CWE-400: Uncontrolled Resource Consumption
Also known as: Resource Exhaustion
The product does not properly control the allocation and maintenance of a limited resource.
Last updated
Overview
CWE-400 (Uncontrolled Resource Consumption) is a class-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Real-world CVEs
2,285 recorded CVEs are caused by CWE-400 (Uncontrolled Resource Consumption), including 7 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 475 new CWE-400 CVEs have been recorded so far in 2026 (419 in 2025).
- CVE-2020-3566CISA KEV
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
Critical · CVSS 9.2 · EPSS 88th2020-08-29 - CVE-2023-38180CISA KEV
.NET and Visual Studio Denial of Service Vulnerability
High · CVSS 8.7 · EPSS 96th2023-08-08 - CVE-2020-3569CISA KEV
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities
High · CVSS 8.7 · EPSS 87th2020-09-23 - CVE-2004-1464CISA KEVHigh · CVSS 8.7 · EPSS 91th2005-02-13
- CVE-2026-28318CISA KEV
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
High · CVSS 7.5 · EPSS 95th2026-06-04 - CVE-2026-45498CISA KEV
Microsoft Defender Denial of Service Vulnerability
High · CVSS 7.5 · EPSS 99th2026-05-20 - CVE-2023-44487CISA KEVHigh · CVSS 7.5 · EPSS 100th2023-10-10
- CVE-2026-28575Critical · CVSS 10.0 · EPSS 3th2026-06-17
- CVE-2026-0064Critical · CVSS 10.0 · EPSS 2th2026-06-17
- CVE-2026-22239
Email Sending Vulnerability in BLUVOYIX
Critical · CVSS 10.0 · EPSS 20th2026-01-14 - CVE-2025-61303Critical · CVSS 9.8 · EPSS 34th2025-10-20
- CVE-2025-43193Critical · CVSS 9.8 · EPSS 51th2025-07-29
Showing 12 of 2,285 recorded CWE-400 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-400 vulnerabilitiesCommon consequences
What can happen when CWE-400 is exploited.
DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
Affects: Availability
If an attacker can trigger the allocation of the limited resources, but the number or size of the resources is not controlled, then the most common result is denial of service. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment, i.e., the product may slow down, crash due to unhandled errors, or lock out legitimate users. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
Bypass Protection Mechanism, Other
Affects: Access Control, Other
In some cases it may be possible to force the product to "fail open" in the event of resource exhaustion. The state of the product -- and possibly the security functionality - may then be compromised.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Technologies
How to prevent it
Practical mitigations for CWE-400, grouped by where in the lifecycle they apply.
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation of resource exhaustion attacks requires that the target system either:
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Ensure that protocols have specific limits of scale placed on them.
Ensure that all failures in resource allocation place the system into a safe posture.
How to detect it
Automated Static Analysis
Automated static analysis typically has limited utility in recognizing resource exhaustion problems, except for program-independent system resources such as files, sockets, and processes. For system resources, automated static analysis may be able to detect circumstances in which resources are not released after they have expired. Automated analysis of configuration files may be able to detect settings that do not specify a maximum value.
Automated static analysis tools will not be appropriate for detecting exhaustion of custom resources, such as an intended security policy in which a bulletin board user is only allowed to make a limited number of posts per day.
Effectiveness: Limited
Automated Dynamic Analysis
Certain automated dynamic analysis techniques may be effective in spotting resource exhaustion problems, especially with resources such as processes, memory, and connections. The technique may involve generating a large number of requests to the product within a short time frame.
Effectiveness: Moderate
Fuzzing
While fuzzing is typically geared toward finding low-level implementation bugs, it can inadvertently find resource exhaustion problems. This can occur when the fuzzer generates a large number of test cases but does not restart the targeted product in between test cases. If an individual test case produces a crash, but it does not do so reliably, then an inability to handle resource exhaustion may be the cause.
Effectiveness: Opportunistic
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
The following example demonstrates the weakness.
Vulnerable example
class Worker implements Executor {There are no limits to runnables. Potentially an attacker could cause resource problems very quickly.
This code allocates a socket and forks each time it receives a new connection.
Vulnerable example
sock=socket(AF_INET, SOCK_STREAM, 0);The program does not track how many connections have been made, and it does not limit the number of connections. Because forking is a relatively expensive operation, an attacker would be able to cause the system to run out of CPU, processes, or memory by making a large number of connections. Alternatively, an attacker could consume all available connections, preventing others from accessing the system remotely.
In the following example a server socket connection is used to accept a request to store data on the local file system using a specified filename. The method openSocketConnection establishes a server socket to accept requests from a client. When a client establishes a connection to this service the getNextMessage method is first used to retrieve from the socket the name of the file to store the data, the openFileToWrite method will validate the filename and open a file to write to on the local file system. The getNextMessage is then used within a while loop to continuously read data from the socket and output the data to the file until there is no longer any data from the socket.
Vulnerable example
int writeDataFromSocketToFile(char *host, int port)This example creates a situation where data can be dumped to a file on the local file system without any limits on the size of the file. This could potentially exhaust file or disk resources and/or limit other clients' ability to access the service.
In the following example, the processMessage method receives a two dimensional character array containing the message to be processed. The two-dimensional character array contains the length of the message in the first character array and the message body in the second character array. The getMessageLength method retrieves the integer value of the length from the first character array. After validating that the message length is greater than zero, the body character array pointer points to the start of the second character array of the two-dimensional character array and memory is allocated for the new body character array.
