CWE-400: Uncontrolled Resource Consumption vulnerabilities

Twig versions prior to 3.26.0 have a vulnerability in the sandbox feature that allows untrusted templates to consume excessive CPU, memory, or wall-clock time, leading to resource exhaustion. The issue is documented in version 3.26.0, clarifying that the sandbox does not protect against such resource consumption. This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and has a high severity rating with a CVSS score of 7.1.

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.

NVIDIA Triton Inference Server for Linux has a vulnerability (CVE-2026-47479) involving uncontrolled resource consumption. This flaw can be exploited remotely without authentication and user interaction, potentially causing a denial of service by exhausting system resources. The vulnerability is rated high severity with a CVSS score of 7.5. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

NVIDIA Triton Inference Server for Linux has a vulnerability (CVE-2026-47476) involving uncontrolled resource consumption. Exploiting this flaw could lead to denial of service conditions. The vulnerability is classified under CWE-400 and has a high severity rating with a CVSS score of 7.5. No official patch or remediation guidance is currently available from the vendor. The affected version is listed as 0.0, but no further version details are provided.

Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.

Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.

Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

CVE-2026-55781 is a low-severity vulnerability in NanaZip prior to version 6.5.1749.0. It involves uncontrolled resource consumption due to improper validation of fragment size fields in the UFS and FFS image handler. An attacker can craft a small UFS image that triggers excessive memory allocations, potentially causing memory exhaustion or process termination. The issue is fixed in version 6.5.1749.0.

CVE-2026-55780 is a low-severity vulnerability in NanaZip prior to version 6.5.1749.0. It involves improper validation of the extraction buffer size in the .NET single-file bundle handler, which can lead to uncaught exceptions and process crashes. The issue is fixed in version 6.5.1749.0.

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can force multi-gigabyte allocations during listing or extraction through NameSize, Information.Size, and std::string or vector allocation paths, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticated attacker can send a stream of repeated E-language prefixes that drives the recursion arbitrarily deep, exhausting the receiver thread's JVM stack and raising StackOverflowError. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.