CWE-400: Uncontrolled Resource Consumption vulnerabilities

A vulnerability in the Wikimedia Foundation Mediawiki DataTransfer Extension versions 1.46.0 up to but not including 1.47.0 allows uncontrolled resource consumption due to dependency on a vulnerable third-party component. This can lead to excessive allocation of resources, impacting availability. The issue is fixed in version 1.47.0.

CVE-2026-102414 is a medium severity vulnerability in the browserify pbkdf2 library up to version 3.1.6. It involves uncontrolled resource consumption due to re-hashing of passwords longer than the digest's block size on every iteration in the JavaScript fallback implementation. This causes a computational cost proportional to the product of iterations and password length, potentially blocking the event loop. The issue affects Node.js versions before 0.12, Bun versions 1.0.0 through 1.1.34 and 1.2.6 and later, and Deno 2.9.0 and later when the fallback is used. Node.js 0.12 and later and browser builds are not affected. Applications that enforce reasonable maximum password lengths are not significantly impacted.

CVE-2026-102278 is a high-severity vulnerability in the juliangruber brace-expansion library. It involves uncontrolled recursion in the expand_() function when processing deeply nested brace groups, which can exhaust the native stack and cause the Node.js process to terminate. This leads to a denial of service condition. The issue affects multiple versions prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, where the recursion occurs at comma-member and single-set expansion sites. The vulnerability is fixed in these versions.

CVE-2026-102277 is a medium severity vulnerability in the juliangruber brace-expansion library that causes uncontrolled resource consumption. The expand function in affected versions repeatedly rescans input patterns with many trailing closing braces, leading to quadratic CPU and memory usage. This results in a recoverable denial of service by blocking the Node.js event loop. The issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

CVE-2026-101911 is a medium severity vulnerability in the JavaScript ip-address library before version 10.7.1. It involves uncontrolled resource consumption due to unbounded string input in the Address6 constructor, Address6.isValid, and related parsing code. Large attacker-controlled inputs can cause synchronous stalls, high memory usage, invalid string length exceptions, and process termination. The issue is fixed in version 10.7.1.

A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

CVE-2026-82300 is a medium severity vulnerability in Elastic Elasticsearch involving uncontrolled resource consumption (CWE-400). This flaw can lead to denial of service (DoS) through excessive allocation of resources. The vulnerability affects multiple Elasticsearch versions from 8.0.0 through 9.5.3 in various ranges. No known exploits are reported in the wild, and no explicit patch information is provided in the source data.

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

CVE-2026-67408 is a high-severity vulnerability in rabbitmq-server versions 4.1.0 through before 4.1.11, 4.2.0 through before 4.2.9, and 4.3.0 through before 4.3.3. It allows an authenticated low-privileged management user with access to a vhost but without configure, write, or read permissions to cause uncontrolled resource consumption. By sending a crafted HTTP PUT request to the stream management API with a large binding-keys field, the attacker can force large memory allocations before permission checks occur, potentially causing the RabbitMQ node to crash in memory-limited environments. The issue is fixed in versions 4.1.11, 4.2.9, and 4.3.3.

CVE-2026-67227 is a medium severity vulnerability in rabbitmq-server versions from 4.0.0 up to but not including 4.0.22, 4.1.14, 4.2.7, and 4.3.1. It involves uncontrolled resource consumption due to atom exhaustion triggered by a policymaker user making repeated requests to the /api/global-parameters/:name endpoint with unique :name values. This can crash the node by exhausting the atom table. The issue is fixed in versions 4.0.22, 4.1.14, 4.2.7, and 4.3.1.

CVE-2026-67226 is a medium severity vulnerability in rabbitmq-server affecting versions 4.0.0 up to but not including 4.0.22, 4.1.0 up to but not including 4.1.14, and 4.2.0 up to but not including 4.2.7. It involves uncontrolled resource consumption via an admin-only API endpoint that processes user tags. An administrator can crash the node by submitting a request with approximately one million unique tags. This issue has been fixed in versions 4.0.22, 4.1.14, and 4.2.7.

CVE-2026-67415 is a medium severity vulnerability in rabbitmq-server versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2. It involves uncontrolled resource consumption due to the Shovel parameter parser converting attacker-controlled runtime parameters into non-garbage-collected Erlang atoms without proper bounds or allowlist checks. Exploitation requires network access to the Management HTTP API, valid credentials with management and policymaker tags, permission to set Shovel runtime parameters, and enabled shovel plugins. Successful exploitation can exhaust the node-wide atom table, causing denial of service. The issue is fixed in versions 4.2.9 and 4.3.3.

CVE-2026-66071 is a medium severity vulnerability in rabbitmq-server affecting versions from 3.13.0 up to but not including 3.13.15, and several 4.x versions up to their respective fixed releases. It involves uncontrolled resource consumption due to atom exhaustion when parsing OAuth2 JWT scope values in certain IdP configurations where scope content is user-influenced. The vulnerability is fixed in versions 3.13.15, 4.0.22, 4.1.11, 4.2.6, and 4.3.1.