Home/CWE/Uncontrolled Resource Consumption
Weakness

Uncontrolled Resource Consumption

CWE-400 · Class · Draft

The product does not properly control the allocation and maintenance of a limited resource.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-664 · Improper Control of a Resource Through its Lifetime
Children (more specific)
ParentOfCWE-1235 · Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
ParentOfCWE-1246 · Improper Write Handling in Limited-write Non-Volatile Memories
ParentOfCWE-405 · Asymmetric Resource Consumption (Amplification)
ParentOfCWE-770 · Allocation of Resources Without Limits or Throttling
ParentOfCWE-771 · Missing Reference to Active Allocated Resource
ParentOfCWE-779 · Logging of Excessive Data
ParentOfCWE-920 · Improper Restriction of Power Consumption
◆

Attack Patterns (CAPEC)

3
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-147XML Ping of the Death
CAPEC-227Sustained Client Engagement
CAPEC-492Regular Expression Exponential Blowup
⚠

CVEs With This Weakness

3,366
A sample of the 3,366 CVEs tagged with this weakness.
CVECVE-2026-8769
CVECVE-2026-8319
CVECVE-2026-8187
CVECVE-2026-8124
CVECVE-2026-7790
CVECVE-2026-6844
CVECVE-2026-6797
CVECVE-2026-6781
CVECVE-2026-6780
CVECVE-2026-6777
CVECVE-2026-6607
CVECVE-2026-6601
◉

Nuclei Scanner Templates

4
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
highKubernetes API Server - YAML Parsing DoS (Billion Laughs)
highPure-FTPd < 1.0.50 - DoS via Resource Exhaustion
mediumMarimo > 0.9.20 - Proxy Abuse
mediumvsftpd < 2.3.3 - DoS
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin