CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 moreArgo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor8.2 High
- linuxcontainers incusIncus: Unbounded binary import disk exhaustion4.3 Medium
- linuxcontainers incusIncus: Unbounded YAML Metadata Decode via Parsing5.3 Medium
- @fastify/accepts-serializer, fastify fastify\/accepts-serializer +1 more@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth7.5 High
- apache opennlp, red hat data grid 8, fuse 7 +2 more +4 moreApache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader7.5 High
- prometheus, red hat file integrity operator, logging for red hat openshift 6 +53 more +55 morePrometheus: remote read endpoint allows denial of service via crafted snappy payload7.5 High
- red hat enterprise linux 10, enterprise linux 9 +1 moreAn issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the...5.9 Medium
- red hat enterprise linux 10, enterprise linux 9 +1 moreAn issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the...7.5 High
- rapid7 velociraptorUnbounded Memory Allocation in VQLResponse Result-Set Writer4.9 Medium
- mtrudel banditWebSocket permessage-deflate inflate has no output-size cap in bandit8.2 High
- mtrudel banditWebSocket fragmented message reassembly unbounded in bandit8.7 High
- mtrudel banditHTTP/2 frame size limit checked after body is buffered in bandit6.9 Medium
- prosodyAn issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial...5.3 Medium
- hickory-dnsHickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression8.7 High
- ibm db2IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic6.5 Medium
- cryptpadCryptPad unbounded WebSocket frame flood8.7 High
- bytecodealliance wasmtime, red hat enterprise linux 10, hardened images +2 moreWasmtime: Panic when allocating a table exceeding the size of the host's address space5.9 Medium
- n8nn8n: Unauthenticated Denial of Service via MCP Client Registration8.7 High
- phpoffice phpspreadsheetPhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions7.5 High
- phpoffice phpspreadsheetPhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader7.5 High
- opentelemetry opentelemetry.exporter.onecollector, open-telemetry opentelemetry-dotnet-contrib +1 moreOpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body5.3 Medium
- opentelemetry opentelemetry.resources.azure, open-telemetry opentelemetry-dotnet-contrib +1 moreUnbounded HTTP response body read in OpenTelemetry.Resources.Azure5.9 Medium
- pgjdbc, postgresql jdbc driver, red hat amq broker 7.13.6 +17 more +19 morepgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS7.5 High
- opentelemetry opentelemetry.exporter.zipkin, open-telemetry opentelemetry-dotnet +1 moreOpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth5.3 Medium
- corednsCoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service8.7 High
- elixir-plug plug.cowboy, plug cowboy +1 moreAtom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy8.7 High
- axios, red hat cryostat 4, gatekeeper 3 +61 more +63 moreAxios: unbounded recursion in toFormData causes DoS via deeply nested request data6.9 Medium
- axiosAxios: HTTP adapter streamed responses bypass maxContentLength5.3 Medium
- axiosAxios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 05.3 Medium
- eugeny russh, warpgate project warpgate +1 moreRussh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth7.5 High
- grafana tempo, enterprise traces (get), red hat logging subsystem for red hat openshift +13 more +15 moreTempo query limit results in unbounded memory allocation7.5 High
- opensource-socialnetworkOpen Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image Processing8.2 High
- open-telemetry opentelemetry-dotnet-contribUnbounded HTTP response body read in OpenTelemetry.Sampler.AWS5.9 Medium
- monetrmonetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh8.3 High
- nimiq network-libp2p, proof-of-stake +1 moreNimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/response5.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- powerdns dnsdistOutgoing DoH excessive memory allocation5.3 Medium
- powerdns dnsdistDoQ/DoH3 excessive memory allocation5.3 Medium
- powerdns dnsdistResource exhaustion via DoQ/DoH3 connections5.3 Medium
- powerdns authoritative, dnsdist, recursor +2 moreInsufficient input validation of internal webserver5.3 Medium
- powerdns recursorCrafted zones can cause increased resource usage5.3 Medium
- powerdns authoritative, dnsdist, recursor +2 moreInsufficient input validation of internal webserver5.3 Medium
- powerdns recursorUnbounded memory allocation by internal web server5.3 Medium
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...3.7 Low
- golang image, golang.org/x/image golang.org/x/image/font/sfnt +1 moreExcessive memory allocation when decoding malicious SFNT in golang.org/x/image6.1 Medium
- dayuanjiang next ai draw.io, next-ai-draw-io +1 moreNext AI Draw.io: Unbounded HTTP Body — Denial of Service6.2 Medium
- freescoutFreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron8.9 High
- Show moreLoading…