CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation iotdbApache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver7.5 High
- zeekZeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer8.7 High
- facelessuser soup sieve, soupsieve +1 moreSoup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve7.5 High
- pyloadpyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager6.5 Medium
- body-parserbody-parser vulnerable to denial of service when invalid limit value silently disables size enforcement3.7 Low
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreDoS through oversized audit log entries in Guardian/CMC before 26.2.08.7 High
- libp2p js-libp2plibp2p: CPU DoS via oversized IHAVE and IWANT control message arrays7.5 High
- httplib2httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling7.5 High
- harttle liquidjsLiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce8.2 High
- hashicorp shared libraryDenial of service via crafted push/pull gossip message in memberlist4.9 Medium
- isaacs node-tar, tar +1 morenode-tar: Decompression/parse DoS via unlimited input9.2 Critical
- openbsd opensshsshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.6.5 Medium
- openbsd opensshsshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource...3.7 Low
- phoenixframework phoenixPhoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service8.7 High
- coollabsio coolifyCoolify: File Upload Without Type or Size Validation in Database Backup Restore3.1 Low
- coollabsio coolifyCoolify unauthenticated feedback endpoint allows Discord webhook abuse6.5 Medium
- coderCoder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints6.5 Medium
- coderCoder: Zip upload decompression lacks aggregate size limit, enabling denial of service6.5 Medium
- vllmvLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit6.5 Medium
- trustedfirmware op-tee, op-tee optee os +1 moreOP-TEE has missing OPTEE_MSG_ATTR_TYPE_MASK in cleanup_shm_refs() leaks mobj references3.8 Low
- openvpnA memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1...6.0 Medium
- elixir-mint mintmint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/58.7 High
zebradcrates.io,zebra-networkcrates.io +1 moreZebra has pre-handshake buffer capacity reservation based on attacker-claimed body length3.7 Low- zcashfoundation zebraZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation5.3 Medium
- zcashfoundation zebra, zebra-chain +1 moreZebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length6.3 Medium
- eclipse-wakaama wakaamaEclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoS8.7 High
- o6 automation gmbh open62541GetEndpoints Memory Exhaustion in open625417.5 High
- eclipse foundation parssonIn Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did...7.5 High
- o6 automation gmbh open62541FindServers Memory Exhaustion in open625417.5 High
- axllent mailpitMailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)5.3 Medium
- surrealdbSurrealDB before 3.1.0 Memory Amplification via /sql WebSocket6.9 Medium
- apache httpcomponents coreApache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK7.5 High
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- clamav, cisco secure endpoint +1 moreClamAV InstallShield File Format Processing Resource Exhaustion Vulnerability7.5 High
- elastic fleet serverAllocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service6.5 Medium
- elastic elasticsearchAllocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service4.9 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 8 +4 more +6 morePipewire: pulse server alloca stack overflow5.5 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence4.3 Medium
- linuxfoundation sigstore timestamp authority, sigstore timestamp-authority +1 moreSigstore Timestamp Authority: OOM due to unbounded metric label cardinality5.9 Medium
- sanko net::bittorrentNet::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix7.5 High
- delta electronics dvp-12seDVP-12SE Exposure of Sensitive Information Vulnerability9.3 Critical
- leandrocp mdexAtom-table exhaustion denial-of-service via JSON parse_document in MDEx8.2 High
@cardano402/mcp-servernpm@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url0.0 None- scribanScriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication8.7 High
- miguelgrinberg python-socketiopython-socketio: Binary attachment accumulation can cause denial of service7.5 High
- miguelgrinberg python-engineiopython-engineio has unbound thread allocation that can cause denial of service7.5 High
- miguelgrinberg python-engineiopython-engineio has possible denial of service due to maximum payload size sometimes not being enforced7.5 High
github.com/apernet/hysteriaGoHysteria: http large header with sniff cause server DoS7.5 Highgithub.com/apernet/hysteriaGoHysteria vulnerable to server crash when max_datagram_frame_size very small7.5 High- fluent-plugins-nursery fluent-plugin-opentelemetryfluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`5.3 Medium
- Show moreLoading…