CWE-408Base

Incorrect Behavior Order: Early Amplification

Draft in the CWE catalog · 7 CVEs mapped

7
CVEs mapped
7.2
Median CVSS
What it is

The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.

Recent examples
7.5cvss
CVE-2026-11605

Unnecessary validation of DNSSEC signed records

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

HIGHno explanation yet
1%
epss
5.3cvss
CVE-2026-3592

Amplification vulnerabilities via self-pointed glue records

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

MEDIUMno explanation yet
0%
epss
8.7cvss
CVE-2026-41405

OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing

OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server resources by bypassing authentication checks.

HIGHno explanation yet
0%
epss
The record
Technical detail
CWE ID
CWE-408
Abstraction
Base
Structure
Simple
Status
Draft