CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- envoyproxy envoy, redhat openshift service mesh, debian linux +2 moreRed Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.9 servicemesh-proxy security update7.5 High
- qtIn Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for...8.6 High
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service,...7.5 High
- hashicorp consulDenial of Service (DoS) in HashiCorp Consul7.5 High
- hashicorp nomadAllocation of Resources Without Limits or Throttling in HashiCorp Nomad7.5 High
- iktm bearftpIKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port.7.5 High
- codesys gateway, hmi, control for beaglebone +12 more +14 moreCODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation...6.5 Medium
- vt cryptacular, oracle communications services gatekeeper, webcenter sites +1 more +3 moreDenial of Service in Cryptacular7.5 High
- gnu libredwg, opensuse backports, leap +2 moreGNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in...6.5 Medium
- matio project matioAn attempted excessive memory allocation was discovered in Mat_VarRead5 in mat5.c in matio 1.5.17.6.5 Medium
- gnu libredwg, opensuse backports sle, leap +2 moreAn issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted...6.5 Medium
- gnu libredwg, opensuse backports sle, leap +2 moreAn issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive...6.5 Medium
- gnu libredwg, opensuse backports sle, leap +2 moreAn issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted...6.5 Medium
- gnu libredwg, opensuse backports sle, leap +2 moreAn issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive...6.5 Medium
- mz-automation libiec61850In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an...6.5 Medium
- puma, debian linux +1 morePotential DOS attack in Puma5.3 Medium
- dnsmasq, fedoraproject fedora +1 moreA vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote...3.7 Low
- facebook mcrouterIn Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user...7.5 High
- gitlabGitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of...6.5 Medium
- apache cxf, oracle commerce guided search, flexcube private banking +1 more +3 morePotential DOS attack due to unrestricted attachment count in messages6.5 Medium
- nicehash minerAn issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a...7.5 High
- google nest cam iq indoor firmwareAn exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ...5.3 Medium
- bitdefender box firmwareAn issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the...4.4 Medium
- idreamsoft icmsidreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption...7.5 High
- apache tomee, bouncycastle bc-java, netapp active iq unified manager +18 more +20 moreOut-of-Memory Error in Bouncy Castle Crypto7.5 High
- linux kernel, xen +1 moreAn issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen...6.5 Medium
- python pillow, fedoraproject fedora +1 moreDOS attack in Pillow when processing specially crafted image files7.5 High
- cisco ic3000 industrial compute gateway, ic3000 industrial compute gateway firmware +1 moreCisco IC3000 Industrial Compute Gateway Denial of Service Vulnerability6.5 Medium
- jetbrains pycharmJetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection...7.5 High
- foxit, foxitsoftware reader, phantompdf +2 moreAn exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software...8.8 High
- puttyPuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows...9.8 Critical
- tcpdump libpcap, apple ipados, iphone os +8 more +10 moresf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before...5.3 Medium
- google androidIn Bluetooth, there is a possible remote code execution due to an improper memory allocation....8.8 High
- google androidIn tzdata there is possible memory corruption due to a mismatch between allocation and...7.8 High
- ui ep-r6 firmware, ep-r8 firmware, er-12 firmware +9 more +11 moreUbiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk...7.5 High
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain...7.5 High
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1....7.5 High
- apache traffic serverApache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache...7.5 High
- asus hg100 firmwareHG100 contains an Uncontrolled Resource Consumption vulnerability7.4 High
- openstack os-vifOpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning9.1 Critical
- facebook fizzA peer could send empty handshake fragments containing only padding which would be kept in memory...7.5 High
- ibm security guardium big data intelligenceIBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or...7.5 High
- envoyproxy envoyIn Envoy through 1.11.1, users may configure a route to match incoming path headers via the...7.5 High
- codesys development system, gateway, control for beaglebone sl +7 more +9 moreAn issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may...7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +15 more +17 moreSome HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service7.5 High
- apache http server, traffic server, apple swiftnio +20 more +22 moreSome HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +16 more +18 moreSome HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +19 more +21 moreSome HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +25 more +27 moreSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service7.5 High
- apache traffic server, apple swiftnio, debian linux +1 more +3 moreSome HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service7.5 High
- Show moreLoading…