CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- telegram desktopTelegram Desktop 2.9.2 - Denial of Service (PoC)4.6 Medium
- smartftp, smartftp client +1 moreSmartFTP Client 10.0.2909.0 - 'Multiple' Denial of Service4.6 Medium
- traefikTraefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall5.9 Medium
solspace/craft-freeformPackagistsolspace/craft-freeform Has a DoS Vulnerability2.7 Low- svelte kitSvelteKit has a memory amplification DoS in Remote Functions binary form deserializer8.2 High
- cyberfox web browserCyberfox Web Browser 52.9.1 - Denial of Service (PoC)6.7 Medium
- cinspiration rdp managerRDP Manager 4.9.9.3 - Denial-of-Service (PoC)6.8 Medium
- sylkat-tools awebserver, awebserver ghostbuilding +1 moreAWebServer GhostBuilding 18 - Denial of Service (DoS)8.7 High
- google keras, red hat openshift ai (rhoai), openshift ai 2.25 +2 more +4 moreDenial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata7.1 High
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreImproper input handling in a system endpoint may allow attackers to overload resources, causing a...4.3 Medium
- nodejs undiciUndici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion5.9 Medium
- elastic kibanaImproper Input Validation in Kibana Email Connector Leading to Excessive Allocation6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Fleet6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation6.5 Medium
- hewlett packard enterprise (hpe) instant onUnexpected shutdown in HPE Instant On Access Points after processing specific packets7.5 High
- llamaindex, run-llama llama index +1 moreLlamaIndex <= 0.12.2 VannaQueryEngine SQL Execution Allows Resource Exhaustion8.7 High
- vllmvLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions6.5 Medium
- nasa cryptolibCryptoLib Memory Leak on HTTP Error Response in KMC Client6.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- corednsCoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages6.6 Medium
- red hat openshift dev spaces, technitium dnsserver +1 moreAn issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service...7.5 High
- quarkusQuarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write5.9 Medium
- auntyfey smart combination lockAuntyFey Smart Combination Lock BLE Connection Flood DoS5.3 Medium
- softwareag arisIn Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate...6.5 Medium
- extreme networks aerohive hiveosExtreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service8.7 High
- aio-libs aiohttpAIOHTTP vulnerable to DoS through chunked messages6.6 Medium
- aio-libs aiohttpAIOHTTP vulnerable to denial of service through large payloads6.6 Medium
- aio-libs aiohttp, red hat openshift lightspeed, openshift service mesh 2 +18 more +20 moreAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb7.5 High
- coollabs coolifyRate-limit bypass on login via X-Forwarded-Host header5.5 Medium
github.com/bishopfox/sliverGoSliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass5.5 Medium- craftcms cms, craft cms +1 moreUnauthenticated Craft CMS users can trigger a database backup7.0 High
github.com/open-feature/flagd/coreGo,github.com/open-feature/flagd/flagdGo,github.com/open-feature/flagd/flagd-proxyGo +2 moreflagd: Multiple Go Runtime CVEs Impact Security and AvailabilityNo score- qnap qts, quts hero +1 moreQTS, QuTS hero4.6 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero4.9 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding7.5 High
- fetch softworks fetch ftp clientFetch Softworks Fetch FTP Client 5.8.2 Remote CPU Consumption Denial of Service7.1 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network Commands8.7 High
- freshrssFreshRSS globally denies access to feed via proxy modifying to 429 Retry-After4.3 Medium
- hasura graphql, graphql engine +1 moreHasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query8.7 High
- tp-link systems inc. tapo c200 v3, tp-link tapo c200 firmware +1 moreImproper Content-Length Validation in HTTPS Requests on Tapo C2007.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreQemu-kvm: unbounded allocation in virtio-crypto5.5 Medium
- elastic elasticsearchElasticsearch Allocation of Resources Without Limits or Throttling4.9 Medium
- elastic kibanaKibana Allocation of Resources Without Limits or Throttling6.5 Medium
- elastic elasticsearchElasticsearch Allocation of Resources Without Limits or Throttling6.5 Medium
- elastic packetbeatElasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments5.3 Medium
- güralp systems certimus series, fortimus series, minimus series +2 moreGüralp Systems Fortimus Series, Minimus Series, and Certimus Series have an Allocation of Resources Without Limits or Throttling vulnerability6.9 Medium
- expr-lang exprExpr has Denial of Service via Unbounded Recursion in Builtin Functions7.5 High
- vercel next.jsNext.js: Unbounded postponed resume buffering can lead to DoS6.9 Medium
- vercel next.jsNext.js: null origin can bypass Server Actions CSRF checks5.3 Medium
- vercel next.jsNext.js: null origin can bypass dev HMR websocket CSRF checks2.3 Low
- Show moreLoading…