CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- websockets ws, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 morews: Memory exhaustion DoS from tiny fragments and data chunks7.5 High
- mattermost, mattermost desktop +1 moreOverly long URLs crash the Mattermost Desktop App6.5 Medium
- nezhahq nezhaNezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS6.5 Medium
github.com/apple/swift-nio-extrasSwiftURLNIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length6.9 Mediumgithub.com/apple/swift-nioSwiftURLSwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS8.7 High- netty, red hat build of apache camel - hawtio 4 +1 moreNetty HTTP/3 QPACK Blocked Streams Memory Exhaustion7.5 High
postgres-protocolcrates.iopostgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service8.7 High- duck-organization questbotQuest Bot: Ticket creation has no per-user open-ticket limit or cooldown5.3 Medium
- steipete summarizeSummarize < 0.17.0 Disk Exhaustion via Uncapped Media Download5.3 Medium
- paulsm zeroconf, python-zeroconf +1 moreZeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood6.5 Medium
- membraneframework membrane mp4 pluginUnauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_plugin5.9 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- sigstore rekorRekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic7.5 High
- vllm, vllm-project vllm-project/vllm, red hat ai inference server +2 more +4 moreUnbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm7.5 High
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick: Policy Bypass can trigger out-of-Memory condition7.5 High
- aws s2n-quicExcessive memory allocation in s2n-quic6.9 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 51.3 Low
- spring for apache kafka, vmware spring for apache kafka +1 moreIn Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header6.5 Medium
- broadcom spring data commons, spring data commons +1 moreSpring Data web support unbounded negative-result cache keyed on attacker-supplied property names7.5 High
- amd uprof, µprof, μprof +2 moreUnrestricted resource allocation in AMD uProf may be exploitable to consume excessive system...6.8 Medium
- nesquena hermes-webuiHermes WebUI < 0.51.270 Resource Exhaustion via passkey/options6.9 Medium
- spring hateoas, vmware spring hateoas +1 moreSpring HATEOAS heap exhaustion through unbounded internal caching7.5 High
- spring framework, vmware spring framework +1 moreSpring Framework Denial of Service via Unbounded Cache in SpEL5.3 Medium
- broadcom spring retry, spring retry +1 moreCache Exhaustion in Stateful Retries leads to Denial of Service5.9 Medium
- spring micrometer, red hat amq broker 7.13.6, amq broker 7.14.1 +19 more +21 moreMicrometer HTTP server instrumentations DoS vulnerability7.5 High
- spring micrometer, red hat amq broker 7.14.1, amq clients +18 more +20 moreMicrometer gRPC server instrumentation DoS vulnerability7.5 High
- strukturag libheiflibheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)7.5 High
- ninenines gungun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion8.7 High
- petdance app::ackApp::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc7.5 High
vibeio-httpcrates.iovibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths6.9 Medium- cloudburstmc networkCloudburst Network has DoS in RakNet connection handling due to missing bound checks7.5 High
- klever-io klever-goKlever-Go: REST API slow-header connection exhaustion via Gin Engine.Run7.5 High
- klever-io klever-goKlever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS7.5 High
- openstack ironic, red hat openshift container platform 4, openstack platform 16.2 +2 more +4 moreOpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash5.3 Medium
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Allocation of Resources Without Limits or Throttling in axios7.5 High
- dell bsafe ssl-jDell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability....7.5 High
openvswitchDebianA missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an...6.5 Medium- quic-goquic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion5.3 Medium
- djangoproject daphneUnbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service5.3 Medium
- solarwinds web help deskSolarWinds Web Help Desk Denial-of-Service Vulnerability8.2 High
- elixir-tesla teslaAtom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint8.2 High
- @tanstack react-router, remix-run turbo-stream, turbo-stream turbo stream +2 moreReact Router vulnerable to Denial of Service via reflected user input in single-fetch7.5 High
- elixir-mint mintHTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation8.2 High
- elixir-mint mintUnbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency8.2 High
- hkuds nanobotNanobot < 0.2.1 Denial of Service via Matrix Media Download Handler5.3 Medium
- spring cloud function, vmware spring cloud function +1 moreUnbounded cache for function definitions5.7 Medium
- redhat openshift container platform, red hat openshift container platform 4 +1 moreOpenshift: openshift: non-admin user can bypass resourcequota and flood etcd with events causing cluster-wide api degradation5.0 Medium
- apache fluss, apache software foundation fluss (incubating) +1 moreApache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability7.5 High
- otrs, otrs ag ((otrs)) community edition +1 moreEmail with special content can lead to DoS5.7 Medium
- Show moreLoading…