Threats tagged 'cwe-410'

CVE-2026-114472 is a low-severity vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It involves an insufficient resource pool in the ACME HTTP-01 challenge responder, which handles TLS certificate issuance and renewal. The responder accepts only one connection at a time and waits up to five seconds for a request, allowing unauthenticated remote attackers to hold the connection idle and cause certificate validation failures. This can lead to certificate expiration and subsequent TLS refusal by clients, although the mail service continues to operate with the existing certificate until expiration. Version 6.3.7 improves this by allowing up to 64 simultaneous connections, mitigating the issue by requiring an attacker to maintain many idle connections concurrently to cause disruption.

When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets and cause the configured routing protocol to fail over.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient resource pooling.

When a WF200/WGM160P device is configured to operate as an Access Point, it may be vulnerable to a denial of service triggered by a malformed packet. The device may recover automatically or require a hard reset.

An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP request with a malicious header, potentially causing the server to crash or become unresponsive.

In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to respond to other requests. This vulnerability is due to uncontrolled resource consumption.

ChargePoint Home Flex Bluetooth Low Energy Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of ChargePoint Home Flex charging devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the connection handling of the Bluetooth Low Energy interface. The issue results from limiting the number of active connections to the product. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-21455.