CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- paulsm zeroconf, python-zeroconf +1 moreZeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via multicast flood6.5 Medium
- golang.org/x/image golang.org/x/image/tiffExcessive resource consumption in PackBits decompression in golang.org/x/image/tiff7.5 High
- yhirose cpp-httplibcpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding5.3 Medium
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 WCM brute-force4.1 Medium
- eugeny russhRussh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets7.5 High
- significant-gravitas autogptAutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/execute5.4 Medium
- py-pdf pypdfpypdf: Possible large memory usage for large offsets for layout mode text4.8 Medium
- py-pdf pypdfpypdf: Manipulated XMP metadata streams can exhaust RAM6.9 Medium
- microsoft .net, asp.net core, .net 10.0 runtime +14 more +16 moreASP.NET Core Denial of Service Vulnerability7.5 High
- robur albatrossRobur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to...7.1 High
- oisf suricataikev2: unbounded client transform storage can lead to resource exhaustion7.5 High
- oisf suricataSuricata ldap: unbounded responses per transaction can lead to resource exhaustion7.5 High
- oisf suricataSuricata nfs: unbounded stateful structures can lead to resource exhaustion7.5 High
- oisf suricataSuricata dnp3: unbounded reassembly can lead to resource exhaustion7.5 High
- oisf suricataSuricata lua: sandbox allocation limit not enforced for new allocations5.9 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- ibm db2IBM® Db2® is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables5.5 Medium
- ibm db2IBM® Db2® is vulnerable to a denial of service with a specially crafted query when running an AUTONOMOUS procedure7.1 High
- convoypanel panelPterodactyl has a database resource limit bypass via race condition in Client API2.3 Low
- b&r industrial automation gmbh ppt30 operating systemAllocation of Resources Without Limits or Throttling in the OPC-UA Server8.7 High
- benoitc hackneyAtom table exhaustion via unrecognized URL schemes in hackney8.7 High
- No product listedHP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP...5.9 Medium
- symfony twigTwig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments5.3 Medium
- nocodbNocoDB: Attachment Size Limit Bypass via Upload-by-URL2.1 Low
- nocodbNocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion6.5 Medium
- netatalkUnbounded realloc in charset conversion3.1 Low
- openbaoOpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens5.3 Medium
- progress moveit automationAllocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation4.3 Medium
- progress moveit automationAllocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation5.3 Medium
- phenixdigital phoenix storybookUnauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook8.2 High
- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +23 more +25 more389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)7.5 High
- nlnet labs unbound, red hat data grid 8, enterprise linux 10 +10 more +12 moreLong list of incoming EDNS options degrades performance6.6 Medium
- isc bind, bind 9, red hat enterprise linux 10 +9 more +11 moreBIND 9 server memory exhaustion during GSS-API TKEY negotiation7.5 High
- laurent22 joplinJoplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input5.5 Medium
- setasign fpdiFPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service6.0 Medium
- axllent mailpitMailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes7.5 High
- axllent mailpitMailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)5.9 Medium
- scribanScriban before 7.2.0 Denial of Service via array.insert_at8.7 High
- synology dns serverTechnitium DNS Server excessive DNSSEC requests6.9 Medium
- significant-gravitas autogptAutoGPT: Unauthenticated DoS via Disk Space Exhaustion7.5 High
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick: Policy Bypass in MNG coder could5.3 Medium
- zauberzeug niceguiNiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes5.3 Medium
- opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 moreOpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals5.1 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick: Policy Bypass in PSD decoder5.3 Medium
github.com/hamba/avro/v2Go,github.com/iskorotkov/avro/v2Go +1 moreiskorotkov/avro: Denial-of-Service Vulnerability in Decoder8.7 High- mattermost, mattermost server +1 moreImproper Input Validation in MS Teams Meetings API Handler4.3 Medium
- wpgraphqlWordPress Plugin WPGraphQL 1.3.5 Denial of Service8.7 High
- eugeny russhRussh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases7.5 High
- tuistTuist: Forgot password flow lacks throttling for reset email delivery6.9 Medium
- svelte devalue, red hat build of podman desktop, enterprise linux 10 +1 more +3 moreSvelte devalue: DoS via sparse array deserialization7.5 High
- Show moreLoading…