CWE-400 · Denial of Service
Uncontrolled Resource Consumption
3,673CVEs
7exploited
3with a public check
93likely (EPSS 10%+)
SortMost likely exploited
3,673 CVEs with CWE-400 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-44487In CISA KEVExploitedThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August throug…IETF · HTTP/2 · CVSS 7.5 · 2023-10-10 | 7.5 | 100% | 2023-10-10 |
| CVE-2026-28318In CISA KEVExploitedSolarWinds Serv-U - Denial of ServiceSolarWinds · Serv-U · CVSS 7.5 · 2026-06-04 | 7.5 | 87% | 2026-06-04 |
| CVE-2026-45498In CISA KEVExploitedMicrosoft Defender Denial of Service VulnerabilityMicrosoft · Microsoft Defender Antimalware Platform · CVSS 4 · 2026-05-20 | 4.0 | 63% | 2026-05-20 |
| CVE-2023-38180In CISA KEVExploited.NET and Visual Studio Denial of Service VulnerabilityMicrosoft · .NET 6.0 · CVSS 7.5 · 2023-08-08 | 7.5 | 14% | 2023-08-08 |
| CVE-2004-1464In CISA KEVExploitedCisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or rev…Cisco · IOS · CVSS 5.9 · 2005-02-13 | 5.9 | 4.8% | 2005-02-13 |
| CVE-2020-3566In CISA KEVExploitedCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityCisco · Cisco IOS XR Software · CVSS 8.6 · 2020-08-29 | 8.6 | 3.7% | 2020-08-29 |
| CVE-2020-3569In CISA KEVExploitedCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilitiesCisco · Cisco IOS XR Software · CVSS 8.6 · 2020-09-23 | 8.6 | 3.4% | 2020-09-23 |
| CVE-2011-0762Checkvsftpd < 2.3.3 - DoSVsftpd Project · Vsftpd · 2011-03-02 | – | 74% | 2011-03-02 |
| CVE-2019-20176CheckPure-FTPd < 1.0.50 - DoS via Resource ExhaustionPureftpd · Pure-Ftpd · 2019-12-31 | – | 4.4% | 2019-12-31 |
| CVE-2026-38361Checkdash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunksFohrloop · Dash-Uploader · CVSS 7.5 · 2026-05-08 | 7.5 | 2.6% | 2026-05-08 |
| CVE-2011-3192The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumpti…Apache · Http Server · 2011-08-29 | – | 99% | 2011-08-29 |
| CVE-2023-45288HTTP/2 CONTINUATION flood in net/httpGo standard library · net/http · CVSS 7.5 · 2024-04-04 | 7.5 | 89% | 2024-04-04 |
| CVE-2024-25617Denial of Service in HTTP Header parser in squid proxysquid-cache · squid · CVSS 5.3 · 2024-02-14 | 5.3 | 89% | 2024-02-14 |
| CVE-2018-1000115Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that c…Memcached · Memcached · 2018-03-05 | – | 88% | 2018-03-05 |
| CVE-2019-9515Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceApache · Traffic Server · CVSS 7.5 · 2019-08-13 | 7.5 | 87% | 2019-08-13 |
| CVE-2019-9512Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of serviceApache · Traffic Server · CVSS 7.5 · 2019-08-13 | 7.5 | 83% | 2019-08-13 |
| CVE-2019-9514Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceApache · Traffic Server · CVSS 7.5 · 2019-08-13 | 7.5 | 83% | 2019-08-13 |
| CVE-2009-2521Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service…Microsoft · Internet Information Services · 2009-09-04 | – | 82% | 2009-09-04 |
| CVE-2019-9513Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of serviceApache · Traffic Server · CVSS 7.5 · 2019-08-13 | 7.5 | 82% | 2019-08-13 |
| CVE-2023-28342Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.Zohocorp · Manageengine Adselfservice Plus · CVSS 7.5 · 2023-04-05 | 7.5 | 78% | 2023-04-05 |
| CVE-2021-21341XStream can cause a Denial of Servicex-stream · xstream · CVSS 7.5 · 2021-03-22 | 7.5 | 78% | 2021-03-22 |
| CVE-2003-0714The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP serv…Microsoft · Exchange Server · 2003-10-17 | – | 78% | 2003-10-17 |
| CVE-2021-22883Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This…NodeJS · Node · 2021-03-03 | – | 77% | 2021-03-03 |
| CVE-2023-50868The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA…Powerdns · Recursor · CVSS 7.5 · 2024-02-14 | 7.5 | 74% | 2024-02-14 |
