CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- fluent fluent-plugin-s3fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`2.7 Low
- significant-gravitas autogptAutoGPT: There is a DoS vulnerability in AITextSummarizerBlock5.3 Medium
- significant-gravitas autogptAutoGPT: There is a DoS vulnerability in ExtractTextInformationBlock5.3 Medium
- kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 moreKubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service3.8 Low
- open-telemetry opentelemetry-rustOpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation5.3 Medium
- aquasec trivyTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser6.9 Medium
- danny-avila librechatLibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits6.5 Medium
- danny-avila librechatLibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork6.5 Medium
- powerdns dnsdistDenial of service via crafted DoH3 queries5.3 Medium
- tp-link systems inc. tapo c200 v3, tp-link tapo c200 firmware +1 moreDenial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C2007.1 High
- lepture mistune, red hat migration toolkit for applications 8, openshift ai (rhoai) +3 more +5 moreMistune: Potential DoS via quadratic-time parsing in parse_link_text8.7 High
- curlWS Auto-PONG memory exhaustion7.5 High
- grokability snipe-itSnipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`5.9 Medium
- open-telemetry opentelemetry-ebpf-profileropentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent6.2 Medium
- python software foundation cpythontarfile opened in streaming mode mishandles EOF8.2 High
- red hat enterprise linux 7An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers...7.5 High
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths6.3 Medium
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length6.3 Medium
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions6.3 Medium
- cap-go capgoCapgo - Rate Limit Bypass via User-Controlled device_id Parameter8.8 High
- cap-go capgoCapgo - Denial of Service via Unlimited Demo App Creation5.3 Medium
- gophishGophish 0.12.1 Denial of Service via Office Document Upload7.1 High
- grafana, grafana enterprise, oss +2 morePre-authentication denial of service in the public dashboard query endpoint7.5 High
- ibm db2, db2 on cloud pak for data and db2 warehouse on cloud pak for data, db2 warehouse +2 moreMultiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.6.5 Medium
- quinn-rs quinnquinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly7.5 High
kozounpm,@kozou/apinpm,@kozou/corenpm +1 more +3 moreKozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)8.4 High- strukturag libde265libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL`4.3 Medium
- faraday project faraday, red hat 3scale api management platform 2, satellite 6 +5 more +7 moreFaraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters7.5 High
- symfony uxSymfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests5.3 Medium
- hitachi virtual storage platform e390, e590, e790, e390h, e590h, e790h, virtual storage platform e990, e1090, e1090h, virtual storage platform g100, g200, g400, g600, g800, f400, f600, f800 +3 more +5 moreDoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform8.6 High
web-token/jwt-frameworkPackagist,web-token/jwt-libraryPackagist +1 morePHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service8.7 High- nesquena hermes-webuiHermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint6.9 Medium
- ncalcNCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation4.8 Medium
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +1 more +3 moreASP.NET Core Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more.NET Denial of Service Vulnerability7.5 High
- microsoft .net, .net framework, .net 10.0 runtime +13 more +15 more.NET Framework Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +14 more +16 more.NET Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +13 more +15 more.NET Denial of Service Vulnerability7.5 High
- authlib joserfcjoserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization5.3 Medium
- envoyproxy envoy, red hat openshift service mesh 2.6, openshift service mesh 3.0 +4 more +6 moreEnvoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification7.5 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +25 more +27 moreundici WebSocket client vulnerable to denial of service via fragment count bypass7.5 High
- teldat regesta smart hd-plc - tldph16d2WEB SERVICE (HTTP) DENIAL OF SERVICE VIA SLOW HEADERS ON REGESTA SMART HD-PLC OF TELDAT6.9 Medium
- elixir-grpc grpcRemote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc9.2 Critical
- elixir-grpc grpcUnbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc8.7 High
- encode starletteStarlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS7.5 High
- open-telemetry opentelemetry-js, opentelemetry +1 moreopentelemetry-js: Unbounded memory allocation in W3C Baggage propagation5.3 Medium
- protobufjs project protobufjs, protobufjs protobuf.js +1 moreprotobufjs: Memory amplification from preserved unknown fields in binary decode5.3 Medium
- aio-libs aiohttpAIOHTTP: Incomplete websocket frame payloads bypass memory limits6.6 Medium
- aio-libs aiohttpAIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit6.6 Medium
- aio-libs aiohttpAIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines6.6 Medium
- Show moreLoading…