CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- rustls rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression 6.3 Medium
- hickory-dns Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service 8.7 High
- hickory-dns Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests 8.7 High
- hickory-dns Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies 8.7 High
- sveltejs devalue Devalue before 5.6.3 Denial of Service via Sparse Array Serialization 8.7 High
- sveltejs devalue Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays 8.7 High
- openidentityplatform openam OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation 8.7 High
- go-vikunja vikunja Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations 7.1 High
- go-vikunja vikunja Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache 7.1 High
- go-vikunja vikunja Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports 7.1 High
- go-vikunja vikunja Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import 7.1 High
- go-vikunja vikunja Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries 5.3 Medium
- go-vikunja vikunja Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count 5.3 Medium
- elixir-grpc grpc server Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server 8.2 High
- stleary json-java JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoS 5.9 Medium
- hisense vidaa Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI 7.1 High
- hapijs content Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API 7.5 High
- apache software foundation james Apache James: Denial of service upon MIME parsing 8.7 High
- apache software foundation james mime4j core, james mime4j dom +1 more Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling No score
- ericsson codechecker Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics 4.9 Medium
- ninenines cowboy Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion 8.2 High
- ninenines cowlib Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion 8.7 High
- jetbrains youtrack In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI... 3.1 Low
- circl vulnerability-lookup Vulnerability-Lookup: memory amplification through webhook payload template format specifiers 5.3 Medium
- dlclark regexp2 Regexp2: Unbounded memory amplification via large `{m}` quantifier on a zero-width subexpression 7.5 High
- gstreamer gst-plugins-good Gstreamer1-plugins-good: gstreamer: missing subindex entry count validation in avidemux leading to denial of service 5.5 Medium
-
libhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 more HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time No score - tinyhumansai openhuman OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth 7.7 High
- anacrolix torrent anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response 7.1 High
- apache software foundation ofbiz Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode No score
- apache software foundation ofbiz Apache OFBiz: Unbounded multi-form row count from a parameter name 7.5 High
- apache software foundation juneau Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling 8.7 High
- h2o h2o: heap exhaustion using capsules 7.5 High
- zulip Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests 6.5 Medium
- elixir-ecto ecto Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto 8.9 High
- apache software foundation zookeeper Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling 7.1 High
- apache software foundation zookeeper Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable 8.7 High
- miniorange saml sp single sign on WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability 7.5 High
- qt framework Resource exhaustion vulnerability in HTTP request handling impacts Qt HTTP Server (QHttpServer) 2.7 Low
-
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits No score - tanium threat response Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response. 4.3 Medium
- agamnentzar ag-psd ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass) 7.5 High
- elastic apm server Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service 6.5 Medium
- elastic elasticsearch Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service 6.5 Medium
- djangoproject django Potential memory exhaustion in MultiPartParser via base64-encoded file upload 6.9 Medium
- eclipse foundation vert.x Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser 7.5 High
- eclipse foundation vert.x Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client 5.9 Medium
- freerdp FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly 7.1 High
- freerdp FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control 5.3 Medium
- freerdp FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP 5.3 Medium
- Show olderLoading…