Asymmetric Resource Consumption (Amplification)

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

CVEs (46)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-28214 1Naver 1Ngrinder Jun 17, 2026 Mar 7, 2024 N/A· v4 2.7 LOW· v3 N/A· v2 nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.
CVE-2023-2992 1Lenovo 8Nextscale N1200 Enclosure Firmware Thinkagile Cp Cb 10 FirmwareThinkagile Cp Cb 10e Firmware+5 more Jun 17, 2026 Jun 26, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management...Show more An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.Show less
CVE-2021-38447 1Objectcomputing 1Opendds Jun 17, 2026 May 5, 2022 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may result in a denial-of-service condition.
CVE-2021-21359 1Typo3 1Typo3 Jun 17, 2026 Mar 23, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could re...Show more TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.Show less
CVE-2019-11479 4Canonical F5Linux+1 more 21Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Analytics+18 more Jun 17, 2026 Jun 19, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker cou...Show more Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.Show less
CVE-2018-15492 1Gemalto 1Sentinel License Manager Nov 21, 2024 Aug 18, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.

Previous 1 23