CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- olivetinOliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint7.5 High
- authlib joserfcjoserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)7.5 High
- svelte sveltekit, sveltejs kit +1 moreSvelteKit 2.49.0 before 2.53.3 Denial of Service via form8.7 High
- fasterxml jackson-corejackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service6.9 Medium
- spinframework containerd-shim-spin, spin, spinkube +2 moreSpin has memory leaks in various WIT interfaces6.9 Medium
- maximmasiutin tinywebTinyWeb has Unbounded Content-Length Memory Exhaustion (DoS)8.7 High
- maximmasiutin tinywebTinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)8.7 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab5.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- zeroae zae-limiterzae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service4.3 Medium
- wiresharkImproperly Controlled Sequential Memory Allocation in Wireshark4.7 Medium
- gofiber fiberFiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation7.5 High
- linuxfoundation nats-servernats-server websockets are vulnerable to pre-auth memory DoS5.9 Medium
- bytecodealliance wasmtimeWasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance6.9 Medium
- bytecodealliance wasmtimeWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion6.9 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreMemory allocation with excessive without limits in the internal SVG decoder7.5 High
- withastro astro, astro \@astrojs\/node +1 moreAstro has memory exhaustion DoS due to missing request body size limit in Server Actions5.9 Medium
- moodleMoodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service6.5 Medium
- stalw stalwartStalwart Mail Server has Out-of-Memory Denial of Service via Malformed Nested MIME Messages6.5 Medium
- svelte sveltekit, sveltejs kit +1 moreSvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization8.7 High
- sveltejs devalueSvelte devalue: DoS via malformed input5.3 Medium
- openclawOpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool6.9 Medium
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions8.7 High
- py-pdf pypdfpypdf possibly has long runtimes for malformed FlateDecode streams6.9 Medium
- ethereum go-ethereum, go ethereum +1 moreGo Ethereum affected by DoS via malicious p2p message6.9 Medium
- xmedia recode recodeXMedia Recode 3.4.8.6 - '.m3u' Denial Of Service4.6 Medium
- openclawOpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering8.7 High
- openclawOpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive6.7 Medium
- openclawOpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding6.8 Medium
- openclawOpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch8.7 High
sqlparsePyPIsqlparse: formatting list of tuples leads to denial of service6.9 Medium- centova technologies inc. castCentova Cast 3.2.12 - Denial of Service7.1 High
- pendulum-project ntpd-rsntpd-rs affected by excessive CPU load from malformed packets6.9 Medium
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik: TCP readTimeout bypass via STARTTLS on Postgres7.5 High
- quic-go webtransport-gowebtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule5.3 Medium
- apple ipados, macos, safari +19 more +21 moreThis issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26...5.5 Medium
- google libjxl, red hat enterprise linux 10, enterprise linux 7 +2 more +4 morelibjxl: Out-of-bounds write in grayscale color transformation when using LCMS28.7 High
- qnap qsync centralQsync Central4.9 Medium
- qnap qsync centralQsync Central4.9 Medium
- qnap qsync centralQsync Central4.9 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 53.6 Low
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 53.6 Low
- qnap qsync centralQsync Central2.3 Low
- qnap qsync centralQsync Central3.6 Low
- qnap qsync centralQsync Central3.6 Low
- qnap qsync centralQsync Central1.2 Low
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- Show moreLoading…