What CVEs are caused by CWE-1088?

8 recorded CVEs are attributed to CWE-1088, including CVE-2026-89147, CVE-2026-81520, CVE-2026-103649.

What are the consequences of CWE-1088?

Exploiting CWE-1088 can lead to: Reduce Reliability.

Is CWE-1088 actively exploited?

8 recorded CVEs are caused by CWE-1088; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Create an account

Base weakness

Incomplete

CWE-1088: Synchronous Access of Remote Resource without Timeout

The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.

Last updated May 1, 2026

8

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

CWE-1088 (Synchronous Access of Remote Resource without Timeout) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

8 recorded CVEs are caused by CWE-1088 (Synchronous Access of Remote Resource without Timeout). The highest-severity and most recent are shown first. 3 new CWE-1088 CVEs have been recorded so far in 2026 (4 in 2025).

High · CVSS 7.5 · EPSS 18th

2026-10-08

CVE-2024-8062

H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request

High · CVSS 7.5 · EPSS 40th

2025-03-20

CVE-2024-8061

Denial of Service in aimhubio/aim

High · CVSS 7.5 · EPSS 40th

2025-03-20

CVE-2024-12777

Aim vulnerable to Synchronous Access of Remote Resource without Timeout

Medium · CVSS 5.9 · EPSS 40th

2025-03-20

CVE-2020-14483

Medium · CVSS 4.3 · EPSS 35th

2020-08-13

CVE-2025-4656

Vault Vulnerable to Recovery Key Cancellation Denial of Service

Low · CVSS 3.1 · EPSS 17th

2025-06-25

Common consequences

What can happen when CWE-1088 is exploited.

Reduce Reliability

Affects: Other

This issue can prevent the product from running reliably, since an outage for the remote resource can cause the product to hang. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2024-8062 — API endpoint performs a HEAD request without a timeout, allowing attackers to cause the server to hang
CVE-2024-8061 — development product for AI can make requests to external servers without timeouts and does not respond to other requests while waiting, allowing DoS

Terminology & mappings

Mapped taxonomies

OMG ASCRM (ASCRM-RLB-19)

Frequently asked questions

Common questions about CWE-1088.

What is CWE-1088?: The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.
What CVEs are caused by CWE-1088?: 8 recorded CVEs are attributed to CWE-1088, including CVE-2026-89147, CVE-2026-81520, CVE-2026-103649.
What are the consequences of CWE-1088?: Exploiting CWE-1088 can lead to: Reduce Reliability.
Is CWE-1088 actively exploited?: 8 recorded CVEs are caused by CWE-1088; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Track CWE-1088 CVEs

Get an alert when a new CWE-1088 CVE affects your products, with AI-written analysis and remediation steps.

Create an account See pricing

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Illustrative examples

Related weaknesses

Parent

Terminology & mappings

Mapped taxonomies

Frequently asked questions

References

Track CWE-1088 CVEs