CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- vercel next, next.js +1 moreNext.js has Unbounded Memory Consumption via PPR Resume Endpoint5.9 Medium
- vercel next, next.js +1 moreNext.js Vulnerable to Denial of Service with Server Components5.9 Medium
- vercel next.jsNext.js: Denial of Service in App Router using Server Actions8.2 High
- vercel next.jsNext.js: Cache poisoning via collisions in React Server Component cache-busting3.7 Low
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 moreDenial of Service Vulnerability in React Server Components7.5 High
- servify-express.js servify express, aarondoran servify-express +1 moreServify Express does not enforce rate limiting when parsing JSON8.7 High
- quic-goquic-go HTTP/3 QPACK Header Expansion DoS5.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis8.7 High
- rockwell automation 432es-ig3 series a432ES-IG3 Series A Denial-of-Service Vulnerability8.7 High
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +134 more +136 moreAuthenticated Denial-of-Service via SSH4.3 Medium
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +134 more +136 moreAuthenticated Denial-of-Service via Webshell6.5 Medium
- ibm watsonx.dataIBM watsonx.data Denial of Service6.5 Medium
- google androidIn multiple locations, there is a possible permanent denial of service due to resource exhaustion...5.5 Medium
- google androidIn onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service...6.5 Medium
- google androidIn getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence...7.8 High
- python urllib3urllib3 allows an unbounded number of links in the decompression chain8.9 High
- qtImproper validation of <img> tag size in Text component parser8.7 High
- openvpnInteractive service agent in OpenVPN version 2.5.0 through 2.7_rc2 on Windows allows a local...1.3 Low
- hcltech dragonAn issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to...5.5 Medium
- lfprojects mcp typescript sdk, modelcontextprotocol typescript-sdk +1 moreDNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost7.6 High
- better-authbetter-auth before 1.4.2 basePath Modification DoS9.3 Critical
- google androidIn InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due...5.5 Medium
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 Unauthenticated Object Flagging Vulnerability6.5 Medium
- oisf suricataSuricata is vulnerable to unbounded memory growth for decompression7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- victoriametricsVictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOM2.7 Low
github.com/babylonlabs-io/babylonGo,github.com/babylonlabs-io/babylon/v2Go,github.com/babylonlabs-io/babylon/v3Go +1 more +3 moreBabylon's malformed vote extensions are not rejected7.0 High- vllmvLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`6.5 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 moreUnbounded memory consumption in golang.org/x/crypto/ssh5.3 Medium
- shelly pro 4pmAllocation of Resources Without Limits or Throttling in Shelly Pro 4PM8.3 High
- authlib joserfcjoserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads9.2 Critical
- ascertia signinghubIn Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user...4.3 Medium
- digiwin easyflow gpDigiwin｜EasyFlow GP - Denial of service8.7 High
- latchset kdcproxy, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 morePython-kdcproxy: remote dos via unbounded tcp upstream buffering5.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibvirt: denial of service in xml parsing5.5 Medium
- authzed spicedbSpiceDB's WriteRelationships fails silently if payload is too big2.7 Low
- bugsinkBugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)7.5 High
- bugsinkBugsink vulnerable to unauthenticated remote DoS via crafted Brotli input7.5 High
- ibm db2IBM Db2 denial of service6.5 Medium
- ibm db2IBM denial of service5.1 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 54.9 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 54.9 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 51.2 Low
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 54.9 Medium
- mantisbtMantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length6.5 Medium
- hashicorp consul, consul enterprise +1 moreConsul's KV endpoint is vulnerable to denial of service6.5 Medium
- Show moreLoading…