The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
Volume of CVEs assigned to CWE-405 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
46 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-11479HIGH Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger | Jun 19, 2019 | 7.5 | 75 | NO | NO |
CVE-2025-8677HIGH Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.
This issue affects BIND 9 versions 9.18.0 through 9.18. | Oct 22, 2025 | 7.5 | 35 | NO | NO |
CVE-2026-47774HIGH Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 down | Jun 17, 2026 | 7.5 | 33 | NO | NO |
CVE-2026-22775HIGH Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.p | Jan 15, 2026 | 7.5 | 31 | NO | NO |
CVE-2026-25611HIGH A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server. | Feb 10, 2026 | 7.5 | 30 | NO | NO |
CVE-2025-53633CRITICAL Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the size of the decoded content is not ch | Jul 10, 2025 | 9.8 | 30 | NO | NO |
CVE-2026-8594MEDIUM Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.
Text::LineFold splits the input string by specific line bre | May 30, 2026 | 6.2 | 29 | NO | NO |
CVE-2026-44296HIGH Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.167, a remote, unauthenticated denial of service (DoS) vulnerability affects Deskflow servers running with TLS enabled | May 12, 2026 | 7.5 | 29 | NO | NO |
CVE-2026-22774HIGH Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.p | Jan 15, 2026 | 7.5 | 28 | NO | NO |
CVE-2026-54224HIGH UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to view any user profile on instances with many registered users, an authenticated att | Jun 18, 2026 | 7.1 | 27 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.