CWE-405 · Denial of Service
Asymmetric Resource Consumption (Amplification)
72CVEs
SortMost likely exploited
72 CVEs with CWE-405 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-11479Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger…Linux · Linux kernel · CVSS 5.3 · 2019-06-18 | 5.3 | 91% | 2019-06-18 |
| CVE-2026-49160HTTP.sys Denial of Service VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.5 · 2026-06-09 | 7.5 | 57% | 2026-06-09 |
| CVE-2024-11187Many records in the additional section cause CPU exhaustionISC · BIND 9 · CVSS 7.5 · 2025-01-29 | 7.5 | 16% | 2025-01-29 |
| CVE-2025-8677Resource exhaustion via malformed DNSKEY handlingISC · BIND 9 · CVSS 7.5 · 2025-10-22 | 7.5 | 11% | 2025-10-22 |
| CVE-2021-38447OCI OpenDDS Secure AmplificationOCI · OpenDDS · CVSS 8.6 · 2022-05-05 | 8.6 | 2.1% | 2022-05-05 |
| CVE-2018-15492A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.Gemalto · Sentinel License Manager · 2018-08-18 | – | 1.2% | 2018-08-18 |
| CVE-2026-96960.NET Denial of Service VulnerabilityMicrosoft · Microsoft .NET Framework 3.5 · CVSS 7.5 · 2026-10-13 | 7.5 | 1.2% | 2026-10-13 |
| CVE-2024-45338Non-linear parsing of case-insensitive content in golang.org/x/net/htmlgolang.org/x/net · golang.org/x/net/html · CVSS 5.3 · 2024-12-18 | 5.3 | 1.1% | 2024-12-18 |
| CVE-2026-111752Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)angular · angular · CVSS 8.2 · 2026-11-03 | 8.2 | 1.0% | 2026-11-03 |
| CVE-2026-47774Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationenvoyproxy · envoy · CVSS 7.5 · 2026-06-17 | 7.5 | 1.0% | 2026-06-17 |
| CVE-2026-70162.NET Denial of Service VulnerabilityMicrosoft · Microsoft Visual Studio 2022 version 17.14 · CVSS 5.9 · 2026-10-13 | 5.9 | 0.9% | 2026-10-13 |
| CVE-2026-78659HTTP/2 server memory exhaustion due to Trailer headers in net/httpGo standard library · net/http · CVSS 7.5 · 2026-10-08 | 7.5 | 0.9% | 2026-10-08 |
| CVE-2026-25611Pre-Authentication Memory Exhaustion Denial of Service in MongoDB ServerMongoDB Inc · MongoDB Server · CVSS 7.5 · 2026-02-10 | 7.5 | 0.9% | 2026-02-10 |
| CVE-2026-78669Excessive CPU consumption from repeated initial window changes in net/httpGo standard library · net/http · CVSS 7.5 · 2026-10-08 | 7.5 | 0.8% | 2026-10-08 |
| CVE-2024-34702Botan has a Denial of Service Due to Excessive Name Constraintsrandombit · botan · CVSS 5.3 · 2024-07-08 | 5.3 | 0.8% | 2024-07-08 |
| CVE-2026-104712Apache Struts: Disproportionate response size when rendering BigDecimal request parametersApache Software Foundation · Apache Struts · CVSS 7.5 · 2026-10-05 | 7.5 | 0.8% | 2026-10-05 |
| CVE-2026-72914Mastodon: Exhausting data by an unauthenticated request to the admin retention APImastodon · mastodon · CVSS 7.5 · 2026-08-10 | 7.5 | 0.8% | 2026-08-10 |
| CVE-2024-45590body-parser vulnerable to denial of service when url encoding is enabledexpressjs · body-parser · CVSS 7.5 · 2024-09-10 | 7.5 | 0.8% | 2024-09-10 |
| CVE-2025-30204jwt-go allows excessive memory allocation during header parsinggolang-jwt · jwt · CVSS 7.5 · 2025-03-21 | 7.5 | 0.8% | 2025-03-21 |
| CVE-2026-97031Reject malformed ECH outer extension references in crypto/tlsGo standard library · crypto/tls · CVSS 7.5 · 2026-10-08 | 7.5 | 0.7% | 2026-10-08 |
| CVE-2025-24356UDP traffic amplification via fastd's fast reconnect featureneocturne · fastd · CVSS 6.9 · 2025-01-27 | 6.9 | 0.7% | 2025-01-27 |
| CVE-2024-55628Suricata oversized resource names utilizing DNS name compression can lead to resource starvationOISF · suricata · CVSS 7.5 · 2025-01-06 | 7.5 | 0.7% | 2025-01-06 |
| CVE-2026-87011Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutopen-webui · open-webui · CVSS 7.5 · 2026-09-09 | 7.5 | 0.6% | 2026-09-09 |
| CVE-2026-23930Frontend DoS via the popup.testtriggerexpr actionZabbix · Zabbix · CVSS 5.3 · 2026-08-18 | 5.3 | 0.6% | 2026-08-18 |
| CVE-2026-22775devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parsesveltejs · devalue · CVSS 7.5 · 2026-01-15 | 7.5 | 0.6% | 2026-01-15 |
