "cgi"
},
"ranges": [
{
"events": [
{
"introduced": "0.4.0"
},
{
"fixed": "0.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-27219"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-03T20:53:43Z",
"nvd_published_at": "2025-03-04T00:15:31Z",
"severity": "MODERATE"
},
"details": "There is a possibility for DoS by in the cgi gem.\nThis vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem.\n\n## Details\n\nCGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service.\n\nPlease update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.\n\n## Affected versions\n\ncgi gem versions \u003c= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.\n\n## Credits\n\nThanks to lio346 for discovering this issue.\nAlso thanks to mame for fixing this vulnerability.",
"id": "GHSA-gh9q-2xrm-x6qv",
"modified": "2025-11-04T00:32:21Z",
"published": "2025-03-03T20:53:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27219"
},
{
"type": "WEB",
"url": "https://github.com/ruby/cgi/pull/52"
},
{
"type": "WEB",
"url": "https://github.com/ruby/cgi/pull/53"
},
{
"type": "WEB",
"url": "https://github.com/ruby/cgi/pull/54"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2936778"
},
{
"type": "PACKAGE",
"url": "https://github.com/ruby/cgi"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27219"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "CGI has Denial of Service (DoS) potential in Cookie.parse"
}
GHSA-GHFH-P92W-J4MG
Vulnerability from github – Published: 2025-04-08 18:34 – Updated: 2026-09-25 17:29A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash.
A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.elasticsearch:elasticsearch-grok"
},
"ranges": [
{
"events": [
{
"introduced": "7.17.0"
},
{
"fixed": "8.15.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-52980"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-09T13:02:50Z",
"nvd_published_at": "2025-04-08T17:15:34Z",
"severity": "MODERATE"
},
"details": "A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash.\n\nA successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.",
"id": "GHSA-ghfh-p92w-j4mg",
"modified": "2026-09-25T17:29:46Z",
"published": "2025-04-08T18:34:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52980"
},
{
"type": "WEB",
"url": "https://github.com/elastic/elasticsearch/commit/4e5c6801f4d60f100f122072f6bf35b21fd722a5"
},
{
"type": "WEB",
"url": "https://github.com/elastic/elasticsearch/commit/a02dc7165c75f12701f8d47a2bdefe5283735267"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919"
},
{
"type": "PACKAGE",
"url": "https://github.com/elastic/elasticsearch"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function"
}
GHSA-GHHP-3QVG-889P
Vulnerability from github – Published: 2026-07-15 22:01 – Updated: 2026-08-17 16:15Impact
The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a server or client can make the other peer parse these bytes into an ever-growing integer. Since Ruby integers are arbitrary precision, this can be used to make a WebSocket connection consume an unbounded amount of memory and lead to the host process running out of memory.
Patches
The issue has been patched in version 0.8.1. All users should upgrade to this version.
Workarounds
No known workarounds exist.
Acknowledgements
This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "websocket-driver"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54463"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-15T22:01:52Z",
"nvd_published_at": "2026-07-17T20:17:26Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nThe frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values `0x80` or above, a server or client can make the other peer parse these bytes into an ever-growing integer. Since Ruby integers are arbitrary precision, this can be used to make a WebSocket connection consume an unbounded amount of memory and lead to the host process running out of memory.\n\n### Patches\n\nThe issue has been patched in version 0.8.1. All users should upgrade to this version.\n\n### Workarounds\n\nNo known workarounds exist.\n\n### Acknowledgements\n\nThis issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.",
"id": "GHSA-ghhp-3qvg-889p",
"modified": "2026-08-17T16:15:03Z",
"published": "2026-07-15T22:01:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/faye/websocket-driver-ruby/security/advisories/GHSA-ghhp-3qvg-889p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54463"
},
{
"type": "WEB",
"url": "https://github.com/faye/websocket-driver-ruby/commit/d0141f041f6e3677a951255d547a313e732ccbe0"
},
{
"type": "PACKAGE",
"url": "https://github.com/faye/websocket-driver-ruby"
},
{
"type": "WEB",
"url": "https://github.com/faye/websocket-driver-ruby/releases/tag/0.8.1"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/websocket-driver/CVE-2026-54463.yml"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54463"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
"type": "CVSS_V4"
}
],
"summary": "websocket-driver: Memory exhaustion via abuse of protocol length headers"
}
GHSA-GHRH-MW3V-VGGJ
Vulnerability from github – Published: 2022-05-11 00:01 – Updated: 2025-01-02 21:31Windows Hyper-V Denial of Service Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-22713"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-10T21:15:00Z",
"severity": "MODERATE"
},
"details": "Windows Hyper-V Denial of Service Vulnerability.",
"id": "GHSA-ghrh-mw3v-vggj",
"modified": "2025-01-02T21:31:32Z",
"published": "2022-05-11T00:01:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22713"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22713"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22713"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GHRQ-5WPP-HXX5
Vulnerability from github – Published: 2026-07-31 16:20 – Updated: 2026-07-31 16:20Summary
A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.
