CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
6475 vulnerabilities reference this CWE, most recent first.
GHSA-JR22-8QGM-4Q87
Vulnerability from github – Published: 2024-03-02 00:31 – Updated: 2026-05-08 18:24Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f2qx-66wf-wvvx. This link is maintained to preserve external references.
Original Description
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpseclib/phpseclib"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.36"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpseclib/phpseclib"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.47"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpseclib/phpseclib"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.23"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-04T20:42:19Z",
"nvd_published_at": "2024-03-01T23:15:08Z",
"severity": "HIGH"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-f2qx-66wf-wvvx. This link is maintained to preserve external references.\n\n### Original Description\nAn issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).",
"id": "GHSA-jr22-8qgm-4q87",
"modified": "2026-05-08T18:24:10Z",
"published": "2024-03-02T00:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27355"
},
{
"type": "WEB",
"url": "https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59"
},
{
"type": "WEB",
"url": "https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2024-27355.yaml"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-jr22-8qgm-4q87"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpseclib/phpseclib"
},
{
"type": "WEB",
"url": "https://github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: phpseclib does not properly limit the ASN1 OID length",
"withdrawn": "2026-05-08T18:24:10Z"
}
GHSA-JR6H-R7VG-F9MC
Vulnerability from github – Published: 2022-10-12 12:00 – Updated: 2025-06-09 18:35An issue in the fetch() method in the BasicProfile class of org.ini4j before v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.ini4j:ini4j"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.5.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-41404"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-18T17:07:30Z",
"nvd_published_at": "2022-10-11T23:15:00Z",
"severity": "HIGH"
},
"details": "An issue in the fetch() method in the BasicProfile class of org.ini4j before v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.",
"id": "GHSA-jr6h-r7vg-f9mc",
"modified": "2025-06-09T18:35:25Z",
"published": "2022-10-12T12:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41404"
},
{
"type": "WEB",
"url": "https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2022/CVE-2022-41404"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00037.html"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/ini4j/bugs/56"
},
{
"type": "WEB",
"url": "https://sourceforge.net/projects/ini4j"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "org.ini4j allows attackers to cause a Denial of Service (DoS) "
}
GHSA-JR77-8GX4-H5QH
Vulnerability from github – Published: 2022-11-11 12:00 – Updated: 2022-11-16 00:04Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. This issue has been patched in version 2.1.1.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/shamaton/msgpack/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-41719"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-16T00:04:13Z",
"nvd_published_at": "2022-11-10T20:15:00Z",
"severity": "HIGH"
},
"details": "Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. This issue has been patched in version 2.1.1.",
"id": "GHSA-jr77-8gx4-h5qh",
"modified": "2022-11-16T00:04:13Z",
"published": "2022-11-11T12:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41719"
},
{
"type": "WEB",
"url": "https://github.com/shamaton/msgpack/issues/31"
},
{
"type": "WEB",
"url": "https://github.com/shamaton/msgpack/pull/32"
},
{
"type": "PACKAGE",
"url": "https://github.com/shamaton/msgpack"
},
{
"type": "WEB",
"url": "https://github.com/shamaton/msgpack/releases/tag/v2.1.1"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0972"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "MessagePack for Golang subject to DoS via Unmarshal panic"
}
GHSA-JR79-GH2G-M9RV
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12.9 for Windows, tvOS 12. Unexpected interaction causes an ASSERT failure.
{
"affected": [],
"aliases": [
"CVE-2018-4474"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-27T20:15:00Z",
"severity": "HIGH"
},
"details": "A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12.9 for Windows, tvOS 12. Unexpected interaction causes an ASSERT failure.",
"id": "GHSA-jr79-gh2g-m9rv",
"modified": "2022-05-24T17:32:14Z",
"published": "2022-05-24T17:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4474"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209106"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209107"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209108"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209109"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209140"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT209141"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JR7J-5WRW-QXV3
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35Receipt of a specific MPLS packet may cause MPC7/8/9, PTX-FPC3 (FPC-P1, FPC-P2) line cards or PTX1K to crash and restart. By continuously sending specific MPLS packets, an attacker can repeatedly crash the line cards or PTX1K causing a sustained Denial of Service. Affected releases are Juniper Networks Junos OS with MPC7/8/9 or PTX-FPC3 (FPC-P1, FPC-P2) installed and PTX1K: 15.1F versions prior to 15.1F6-S10; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 16.1 versions prior to 16.1R3-S8, 16.1R4-S9, 16.1R5-S4, 16.1R6-S3, 16.1R7; 16.1X65 versions prior to 16.1X65-D46; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S4, 17.2R2-S4, 17.2R3; 17.2X75 versions prior to 17.2X75-D70, 17.2X75-D90; 17.3 versions prior to 17.3R1-S4, 17.3R2, 17.4 versions prior to 17.4R1-S2, 17.4R2. Refer to KB25385 for more information about PFE line cards.
{
"affected": [],
"aliases": [
"CVE-2018-0030"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-11T18:29:00Z",
"severity": "HIGH"
},
"details": "Receipt of a specific MPLS packet may cause MPC7/8/9, PTX-FPC3 (FPC-P1, FPC-P2) line cards or PTX1K to crash and restart. By continuously sending specific MPLS packets, an attacker can repeatedly crash the line cards or PTX1K causing a sustained Denial of Service. Affected releases are Juniper Networks Junos OS with MPC7/8/9 or PTX-FPC3 (FPC-P1, FPC-P2) installed and PTX1K: 15.1F versions prior to 15.1F6-S10; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 16.1 versions prior to 16.1R3-S8, 16.1R4-S9, 16.1R5-S4, 16.1R6-S3, 16.1R7; 16.1X65 versions prior to 16.1X65-D46; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S4, 17.2R2-S4, 17.2R3; 17.2X75 versions prior to 17.2X75-D70, 17.2X75-D90; 17.3 versions prior to 17.3R1-S4, 17.3R2, 17.4 versions prior to 17.4R1-S2, 17.4R2. Refer to KB25385 for more information about PFE line cards.",
"id": "GHSA-jr7j-5wrw-qxv3",
"modified": "2022-05-13T01:35:58Z",
"published": "2022-05-13T01:35:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0030"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/JSA10864"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/KB25385"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041325"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JR9F-6CWX-MFJG
Vulnerability from github – Published: 2024-07-31 21:32 – Updated: 2024-07-31 21:32A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API request.
{
"affected": [],
"aliases": [
"CVE-2022-4003"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T21:15:14Z",
"severity": "LOW"
},
"details": "A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API request.",
"id": "GHSA-jr9f-6cwx-mfjg",
"modified": "2024-07-31T21:32:38Z",
"published": "2024-07-31T21:32:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4003"
},
{
"type": "WEB",
"url": "https://en-us.support.motorola.com/app/answers/detail/a_id/176952/~/motorola-q14-mesh-router-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-JRF8-CMGG-GV2M
Vulnerability from github – Published: 2021-08-25 20:53 – Updated: 2023-06-13 20:29native_cpuid::cpuid_count() exposes the unsafe __cpuid_count() intrinsic from core::arch::x86 or core::arch::x86_64 as a safe function, and uses it internally, without checking the safety requirement:
- The CPU the program is currently running on supports the function being called.
CPUID is available in most, but not all, x86/x86_64 environments. The crate compiles only on these architectures, so others are unaffected. This issue is mitigated by the fact that affected programs are expected to crash deterministically every time.
The flaw has been fixed in v9.0.0, by intentionally breaking compilation when targeting SGX or 32-bit x86 without SSE. This covers all affected CPUs.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "raw-cpuid"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-26307"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-657"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T18:02:32Z",
"nvd_published_at": "2021-01-29T03:15:00Z",
"severity": "MODERATE"
},
"details": "native_cpuid::cpuid_count() exposes the unsafe __cpuid_count() intrinsic from core::arch::x86 or core::arch::x86_64 as a safe function, and uses it internally, without checking the safety requirement:\n\n* The CPU the program is currently running on supports the function being called.\n\nCPUID is available in most, but not all, x86/x86_64 environments. The crate compiles only on these architectures, so others are unaffected. This issue is mitigated by the fact that affected programs are expected to crash deterministically every time.\n\nThe flaw has been fixed in v9.0.0, by intentionally breaking compilation when targeting SGX or 32-bit x86 without SSE. This covers all affected CPUs.",
"id": "GHSA-jrf8-cmgg-gv2m",
"modified": "2023-06-13T20:29:54Z",
"published": "2021-08-25T20:53:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26307"
},
{
"type": "WEB",
"url": "https://github.com/gz/rust-cpuid/issues/40"
},
{
"type": "WEB",
"url": "https://github.com/gz/rust-cpuid/issues/41"
},
{
"type": "WEB",
"url": "https://github.com/RustSec/advisory-db/pull/614"
},
{
"type": "WEB",
"url": "https://github.com/gz/rust-cpuid/commit/91b676eecd01f2163e2984215e2c0ac89e30ce75"
},
{
"type": "PACKAGE",
"url": "https://github.com/gz/rust-cpuid"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2021-0013.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Error on unsupported architectures in raw-cpuid"
}
GHSA-JRFJ-98QG-QJGV
Vulnerability from github – Published: 2022-01-27 14:42 – Updated: 2023-01-24 15:46In api.rb in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "sidekiq"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "sidekiq"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-23837"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-24T22:50:23Z",
"nvd_published_at": "2022-01-21T21:15:00Z",
"severity": "HIGH"
},
"details": "In `api.rb` in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.",
"id": "GHSA-jrfj-98qg-qjgv",
"modified": "2023-01-24T15:46:01Z",
"published": "2022-01-27T14:42:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23837"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/pull/495"
},
{
"type": "WEB",
"url": "https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956"
},
{
"type": "WEB",
"url": "https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md"
},
{
"type": "PACKAGE",
"url": "https://github.com/mperham/sidekiq"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Denial of service in sidekiq"
}
GHSA-JRFJ-FHJ2-JJVM
Vulnerability from github – Published: 2026-10-07 20:23 – Updated: 2026-10-07 20:23Opening a file whose first eight bytes are the OLE magic number sends excelize down the decryption path whether or not the caller set a password, or supports encrypted workbooks at all. openReaderAt (excelize.go:198-215) branches on the header alone, and agileDecrypt calls convertPasswdToKey before the verifier hash is checked, so the key-derivation loop runs spinCount times regardless.