Vulnerable example
/* process message accepts a two-dimensional character array of the form [length][body] containing the message to be processed */Safe example
unsigned int length = getMessageLength(message[0]);In the following example, a server object creates a server socket and accepts client connections to the socket. For every client connection to the socket a separate thread object is generated using the ClientSocketThread class that handles request made by the client through the socket.
Vulnerable example
public void acceptConnections() {Safe example
public static final int SERVER_PORT = 4444;In the following example, the serve function receives an http request and an http response writer. It reads the entire request body.
Vulnerable example
func serve(w http.ResponseWriter, r *http.Request) {Safe example
func serve(w http.ResponseWriter, r *http.Request) {Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2020-3566CISA KEV— Resource exhaustion in distributed OS because of "insufficient" IGMP queue management, as exploited in the wild per CISA KEV.
- CVE-2019-19911 — Chain: Python library does not limit the resources used to process images that specify a very large number of bands (CWE-1284), leading to excessive memory consumption (CWE-789) or an integer overflow (CWE-190).
- CVE-2020-7218 — Go-based workload orchestrator does not limit resource usage with unauthenticated connections, allowing a DoS by flooding the service
- CVE-2009-2874 — Product allows attackers to cause a crash via a large number of connections.
- CVE-2009-1928 — Malformed request triggers uncontrolled recursion, leading to stack exhaustion.
- CVE-2009-2858 — Chain: memory leak (CWE-404) leads to resource exhaustion.
- CVE-2009-2726 — Driver does not use a maximum width when invoking sscanf style functions, causing stack consumption.
- CVE-2009-2540 — Large integer value for a length property in an object causes a large amount of memory allocation.
- CVE-2009-2299 — Web application firewall consumes excessive memory when an HTTP request contains a large Content-Length value but no POST data.
- CVE-2009-2054 — Product allows exhaustion of file descriptors when processing a large number of TCP packets.
- CVE-2008-5180 — Communication product allows memory consumption with a large number of SIP requests, which cause many sessions to be created.
- CVE-2008-2121 — TCP implementation allows attackers to consume CPU and prevent new connections using a TCP SYN flood attack.
- CVE-2008-2122 — Port scan triggers CPU consumption with processes that attempt to read data from closed sockets.
- CVE-2008-1700 — Product allows attackers to cause a denial of service via a large number of directives, each of which opens a separate window.
- CVE-2007-4103 — Product allows resource exhaustion via a large number of calls that do not complete a 3-way handshake.
- CVE-2006-1173 — Mail server does not properly handle deeply nested multipart MIME messages, leading to stack exhaustion.
- CVE-2007-0897 — Chain: anti-virus product encounters a malformed file but returns from a function without closing a file descriptor (CWE-775) leading to file descriptor consumption (CWE-400) and failed scans.
Terminology & mappings
Alternate terms
- Resource Exhaustion
Mapped taxonomies
- CLASP: Resource exhaustion (file descriptor, disk space, sockets, ...)
- OWASP Top Ten 2004: Denial of Service (A9) — CWE More Specific fit
- WASC: Denial of Service (10)
- WASC: XML Attribute Blowup (41)
- The CERT Oracle Secure Coding Standard for Java (2011): Avoid memory and resource leaks during serialization (SER12-J)
- The CERT Oracle Secure Coding Standard for Java (2011): Do not exhaust heap space (MSC05-J)
- Software Fault Patterns: Unrestricted Consumption (SFP13)
- ISA/IEC 62443: Req SR 7.1 (Part 3-3)
- ISA/IEC 62443: Req SR 7.2 (Part 3-3)
- ISA/IEC 62443: Req SI-1 (Part 4-1)
- ISA/IEC 62443: Req SVV-3 (Part 4-1)
- ISA/IEC 62443: Req CR 7.1 (Part 4-2)
- ISA/IEC 62443: Req CR 7.2 (Part 4-2)
Attack patterns
CAPEC attack patterns that exploit this weakness.
Frequently asked questions
Common questions about CWE-400.
- What is CWE-400?
- The product does not properly control the allocation and maintenance of a limited resource.
- What CVEs are caused by CWE-400?
- 2,285 recorded CVEs are attributed to CWE-400, including CVE-2020-3566, CVE-2023-38180, CVE-2020-3569. 7 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- Is CWE-400 part of the OWASP Top 10?
- CWE-400 maps to OWASP Top Ten 2004: Denial of Service (A9) in the OWASP security taxonomy.
- How do you prevent CWE-400?
- Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- How is CWE-400 detected?
- Automated Static Analysis: Automated static analysis typically has limited utility in recognizing resource exhaustion problems, except for program-independent system resources such as files, sockets, and processes. For system resources, automated static analysis may be able to detect circumstances in which resources are not released after they have expired. Automated analysis of configuration files may be able to detect settings that do not specify a maximum value.
- What are the consequences of CWE-400?
- Exploiting CWE-400 can lead to: DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other), Bypass Protection Mechanism, Other.
- Is CWE-400 actively exploited?
- Yes. 7 CWE-400 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 2,285 recorded CVEs.
References
- MITRE CWE definition (CWE-400) (opens in a new tab)
- CWE-400 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-400
Get alerted the moment a new CWE-400 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.