Skip to content
BackEsc
Sign in

CWE-400 · weakness in Denial of Service

Uncontrolled Resource Consumption

3,673 CVEs · 7 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
7
check available
3
likely to be exploited
93

Every one of the 3,673 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August throug…CVE-2023-44487IETF · CVSS 7.5 · 100% likely

    IETF

  2. Microsoft Defender Denial of Service VulnerabilityCVE-2026-45498Microsoft · CVSS 4 · 63% likelycovered by CyberSIXT

    Microsoft

  3. SolarWinds Serv-U - Denial of ServiceCVE-2026-28318SolarWinds · CVSS 7.5 · 48% likelycovered by CyberSIXT

    SolarWinds

  4. .NET and Visual Studio Denial of Service VulnerabilityCVE-2023-38180Microsoft · CVSS 7.5 · 14% likely

    Microsoft

  5. Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or rev…CVE-2004-1464Cisco · CVSS 5.9 · 4.8% likely

    Cisco

  6. Cisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityCVE-2020-3566Cisco · CVSS 8.6 · 3.7% likely

    Cisco

  7. Cisco IOS XR Software DVMRP Memory Exhaustion VulnerabilitiesCVE-2020-3569Cisco · CVSS 8.6 · 3.4% likely

    Cisco

  8. vsftpd < 2.3.3 - DoSCVE-2011-076274% likely
  9. Pure-FTPd < 1.0.50 - DoS via Resource ExhaustionCVE-2019-201764.4% likely
  10. dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunksCVE-2026-38361Fohrloop · CVSS 7.5 · 2.6% likely
  11. The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumpti…CVE-2011-319299% likely
  12. HTTP/2 CONTINUATION flood in net/httpCVE-2023-45288Go standard library · CVSS 7.5 · 89% likely

    Go standard library

  13. Denial of Service in HTTP Header parser in squid proxyCVE-2024-25617squid-cache · CVSS 5.3 · 88% likely

    Squid-Cache

  14. Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that c…CVE-2018-100011588% likely
  15. Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceCVE-2019-9515CVSS 7.5 · 87% likely
  16. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of serviceCVE-2019-9512CVSS 7.5 · 83% likely
  17. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceCVE-2019-9514CVSS 7.5 · 83% likely
  18. Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service…CVE-2009-252182% likely
  19. Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of serviceCVE-2019-9513CVSS 7.5 · 82% likely
  20. Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.CVE-2023-28342CVSS 7.5 · 78% likely
  21. XStream can cause a Denial of ServiceCVE-2021-21341x-stream · CVSS 7.5 · 78% likely

    X-Stream

  22. The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP serv…CVE-2003-071478% likely
  23. Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This…CVE-2021-22883NodeJS · 77% likely

    Node.js

  24. The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA…CVE-2023-50868CVSS 7.5 · 74% likely
  25. EncryptInterceptor does not provide complete protection on insecure networksCVE-2022-29885Apache Software Foundation · 73% likely

    Apache

  26. The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep str…CVE-2019-0199Apache Tomcat · 73% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in