CWE-405: Amplification
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
51 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-54874 — Excessive Memory Use Buffering DTLS Records for a Future Epoch
- CVE-2026-25611 — Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server
- CVE-2025-53633 — Chall-Manager's scenario decoding process does not check for zip bombs
- CVE-2024-56200 — Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxy
- CVE-2025-42874 — Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius)
- CVE-2026-0485 — Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform
- CVE-2025-8677 — Resource exhaustion via malformed DNSKEY handling
- CVE-2025-66564 — Sigstore Timestamp Authority allocates excessive memory during request parsing
- CVE-2025-66506 — Fulcio allocates excessive memory during token parsing
- CVE-2025-30204 — jwt-go allows excessive memory allocation during header parsing
- CVE-2024-34703 — Botan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve Parameters
- CVE-2024-49363 — Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey
- CVE-2025-42876 — Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger)
- CVE-2025-24356 — UDP traffic amplification via fastd's fast reconnect feature
- CVE-2026-24324 — Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools)
- CVE-2025-25186 — Net::IMAP vulnerable to possible DoS by memory exhaustion
- CVE-2026-47774 — Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification
- CVE-2026-22775 — devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
- CVE-2026-22774 — devalue vulnerable to denial of service due to memory exhaustion in devalue.parse
- CVE-2026-87011 — Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
Recently published
- CVE-2026-87011 — Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
- CVE-2026-86432 — commonmark 2.0.0 before 2.8.4 Denial of Service via XML
- CVE-2026-82309 — Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries
- CVE-2026-84310 — pypdf: Possible long runtimes/large memory usage when retrieving outlines
- CVE-2026-54874 — Excessive Memory Use Buffering DTLS Records for a Future Epoch
- CVE-2026-23934 — Frontend DoS via the validate.api.exists action
- CVE-2026-23930 — Frontend DoS via the popup.testtriggerexpr action
- CVE-2026-72914 — Mastodon: Exhausting data by an unauthenticated request to the admin retention API
- CVE-2025-32394 — AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock
- CVE-2026-54224 — Denial of Service in UBB.threads
- CVE-2026-47774 — Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification
- CVE-2026-8594 — Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters
- CVE-2026-45557 — Technitium DNS Server excessive DNSSEC requests
- CVE-2026-44296 — Deskflow: TLS multiplexer DoS on failed `SSL_accept`
- CVE-2026-35665 — OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing
- CVE-2026-35626 — OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook
- CVE-2026-25611 — Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server
- CVE-2026-24324 — Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools)
- CVE-2026-0485 — Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform
- CVE-2026-22775 — devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
More specific weaknesses
- CWE-1050 — Excessive Platform Resource Consumption within a Loop
- CWE-1072 — Data Resource Access without Use of Connection Pooling
- CWE-1073 — Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
- CWE-1084 — Invokable Control Element with Excessive File or Data Access Operations
- CWE-1089 — Large Data Table with Excessive Number of Indices
- CWE-1094 — Excessive Index Range Scan for a Data Resource
- CWE-1176 — Inefficient CPU Computation
- CWE-406 — Network Amplification
- CWE-407 — Inefficient Algorithmic Complexity
- CWE-409 — Data Amplification