Impact
All wings users with an open SFTP port.
Workarounds
Close SFTP port.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/pterodactyl/wings"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-52856"
],
"database_specific": {
"cwe_ids": [
"CWE-129",
"CWE-20",
"CWE-248",
"CWE-400",
"CWE-617",
"CWE-755"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T16:20:25Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nA maliciously crafted packet received \u0026 parsed during the SFTP connection handshake will cause a Go panic.\n\n### Impact\nAll wings users with an open SFTP port.\n\n### Workarounds\nClose SFTP port.",
"id": "GHSA-ghrq-5wpp-hxx5",
"modified": "2026-07-31T16:20:25Z",
"published": "2026-07-31T16:20:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pterodactyl/wings/security/advisories/GHSA-ghrq-5wpp-hxx5"
},
{
"type": "WEB",
"url": "https://github.com/pterodactyl/wings/commit/8e49c7c0eda815d3ada171831876a1c14c493026"
},
{
"type": "PACKAGE",
"url": "https://github.com/pterodactyl/wings"
},
{
"type": "WEB",
"url": "https://github.com/pterodactyl/wings/releases/tag/v1.13.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service"
}
GHSA-GHRR-GJMC-QQ88
Vulnerability from github – Published: 2025-05-14 21:31 – Updated: 2025-05-15 15:31An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, W1000, Modem 5300, and Modem 5400. Incorrect handling of undefined values leads to a Denial of Service.
{
"affected": [],
"aliases": [
"CVE-2025-26783"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-14T21:15:58Z",
"severity": "HIGH"
},
"details": "An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, W1000, Modem 5300, and Modem 5400. Incorrect handling of undefined values leads to a Denial of Service.",
"id": "GHSA-ghrr-gjmc-qq88",
"modified": "2025-05-15T15:31:24Z",
"published": "2025-05-14T21:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26783"
},
{
"type": "WEB",
"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates"
},
{
"type": "WEB",
"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26783"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GHVC-7HP8-2G2V
Vulnerability from github – Published: 2026-06-12 12:31 – Updated: 2026-08-12 18:43There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-core"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-core"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-50645"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-06T19:12:38Z",
"nvd_published_at": "2026-06-12T10:16:23Z",
"severity": "HIGH"
},
"details": "There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.",
"id": "GHSA-ghvc-7hp8-2g2v",
"modified": "2026-08-12T18:43:59Z",
"published": "2026-06-12T12:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50645"
},
{
"type": "WEB",
"url": "https://cxf.apache.org/security-advisories.data/CVE-2026-50645.txt"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/cxf"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/24zb7cqcvykhwm0j797dmdq25s61mj93"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/06/11/12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache cxf-core: No restriction on attachment headers per message"
}
GHSA-GHWQ-2RG5-C7J8
Vulnerability from github – Published: 2026-07-24 15:33 – Updated: 2026-07-24 21:32It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue.
{
"affected": [],
"aliases": [
"CVE-2026-66143"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-24T13:18:29Z",
"severity": "HIGH"
},
"details": "It is possible to bypass the\u00a0maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption.\u00a0Users are recommended to upgrade to version 3.2.3, which fixes this issue.",
"id": "GHSA-ghwq-2rg5-c7j8",
"modified": "2026-07-24T21:32:22Z",
"published": "2026-07-24T15:33:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66143"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/s6o6p5pvcbcsk54dlg6j699t5gxol28w"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/07/24/9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.