CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- nodejs undiciundici WebSocket client vulnerable to denial of service via cumulative fragment bypass7.5 High
- nodeca js-yamljs-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing7.5 High
- nodeca js-yamljs-yaml: YAML merge-key chains can force quadratic CPU consumption5.3 Medium
- nodejs node, node.js, red hat enterprise linux 10 +4 more +6 moreA flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt(...7.5 High
- openbaoOpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)3.1 Low
- otrs ag otrsPossible DoS via SQL Box4.5 Medium
- open-telemetry opentelemetry.exporter.jaeger, opentelemetry, open-telemetry opentelemetry-dotnet +2 moreOpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path5.9 Medium
- zcashfoundation zebra-network, zebrad +1 moreZebra: addr/addrv2 Deserialization Resource Exhaustion6.3 Medium
- openclawOpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime Path8.2 High
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations7.5 High
Meridian.MappingNuGet,Meridian.MediatorNuGet +1 moreMeridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)7.5 High- patrickjuchli basic-ftpbasic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()7.5 High
- quantgeekdev mcp-frameworkMCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport8.7 High
- moby spdystream, red hat cert-manager operator for red hat openshift, cluster observability operator 1.5.0 +44 more +46 moreSpdyStream: DOS on CRI8.7 High
- legion of the bouncy castle inc. bc-java, red hat openshift developer tools and services, openshift developer tools and services 4.12 +30 more +32 moreUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.8.7 High
- xwiki, xwiki org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore +2 moreXWiki's REST APIs can list all pages/spaces, leading to unavailability6.9 Medium
- nestjs nestNest: DoS via Recursive handleData in JsonSocket (TCP Transport)7.5 High
- monetrmonetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation8.2 High
- python pillow, red hat lightspeed core, openshift lightspeed +27 more +29 morePillow is vulnerable to a FITS GZIP decompression bomb8.7 High
- No product listedIn Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for...9.8 Critical
- varnish-software varnish enterpriseVarnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic...4.0 Medium
- patrickjuchli basic-ftpbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering7.5 High
- svelte kitSvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node8.2 High
- go-vikunja vikunjaVikunja has a File Size Limit Bypass via Vikunja Import5.4 Medium
- apache activemq, activemq broker, apache software foundation activemq all +10 more +12 moreApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM7.5 High
- mervinpraison praisonaiPraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits7.5 High
- mervinpraison praisonaiPraisonAI has an Unrestricted Upload Size in WSGI Recipe Registry Server Enables Memory Exhaustion DoS6.2 Medium
- openclawOpenClaw < 2026.4.8 - Improper Base64 Decoding Size Validation5.3 Medium
- orthanc-server orthanc, orthanc dicom server +1 moreMemory Exhaustion via Forged ZIP Metadata7.5 High
- orthanc-server orthanc, orthanc dicom server +1 moreGzip Decompression Bomb via Content-Encoding Header7.5 High
- orthanc dicom server, orthanc-server orthanc +1 moreMemory Exhaustion via Unbounded Content-Length7.5 High
- mattermostUnbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint3.7 Low
- mattermost, mattermost server +1 moreUnbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint3.7 Low
- minioMinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing7.1 High
- tmds tmds.dbus, tmds.dbus.protocol +1 moreTmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service7.1 High
- meta react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack +1 more +3 moreReact Server Components have a Denial of Service Vulnerability7.5 High
- saleorSaleor has a resource exhaustion vulnerability in GraphQL queries7.5 High
- saleorSaleor Affected by Denial of Service via Unbounded GraphQL Query Batching7.5 High
github.com/platform-mesh/kubernetes-graphql-gatewayGokubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution6.5 Medium- go standard library archive/tar, golang go +1 moreUnbounded allocation for old GNU sparse in archive/tar5.5 Medium
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x5097.5 High
- linuxfoundation podman desktop, podman-desktop, red hat build of podman desktop +2 more +4 morePodman Desktop WebView Server Exposed8.2 High
- open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +7 more +9 moreOpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)7.5 High
- wikimedia foundation mediawiki - reportincident extensionReportIncident DiscussionTools integration causes slow requests5.3 Medium
- openclawOpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypass2.3 Low
- djangoproject djangoPotential denial-of-service vulnerability in ASGI requests via memory upload limit bypass7.5 High
- mediatek mt6813 firmware, mt6815 firmware, mt6835 firmware +17 more +19 moreIn Modem, there is a possible system crash due to a logic error. This could lead to remote denial...6.5 Medium
- ipld go-ipld-primego-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers6.2 Medium
- pmmp pocketmine-mpPocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket7.1 High
- Show moreLoading…