| CVE-2022-29885EncryptInterceptor does not provide complete protection on insecure networksApache Software Foundation · Apache Tomcat · 2022-05-12 | – | 73% | 2022-05-12 |
| CVE-2019-0199The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep str…Apache · Apache Tomcat · 2019-04-10 | – | 73% | 2019-04-10 |
| CVE-2017-3144Failure to properly clean up closed OMAPI connections can exhaust available socketsISC · ISC DHCP · CVSS 5.3 · 2019-01-16 | 5.3 | 73% | 2019-01-16 |
| CVE-2018-6389In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script…Wordpress · Wordpress · 2018-02-06 | – | 73% | 2018-02-06 |
| CVE-2018-5390Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of…Linux · Linux Kernel · 2018-08-06 | – | 72% | 2018-08-06 |
| CVE-2023-36606Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.5 · 2023-10-10 | 7.5 | 69% | 2023-10-10 |
| CVE-2023-43622Apache HTTP Server: DoS in HTTP/2 with initial windows size 0Apache Software Foundation · Apache HTTP Server · 2023-10-23 | – | 69% | 2023-10-23 |
| CVE-2019-15226Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The im…Envoyproxy · Envoy · 2019-10-09 | – | 65% | 2019-10-09 |
| CVE-2024-26212DHCP Server Service Denial of Service VulnerabilityMicrosoft · Windows Server 2019 · CVSS 7.5 · 2024-04-09 | 7.5 | 63% | 2024-04-09 |
| CVE-2023-24580An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of…Djangoproject · Django · CVSS 7.5 · 2023-02-15 | 7.5 | 63% | 2023-02-15 |
| CVE-2019-9511Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serviceApache · Traffic Server · CVSS 7.5 · 2019-08-13 | 7.5 | 60% | 2019-08-13 |
| CVE-2006-1364Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause…Microsoft · Asp.net · 2006-03-23 | – | 59% | 2006-03-23 |
| CVE-2019-9516Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of serviceApache · Traffic Server · CVSS 7.5 · 2019-08-13 | 7.5 | 57% | 2019-08-13 |
| CVE-2020-8277A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1…NodeJS · Node · 2020-11-19 | – | 54% | 2020-11-19 |
| CVE-2021-28165In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.The Eclipse Foundation · Eclipse Jetty · CVSS 7.5 · 2021-04-01 | 7.5 | 54% | 2021-04-01 |
| CVE-2018-17281There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk t…Digium · Asterisk · 2018-09-24 | – | 52% | 2018-09-24 |
| CVE-2019-5645Rapid7 Metasploit HTTP Handler Denial of ServiceRapid7 · Metasploit Framework · CVSS 7.5 · 2020-09-01 | 7.5 | 49% | 2020-09-01 |
| CVE-2018-16843nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with…F5 · nginx · CVSS 5.3 · 2018-11-07 | 5.3 | 48% | 2018-11-07 |
| CVE-2022-31698The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this…Vmware · VMware vCenter Server, VMware Cloud Foundation · CVSS 5.3 · 2022-12-13 | 5.3 | 48% | 2022-12-13 |
| CVE-2024-5011WhatsUp Gold TestController Chart denial of service vulnerabilityProgress Software Corporation · WhatsUp Gold · CVSS 7.5 · 2024-06-25 | 7.5 | 47% | 2024-06-25 |
| CVE-2020-2039PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file uploadPalo Alto Networks · PAN-OS · CVSS 5.3 · 2020-09-09 | 5.3 | 46% | 2020-09-09 |
| CVE-2018-12122Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers ver…The Node.js Project · Node.js · 2018-11-28 | – | 41% | 2018-11-28 |
| CVE-2016-8610A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection…OpenSSL · OpenSSL · 2017-11-13 | – | 40% | 2017-11-13 |
| CVE-2014-0118The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attack…Apache · Http Server · 2014-07-20 | – | 37% | 2014-07-20 |
| CVE-2017-6019An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid requests to the device may cause it to…Schneider-Electric · Schneider Electric Conext ComBox · 2017-04-07 | – | 37% | 2017-04-07 |
| CVE-2023-26601Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS…Zohocorp · Manageengine Servicedesk Plus · 2023-03-06 | – | 34% | 2023-03-06 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.