CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- scribanScriban before 7.0.0 Denial of Service via Unbounded Template Output7.1 High
- scribanScriban before 7.0.0 Denial of Service via string.pad_left/pad_right8.7 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS is vulnerable to pre-auth DoS through WebSockets client service5.3 Medium
- pinchtabPinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token4.8 Medium
- withastro astro, astro \@astrojs\/node +1 moreAstro: Memory exhaustion DoS due to missing request body size limit in Server Islands5.9 Medium
- concretecms concrete cmsConcreteCMS is vulnerable to Denial of Service During Bulk Downloads6.5 Medium
- rubyonrails rails, rails activesupport +1 moreRails Active Support has a possible DoS vulnerability in its number helpers6.6 Medium
- wwbn avideoAVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php7.5 High
scribanNuGet,Scriban.SignedNuGet +1 moreScriban Affected by Memory Exhaustion (OOM) via Unbounded String Generation (Denial of Service)5.3 Medium- zauberzeug niceguiNiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion6.9 Medium
- salvoSalvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing8.7 High
- qluster deepdiffDeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT8.7 High
- ibm iIBM i Denial of Service7.5 High
- objectcomputing micronaut, micronaut-projects micronaut-core +1 moreMicronaut Framework vulnerable to a Denial of Service in HTML error response caching7.5 High
- bishopfox sliverSliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports5.7 Medium
- openclawOpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request8.7 High
- dicebear@dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions7.5 High
- mattermost, mattermost server +1 moreDoS attack via login attempts with multi-megabyte passwords7.5 High
- forceu gokapiGokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload4.3 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType8.7 High
- nodejs undiciundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS5.9 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 moreundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression7.5 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Unbounded recursion DoS in parse() revive phase7.5 High
- linuxfoundation inspektor gadget, inspektor-gadget +1 moreInspektor Gadget: Tracing Denial of Service via Event Flooding4.8 Medium
- dsd consulting services llc. inputmapperInputMapper 1.6.10 Local Denial of Service via Username Field6.7 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- anchore quillDoS in Quill via unbounded read of HTTP response body during notarization5.3 Medium
- anchore quillUnbounded memory allocation in Quill via unvalidated size fields in Mach-O binary parsing5.5 Medium
- open-feature flagdAllocation of Resources Without Limits or Throttling in flagd7.5 High
- py-pdf pypdfpypdf: manipulated stream length values can exhaust RAM6.8 Medium
- parse-community parse-serverParse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API8.7 High
- microsoft asp.net core, asp.net core 10.0, asp.net core 8.0 +7 more +9 moreASP.NET Core Denial of Service Vulnerability7.5 High
- express-rate-limitexpress-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting (all IPv4 clients share one bucket on dual-stack servers)7.5 High
- coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreCoreDNS Loop Detection Denial of Service Vulnerability7.5 High
- stellar stellar-xdr, rs-stellar-xdr +1 morestellar-xdr: `StringM::from_str` bypasses max length validation4.0 Medium
- vibrantlabsai ragas, red hat openshift ai (rhoai) +1 moreRAGAS has an Arbitrary File Read vulnerability7.5 High
- fasterxml jackson-core, red hat certificate system 10, enterprise linux 10 +2 more +4 morejackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion8.7 High
- traefikTraefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)4.4 Medium
- cisco secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software, secure firewall threat defense +1 more +3 moreA vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive...8.6 High
- expressjs multer, red hat developer hub 1.8, developer hub 1.9 +1 more +3 moreMulter vulnerable to Denial of Service via uncontrolled recursion8.7 High
- openclawOpenClaw < 2026.3.2 - Slow-Request Denial of Service via Pre-Auth Webhook Body Parsing8.7 High
openclawnpmOpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access CheckNo score- jashkenas underscoreUnderscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack8.2 High
- djangoproject django, red hat ansible automation platform 2, discovery 2 +1 more +3 morePotential denial-of-service vulnerability in URLField via Unicode normalization on Windows7.5 High
openclawnpmOpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants6.9 Medium- openclaw, openclaw voice-call, openclaw\/voice-call +2 moreOpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream8.7 High
- openclawOpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass8.7 High
- openclawOpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn8.7 High
- Show moreLoading…