Skip to content
CVE Tracker

CWE-400: Uncontrolled resource consumption

4,167 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 8 of them as exploited in the wild.

All 4,167 in the listAtom feed of new CVEsWhat CWE-400 is, at MITRE (opens in a new tab)
Published CVEs
4,167
Last 12 months
1,557
Critical
65
Known exploited
8

Critical 65High 2,059Medium 1,906Low 130Not scored 7

CVEs per yearBy the year they were published

  1. 202018
  2. 20204
  3. 20214
  4. 202211
  5. 20225
  6. 2024246
  7. 2025415
  8. 20261,406
  9. 2026463
  10. 2026412
  11. 2026303
  12. 2026221

Known exploitedNewest addition to KEV first

  • CVE-2026-28318

    SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

    SolarWinds · Serv-U

    ExploitedHigh7.5
  • CVE-2026-45498

    Microsoft Defender Denial of Service Vulnerability

    Microsoft · Microsoft Defender Antimalware Platform

    ExploitedMedium4.0
  • CVE-2023-44487

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…

    Product not named

    ExploitedHigh7.5
  • CVE-2023-38180

    .NET and Visual Studio Denial of Service Vulnerability

    Microsoft · .NET 6.0

    ExploitedHigh7.5
  • CVE-2004-1464

    Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection…

    Product not named

    ExploitedMedium5.9
  • CVE-2021-44228

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    Apache Software Foundation · Apache Log4j2

    ExploitedCritical10.0
  • CVE-2020-3569

    Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities

    Cisco · Cisco IOS XR Software

    ExploitedHigh8.6
  • CVE-2020-3566

    Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

    Cisco · Cisco IOS XR Software

    ExploitedHigh8.6

Newest CVEs

  • CVE-2026-116668

    Tanium addressed an uncontrolled resource consumption vulnerability in Discover.

    Tanium · Discover

    Medium4.3
  • CVE-2026-111751

    Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

    angular · angular

    High8.2
  • CVE-2026-111752

    Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

    angular · angular

    High8.2
  • CVE-2026-63476

    isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)

    isomorphic-git · isomorphic-git

    Medium4.3
  • CVE-2026-121444

    svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph

    darylldoyle · svg-sanitizer

    High8.7
  • CVE-2026-121438

    Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing

    lepture · mistune

    Medium6.9
  • CVE-2026-121404

    FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA

    FreeRDP · FreeRDP

    High7.1
  • CVE-2026-49924

    In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. This could lead to…

    Google · Android

    Medium6.2
  • CVE-2026-117531

    @fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers

    @fastify/multipart · @fastify/multipart

    Medium5.9
  • CVE-2026-101174

    DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.

    Huawei · HarmonyOS

    Medium5.7

Vendors it comes up for most

  1. Oracle Corporation321
  2. Cisco118
  3. Microsoft113
  4. Apache Software Foundation81
  5. IBM70
  6. Apple65
  7. Red Hat60
  8. Juniper Networks53
  9. Linux44
  10. Google42