spinCount (crypt.go:98) is a plain int filled by a bare xml.Unmarshal of the file's own EncryptionInfo stream. Nothing bounds it.
A 3072-byte file with spinCount 100000000 makes OpenFile take 58.65s on v2.11.0 with default options, then return zip: not a valid zip file. It is linear at about 0.6 microseconds per iteration and the attacker picks the number, so 1e9 is roughly ten minutes. Nothing on the path takes a context.Context, so the caller cannot cancel it; in an HTTP handler the write timeout returns a response while the goroutine keeps spinning. Memory stays flat at 24 MB, so nothing reclaims it either.
v2.5.0 spinCount=10000000 5.307s
v2.9.1 spinCount=10000000 5.444s
v2.11.0 spinCount=10000000 7.529s
v2.11.0 spinCount=100000000 58.654s
The loop arrived with crypt.go in v2.3.1 and is unchanged through v2.11.0.
Excel and LibreOffice write spinCount 100000, which costs 61ms here, so a ceiling well above the legitimate value would cost real files nothing.
This is availability only, and it is not a vulnerability for a program that only opens files its own operator produced.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/xuri/excelize/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.1"
},
{
"fixed": "2.11.1-0.20260906004932-2badfcd5841d"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-107219"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-07T20:23:22Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Opening a file whose first eight bytes are the OLE magic number sends excelize down the decryption path whether or not the caller set a password, or supports encrypted workbooks at all. `openReaderAt` (excelize.go:198-215) branches on the header alone, and `agileDecrypt` calls `convertPasswdToKey` before the verifier hash is checked, so the key-derivation loop runs `spinCount` times regardless.\n\n`spinCount` (crypt.go:98) is a plain `int` filled by a bare `xml.Unmarshal` of the file\u0027s own EncryptionInfo stream. Nothing bounds it.\n\nA 3072-byte file with spinCount 100000000 makes `OpenFile` take 58.65s on v2.11.0 with default options, then return `zip: not a valid zip file`. It is linear at about 0.6 microseconds per iteration and the attacker picks the number, so 1e9 is roughly ten minutes. Nothing on the path takes a `context.Context`, so the caller cannot cancel it; in an HTTP handler the write timeout returns a response while the goroutine keeps spinning. Memory stays flat at 24 MB, so nothing reclaims it either.\n\n```\nv2.5.0 spinCount=10000000 5.307s\nv2.9.1 spinCount=10000000 5.444s\nv2.11.0 spinCount=10000000 7.529s\nv2.11.0 spinCount=100000000 58.654s\n```\n\nThe loop arrived with `crypt.go` in v2.3.1 and is unchanged through v2.11.0.\n\nExcel and LibreOffice write spinCount 100000, which costs 61ms here, so a ceiling well above the legitimate value would cost real files nothing. \n\nThis is availability only, and it is not a vulnerability for a program that only opens files its own operator produced.",
"id": "GHSA-jrfj-fhj2-jjvm",
"modified": "2026-10-07T20:23:22Z",
"published": "2026-10-07T20:23:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-jrfj-fhj2-jjvm"
},
{
"type": "WEB",
"url": "https://github.com/qax-os/excelize/pull/2389"
},
{
"type": "WEB",
"url": "https://github.com/qax-os/excelize/commit/2badfcd5841d0d88b0ffea119f5a2f3c53b4910b"
},
{
"type": "PACKAGE",
"url": "https://github.com/qax-os/excelize"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile"
}
GHSA-JRG5-JW7R-RXG9
Vulnerability from github – Published: 2025-06-19 12:30 – Updated: 2025-06-20 15:30ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2025-49763"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-19T10:15:21Z",
"severity": "HIGH"
},
"details": "ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.\n\nUsers can use a new setting for the plugin (--max-inclusion-depth) to limit it.\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.\n\nUsers are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.",
"id": "GHSA-jrg5-jw7r-rxg9",
"modified": "2025-06-20T15:30:36Z",
"published": "2025-06-19T12:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49763"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.