| CVE-2026-22774devalue vulnerable to denial of service due to memory exhaustion in devalue.parsesveltejs · devalue · CVSS 7.5 · 2026-01-15 | 7.5 | 0.6% | 2026-01-15 |
| CVE-2026-54874Excessive Memory Use Buffering DTLS Records for a Future EpochOpenSSL · OpenSSL · CVSS 7.5 · 2026-08-25 | 7.5 | 0.6% | 2026-08-25 |
| CVE-2026-68540fulgur: Quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements causes denial of servicefulgur:fulgur-rs · fulgur · CVSS 7.5 · 2026-11-11 | 7.5 | 0.6% | 2026-11-11 |
| CVE-2024-56200Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxynexryai · altair · CVSS 8.6 · 2024-12-19 | 8.6 | 0.6% | 2024-12-19 |
| CVE-2024-40705IBM InfoSphere Information Server denial of serviceIBM · InfoSphere Information Server · CVSS 6.5 · 2024-08-15 | 6.5 | 0.6% | 2024-08-15 |
| CVE-2023-2992An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FP…Lenovo · System Management Module (SMM) · CVSS 7.5 · 2023-06-26 | 7.5 | 0.6% | 2023-06-26 |
| CVE-2024-28214nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.NAVER · nGrinder · CVSS 2.7 · 2024-03-07 | 2.7 | 0.6% | 2024-03-07 |
| CVE-2024-39743IBM MQ Container denial of serviceIBM · MQ Operator · CVSS 5.9 · 2024-07-08 | 5.9 | 0.6% | 2024-07-08 |
| CVE-2026-23934Frontend DoS via the validate.api.exists actionZabbix · Zabbix · CVSS 5.1 · 2026-08-18 | 5.1 | 0.6% | 2026-08-18 |
| CVE-2025-53633Chall-Manager's scenario decoding process does not check for zip bombsctfer-io · chall-manager · CVSS 8.7 · 2025-07-10 | 8.7 | 0.5% | 2025-07-10 |
| CVE-2025-22166This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of…Atlassian · Confluence Data Center · CVSS 8.3 · 2025-10-21 | 8.3 | 0.5% | 2025-10-21 |
| CVE-2026-35626OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call WebhookOpenClaw · OpenClaw · CVSS 5.3 · 2026-04-09 | 5.3 | 0.5% | 2026-04-09 |
| CVE-2024-34703Botan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve Parametersrandombit · botan · CVSS 7.5 · 2024-06-30 | 7.5 | 0.5% | 2024-06-30 |
| CVE-2025-42874Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius)SAP_SE · SAP NetWeaver (remote service for Xcelsius) · CVSS 7.9 · 2025-12-09 | 7.9 | 0.5% | 2025-12-09 |
| CVE-2026-110676Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignumNo vendor recorded · CVSS 7.5 · 2026-10-19 | 7.5 | 0.5% | 2026-10-19 |
| CVE-2026-84897wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role c…wolfSSL Inc. · wolfSSH · CVSS 6.9 · 2026-10-07 | 6.9 | 0.5% | 2026-10-07 |
| CVE-2026-75029Message parser retains every identical singleton RDATA, enabling wire-to-work amplificationISC · BIND 9 · CVSS 5.3 · 2026-09-16 | 5.3 | 0.5% | 2026-09-16 |
| CVE-2025-66564Sigstore Timestamp Authority allocates excessive memory during request parsingsigstore · timestamp-authority · CVSS 7.5 · 2025-12-04 | 7.5 | 0.5% | 2025-12-04 |
| CVE-2026-0485Denial of service (DOS) vulnerability in SAP BusinessObjects BI PlatformSAP_SE · SAP BusinessObjects BI Platform · CVSS 7.5 · 2026-02-10 | 7.5 | 0.5% | 2026-02-10 |
| CVE-2026-68531Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword SearchConcrete CMS · Concrete CMS · CVSS 2.1 · 2026-09-15 | 2.1 | 0.5% | 2026-09-15 |
| CVE-2026-104817Misskey: Lack of rate limiting and size restrictions in RSS fetching APImisskey-dev · misskey · CVSS 8.7 · 2026-10-13 | 8.7 | 0.5% | 2026-10-13 |
| CVE-2026-125327pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requestspgEdge · pgedge-rag-server · CVSS 7.5 · 2026-11-10 | 7.5 | 0.4% | 2026-11-10 |
| CVE-2026-128086OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplificationopen-telemetry · opentelemetry-go · CVSS 5.3 · 2026-11-13 | 5.3 | 0.4% | 2026-11-13 |
| CVE-2026-103880Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwordsApache Software Foundation · Apache Directory LDAP API · CVSS 7.5 · 2026-10-02 | 7.5 | 0.4% | 2026-10-02 |
| CVE-2026-86432commonmark 2.0.0 before 2.8.4 Denial of Service via XMLthephpleague · commonmark · CVSS 5.3 · 2026-09-07 | 5.3 | 0.4% | 2026-09-07 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.