CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- strawberry graphql, strawberry-graphql strawberry +1 moreStrawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions7.5 High
- @fedify fedify, vocab-runtime, fedify fedify\/fedify +1 more +3 moreFedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution7.5 High
directusnpmDirectus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver7.5 High- directusDirectus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits6.5 Medium
io.root.tools.jackson.core:jackson-coreRoot,tools.jackson.core:jackson-coreMaven +1 moreJackson Core: Document length constraint bypass in blocking, async, and DataInput parsers7.5 High- mesop-dev mesopMesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service7.5 High
- vllm, red hat ai inference server, ai inference server 3.2 +3 more +5 morevLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing6.5 Medium
- jupyter lti jupyterhub authenticator, jupyterhub ltiauthenticator +1 moreLTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)5.9 Medium
- amazon athena odbc driver, athena odbc +1 moreAllocation of resources without limits in parsing components in Amazon Athena ODBC driver8.7 High
- vllm, red hat ai inference server, ai inference server 3.2 +3 more +5 morevLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server6.5 Medium
- budibaseBudibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding5.3 Medium
- linux, linux kernel +1 moredrm/amdgpu: Limit BO list entry count to prevent resource exhaustion5.5 Medium
- openclawOpenClaw < 2026.3.31 - Resource Consumption via Unauthorized Telegram Audio Preflight Transcription6.9 Medium
- openclawOpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-call6.9 Medium
- openclawOpenClaw < 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard Bypass7.1 High
- openclawOpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization6.9 Medium
- dokuwikiAn issue in Dokuwiki v.2025-05-14b 'Librarian' allows a remote attacker to cause a denial of...4.3 Medium
- openclawOpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency6.9 Medium
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack: Algorithmic-Complexity DoS in Rack::Multipart::Parser7.5 High
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack: Denial of Service via Unbounded Multipart File Upload Without Content-Length7.5 High
- rackRack: Unbounded Range Count in get_byte_ranges Enables DoS5.3 Medium
- protocol libp2p, libp2p rust-libp2p +1 morelibp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion8.2 High
- protocol libp2p, libp2p rust-libp2p +1 morelibp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers7.5 High
- gleam-wisp wispMultipart form body parser bypasses body size limits in wisp8.7 High
- nothings stb, stb vorbis.c +1 moreNothings stb stb_vorbis.c setup_free allocation of resources5.3 Medium
- ibm aspera sharesMultiple vulnerabilities have been addressed in IBM Aspera Shares2.7 Low
- aio-libs aiohttpAIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS2.7 Low
- aio-libs aiohttpAIOHTTP: Multipart Header Size Bypass6.6 Medium
- aio-libs aiohttpAIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector2.7 Low
- aio-libs aiohttpAIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers6.9 Medium
- ash-hq ash framework, ash-project ash +1 moreAsh Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash8.2 High
- openclawOpenClaw < 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket Upgrades8.7 High
- jahlives openssl encryptopenssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass9.3 Critical
- go-gitgo-git: Maliciously crafted idx file can cause asymmetric memory consumption5.0 Medium
- fleetdm fleetFleet's unbounded request body read allows remote Denial of Service8.7 High
- grafana, red hat enterprise linux 10, enterprise linux 8 +1 more +3 moreOpenFeature evaluation API reads input data with no bounds7.5 High
- oisf suricataSuricata http2: unbounded resource consumption7.5 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreAttacker can send a specifically crafted message before authentication that causes managesieve to...7.5 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreSending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory...4.3 Medium
- linuxcontainers incusIncus vulnerable to denial of source through crafted bucket backup file6.5 Medium
- miraheze tsportalTSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service6.5 Medium
- openclawOpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responses6.9 Medium
- stirling pdf, stirling-tools stirling-pdf +1 moreStirling-PDF vulnerable to DoS via add-watermark6.5 Medium
- nodejs node, node.js, red hat enterprise linux 10 +7 more +9 moreA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received...7.5 High
- freedesktop polkit, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePolkit: polkit: denial of service via unbounded input processing through standard input5.5 Medium
- siemens cpci85 central processing/communication, rtum85 rtu base +1 moreA vulnerability has been identified in CPCI85 Central Processing/Communication (All versions <...7.1 High
- rubyonrails rails, rails activestorage +1 moreRails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests2.3 Low
- golang tiff, golang.org/x/image golang.org/x/image/tiff +1 moreOOM from malicious IFD offset in golang.org/x/image/tiff5.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- isc bind, bind 9, red hat enterprise linux 10 +25 more +27 moreExcessive NSEC3 iterations cause high CPU load during insecure delegation validation7.5 High
- Show moreLoading…