CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5435 vulnerabilities reference this CWE, most recent first.
GHSA-P68V-FRGX-4RJP
Vulnerability from github – Published: 2020-10-19 21:34 – Updated: 2020-10-19 21:34Impact
Denial of Service via Cache Flooding
Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.3.2.0"
},
"package": {
"ecosystem": "Packagist",
"name": "shopware/platform"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.3.2.0"
},
"package": {
"ecosystem": "Packagist",
"name": "shopware/core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2020-10-19T21:34:01Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Impact\n Denial of Service via Cache Flooding\n\n### Patches\nWe recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n### Workarounds\nFor older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:\n\nhttps://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659\n\n### For more information\nhttps://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020",
"id": "GHSA-p68v-frgx-4rjp",
"modified": "2020-10-19T21:34:01Z",
"published": "2020-10-19T21:34:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/shopware/platform/security/advisories/GHSA-p68v-frgx-4rjp"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Denial of Service via Cache Flooding"
}
GHSA-P68X-Q9G7-4CGG
Vulnerability from github – Published: 2022-05-13 01:28 – Updated: 2022-05-13 01:28An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
{
"affected": [],
"aliases": [
"CVE-2015-9253"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-19T19:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.",
"id": "GHSA-p68x-q9g7-4cgg",
"modified": "2022-05-13T01:28:18Z",
"published": "2022-05-13T01:28:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9253"
},
{
"type": "WEB",
"url": "https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=70185"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=73342https://github.com/php/php-src/pull/3287"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=75968"
},
{
"type": "WEB",
"url": "https://github.com/php/php-src/blob/PHP-7.1.20/NEWS#L20-L22"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3766-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4279-1"
},
{
"type": "WEB",
"url": "https://www.futureweb.at/security/CVE-2015-9253"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P696-W4F9-FQC3
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23The authoritative server in MaraDNS through 2.0.04 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which might allow local users to cause a denial of service (CPU consumption) via crafted records in zone files, a different vulnerability than CVE-2012-0024.
{
"affected": [],
"aliases": [
"CVE-2011-5056"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-01-08T00:55:00Z",
"severity": "LOW"
},
"details": "The authoritative server in MaraDNS through 2.0.04 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which might allow local users to cause a denial of service (CPU consumption) via crafted records in zone files, a different vulnerability than CVE-2012-0024.",
"id": "GHSA-p696-w4f9-fqc3",
"modified": "2022-05-13T01:23:30Z",
"published": "2022-05-13T01:23:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5056"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72258"
},
{
"type": "WEB",
"url": "http://samiam.org/blog/20111229.html"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1026820"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-P697-P3X9-JRVR
Vulnerability from github – Published: 2022-05-14 04:03 – Updated: 2022-05-14 04:03Prior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service (DoS) exploit. A DoS attack is a type of attack whereby the perpetrator attempts to make a particular device unavailable to its intended user by temporarily or indefinitely disrupting services of a specific host within a network.
{
"affected": [],
"aliases": [
"CVE-2017-15529"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-13T19:29:00Z",
"severity": "MODERATE"
},
"details": "Prior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service (DoS) exploit. A DoS attack is a type of attack whereby the perpetrator attempts to make a particular device unavailable to its intended user by temporarily or indefinitely disrupting services of a specific host within a network.",
"id": "GHSA-p697-p3x9-jrvr",
"modified": "2022-05-14T04:03:22Z",
"published": "2022-05-14T04:03:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15529"
},
{
"type": "WEB",
"url": "https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=\u0026suid=20171213_00"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102119"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P6FG-723F-HGPW
Vulnerability from github – Published: 2022-12-28 03:30 – Updated: 2023-01-10 15:58Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/shiyanhui/dht"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.0-20201219151056-5a20f3199263"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-36562"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-617"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-30T19:48:43Z",
"nvd_published_at": "2022-12-28T03:15:00Z",
"severity": "HIGH"
},
"details": "Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector.",
"id": "GHSA-p6fg-723f-hgpw",
"modified": "2023-01-10T15:58:24Z",
"published": "2022-12-28T03:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36562"
},
{
"type": "WEB",
"url": "https://github.com/shiyanhui/dht/issues/57"
},
{
"type": "PACKAGE",
"url": "https://github.com/shiyanhui/dht"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2020-0040"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "shiyanhui/dht vulnerable to Uncontrolled Resource Consumption"
