CWE-405 · weakness in Denial of Service
Asymmetric Resource Consumption (Amplification)
72 CVEs
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- likely to be exploited
- 4
Every one of the 72 is a mark on the map. Named now: 1 to 26, most at risk first.
- Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger…
- HTTP.sys Denial of Service Vulnerability
- Many records in the additional section cause CPU exhaustion
- Resource exhaustion via malformed DNSKEY handling
- OCI OpenDDS Secure Amplification
- A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
- .NET Denial of Service Vulnerability
- Non-linear parsing of case-insensitive content in golang.org/x/net/html
- Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
- Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification
- .NET Denial of Service Vulnerability
- HTTP/2 server memory exhaustion due to Trailer headers in net/http
- Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server
- Excessive CPU consumption from repeated initial window changes in net/http
- Botan has a Denial of Service Due to Excessive Name Constraints
- Apache Struts: Disproportionate response size when rendering BigDecimal request parameters
- Mastodon: Exhausting data by an unauthenticated request to the admin retention API
- body-parser vulnerable to denial of service when url encoding is enabled
- jwt-go allows excessive memory allocation during header parsing
- Reject malformed ECH outer extension references in crypto/tls
- UDP traffic amplification via fastd's fast reconnect feature
- Suricata oversized resource names utilizing DNS name compression can lead to resource starvation
- Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
- Frontend DoS via the popup.testtriggerexpr action
- devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
- devalue vulnerable to denial of service due to memory exhaustion in devalue.parse
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.