CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 moreopentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation5.3 Medium
- element synapseSynapse CPU starvation (Denial of Service)6.8 Medium
- elixir-plug plugUnbounded buffer accumulation in multipart header parsing causes denial of service in plug8.2 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- grafana, grafana oss +1 moreGrafana plugin resources can lead to unbounded memory allocation6.5 Medium
- grafana, grafana oss +1 moreGrafana Live push endpoint allows unbounded memory allocation leading to OOM6.5 Medium
- ninenines cowboyUnbounded buffer accumulation in multipart header parsing causes denial of service in cowboy8.2 High
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS5.1 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP SIP profile vulnerability8.7 High
- f5 big-ip, big-ip advanced web application firewall, big-ip application security manager +1 more +3 moreBIG-IP HTTP/2 Layer 7 Dos Protection vulnerability8.7 High
- f5 big-ip, big-ip next cnf, big-ip next for kubernetes +24 more +26 moreBIG-IP SSL/TLS vulnerability8.7 High
- mtrudel banditHTTP/1 chunked body reader ignores length cap in bandit8.7 High
- gnome malcontentmalcontent: Disk Space Exhaustion via Globally Accessible D-Bus API5.1 Medium
- klever-io klever-goKlever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload8.6 High
- mongodb, mongodb, inc. mongodb server +1 morePost-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators5.3 Medium
- m2team nanazipNanaZip: Unbounded resource consumption in NanaZip littlefs parser via attacker-controlled BlockCount3.3 Low
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreUnauthenticated Denial of Service in AOS-8 Network Management Service7.5 High
- apache tomcatApache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling7.5 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +14 more +16 moreAn attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE...4.3 Medium
- siemens simatic cn 4100, simatic cn 4100 firmware +1 moreA vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected...8.7 High
@vitejs/plugin-rscnpm@vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components7.5 High- linuxfoundation volcanoVolcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size6.8 Medium
- absinthe-graphql absintheAtom table exhaustion via attacker-controlled GraphQL SDL names in absinthe8.2 High
- zcashfoundation zebraZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning8.7 High
- linux, linux kernel, red hat enterprise linux 10 +26 more +28 morenetfilter: flowtable: strictly check for maximum number of actions7.8 High
- apache cloudstackApache CloudStack: Domain/account resources limits not honored6.5 Medium
- gpacGPAC box_code_base.c sidx_box_read allocation of resources4.8 Medium
- lin-snow ech0Ech0 before 4.7.3 Unauthenticated fav_count Modification6.9 Medium
- github enterprise serverDenial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint6.3 Medium
- zcashfoundation zebra, zfnd zebra-chain, zebra-network +1 more +3 moreZEBRA: Allocation Amplification in Inbound Network Deserializers5.3 Medium
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mail7.5 High
- divvydrive information technologies inc. divvydriveInput Data Manipulation in DivvyDrive Information Technologies' DivvyDrive8.3 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)7.5 High
- netty, io.netty netty-codec-http3 +1 moreNetty: HTTP/3 QPACK literal unbounded allocation7.5 High
ldap3_protocrates.ioldap3_proto has LDAP Filter stack exhaustion8.7 Highgithub.com/getaxonflow/axonflowGoAxonflow fixed bugs by implementing multi-tenant isolation and access-control hardening9.1 CriticalaiograpiPyPIaiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221)2.9 Low- kludex python-multipart, red hat exploit intelligence, openshift lightspeed +11 more +13 morePython-Multipart: Denial of Service via unbounded multipart part headers7.5 High
- eclipse vert.xVert.x has a DoS via unbounded server-side SNI SslContext cache growth6.9 Medium
- jo-jo98 ciguardciguard: SCA HTTP client reads response body without size cap3.7 Low
graphqlRubyGemsGraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens5.3 Mediumgithub.com/apernet/hysteria/coreGo,github.com/apernet/hysteria/core/v2Go +1 moreHysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled8.8 High- gitoxidelabs gitoxidegitoxide before 0.69.0 Denial of Service via gix-pack8.7 High
- phoenixframework phoenixLong-poll NDJSON body splitting causes unbounded memory allocation in Phoenix8.7 High
- apache http serverApache HTTP Server: mod_md unrestricted OCSP response7.3 High
- No product listedAn issue was discovered in MM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos...7.5 High
- ruby net-imap, ruby-lang net\ +1 morenet-imap: Denial of service via high iteration count for `SCRAM-*` authentication6.0 Medium
- hashicorp boundary, boundary enterprise +1 moreBoundary Workers Vulnerable to Denial of Service During TLS Handshake7.5 High
- Show moreLoading…