}
GHSA-P6HW-8JFC-QQ89
Vulnerability from github – Published: 2024-02-17 03:30 – Updated: 2025-11-04 21:31Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
{
"affected": [],
"aliases": [
"CVE-2024-20978"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-17T02:15:51Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
"id": "GHSA-p6hw-8jfc-qq89",
"modified": "2025-11-04T21:31:10Z",
"published": "2024-02-17T03:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20978"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240201-0003"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2024.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P6J8-HGV5-M35G
Vulnerability from github – Published: 2022-03-18 17:58 – Updated: 2022-03-18 17:58A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.0.19.Final"
},
"package": {
"ecosystem": "Maven",
"name": "org.jboss.remoting:jboss-remoting"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.20.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-35510"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-03T20:38:29Z",
"nvd_published_at": "2021-06-02T14:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"id": "GHSA-p6j8-hgv5-m35g",
"modified": "2022-03-18T17:58:30Z",
"published": "2022-03-18T17:58:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35510"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1905796"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncontrolled Resource Consumption in jboss-remoting"
}
GHSA-P6M5-H7PP-V2X5
Vulnerability from github – Published: 2022-05-02 03:47 – Updated: 2024-09-16 21:57Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.0"
},
{
"fixed": "1.0.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.1"
},
{
"fixed": "1.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2009-3695"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-08T22:00:20Z",
"nvd_published_at": "2009-10-13T10:30:00Z",
"severity": "HIGH"
},
"details": "Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.",
"id": "GHSA-p6m5-h7pp-v2x5",
"modified": "2024-09-16T21:57:14Z",
"published": "2022-05-02T03:47:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3695"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/594a28a9044120bed58671dde8a805c9e0f6c79a"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/e3e992e18b368fcd56aabafc1b5bf80a6e11b495"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53727"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2009-4.yaml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20091013093057/http://secunia.com/advisories/36968"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20091017070244/http://secunia.com/advisories/36948"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200228171918/http://www.securityfocus.com/bid/36655"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550457"
},
{
"type": "WEB",
"url": "http://groups.google.com/group/django-users/browse_thread/thread/15df9e45118dfc51"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2009/dsa-1905"
},
{
"type": "WEB",
"url": "http://www.djangoproject.com/weblog/2009/oct/09/security"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/10/13/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Django Regex Algorithmic Complexity Causes Denial of Service"
}
GHSA-P6MC-XXVV-R37F
Vulnerability from github – Published: 2024-05-08 03:30 – Updated: 2024-05-08 03:30No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions.
There is no limit on how many sessions D-Bus clients may create using the open_session() D-Bus method. For each session a thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further connections will become impossible, likely because no more threads can be spawned by the D-Bus service.
{
"affected": [],
"aliases": [
"CVE-2024-1930"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-08T02:15:09Z",
"severity": "MODERATE"
},
"details": "No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via\u00a0No Limit on Number of Open Sessions.\n\nThere is no limit on how many sessions D-Bus clients may create using the `open_session()` D-Bus method.\u00a0For each session a thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further connections will become impossible, likely because no more threads can be spawned by the D-Bus service.\n\n",
"id": "GHSA-p6mc-xxvv-r37f",
"modified": "2024-05-08T03:30:37Z",
"published": "2024-05-08T03:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1930"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2024/03/04/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P6RM-V297-GPF4
Vulnerability from github – Published: 2025-03-12 21:31 – Updated: 2025-10-22 21:31A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the service unavailable by sending a large number of specially crafted packets over a period of time. This issue affects both the GlobalProtect portal and the GlobalProtect gateway.
This issue does not apply to Cloud NGFWs or Prisma Access software.
{
"affected": [],
"aliases": [
"CVE-2025-0114"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-12T19:15:37Z",
"severity": "HIGH"
},
"details": "A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the service unavailable by sending a large number of specially crafted packets over a period of time. This issue affects both the GlobalProtect portal and the GlobalProtect gateway.\n\nThis issue does not apply to Cloud NGFWs or Prisma Access software.",
"id": "GHSA-p6rm-v297-gpf4",
"modified": "2025-10-22T21:31:18Z",
"published": "2025-03-12T21:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0114"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2025-0114"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:X/U:Amber",
"type": "CVSS_V4"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.