CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- github enterprise serverDenial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration5.7 Medium
- openclawOpenClaw < 2026.6.1 Denial of Service via Remote Media URLs6.0 Medium
- h2oh2o has HTTP/2 state amplification7.5 High
- h2oh2o is vulnerable to musl libc stack overflow7.5 High
- h2o quiclyQuicly is vulnerable to memory exhaustion5.3 Medium
- anthropics buffaBuffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation6.3 Medium
- grafana lokiLoki detected_fields query limits results in unbounded memory allocation7.5 High
- feast feature server, red hat openshift ai (rhoai) +1 moreFeast: resource exhaustion via websocket endpoint7.5 High
- pomeriumPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback7.5 High
- datadog dd-trace-rbdd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS7.5 High
- datadog dd-trace-godd-trace-go: Improper parsing of W3C baggage headers may lead to DoS7.5 High
- datadog dd-trace-dotnetDatadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS7.5 High
- datadog dd-trace-jsdd-trace: Improper parsing of W3C baggage headers may lead to DoS7.5 High
- datadog dd-trace-pydd-trace-py: Improper parsing of W3C baggage headers may lead to DoS7.5 High
- datadog dd-trace-java, com.datadoghq dd-java-agent +1 moredd-trace-java: Improper parsing of W3C baggage headers may lead to DoS7.5 High
- faye websocket-driver-nodewebsocket-driver: Resource limit bypass via message compression6.3 Medium
- faye websocket-driver, websocket-driver-ruby +1 morewebsocket-driver: Memory exhaustion in HTTP header parser6.3 Medium
- faye websocket-driver-rubywebsocket-driver: Resource limit bypass via message compression6.3 Medium
- faye websocket-driver, websocket-driver-ruby +1 morewebsocket-driver: Memory exhaustion via abuse of protocol length headers6.9 Medium
- f5 big-ip, big-ip next cnf, big-ip next for kubernetes +3 more +5 moreBIG-IP HTTP/2 vulnerability8.7 High
- asus business manager, system control interface, business manager manager +1 more +3 moreAllocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not...8.2 High
- nvidia tensorrt-llmNVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an...6.2 Medium
github.com/lin-snow/ech0GoEch0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware8.7 High- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 moreLibsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation7.5 High
- spectolabs hoverflyHoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +18 more +20 moreHTTP/2 Denial of Service Vulnerability7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +18 more +20 moreHTTP.sys Denial of Service Vulnerability7.5 High
- microsoft asp.net core odata, aspnet.odata, aspnetcore.odata +1 more +3 moreOData for ASP.NET and ASP.NET Core Denial of Service Vulnerability7.5 High
- microsoft asp.net core odata, aspnet.odata, aspnetcore.odata +1 more +3 moreOData for ASP.NET and ASP.NET Core Denial of Service Vulnerability7.5 High
- pyasn1pyasn1: Uncontrolled resource consumption when converting decoded REAL values7.5 High
- python pillowPillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()7.5 High
- bulwarkmail webmailIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial...4.3 Medium
- python pillowPillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service8.7 High
- hmbrand dbi::profiledataDBI::ProfileData versions before 1.651 for Perl do not limit the path index7.5 High
- cloudflare quicheUnbounded path event queue growth in quiche via peer-driven source connection ID rotation7.5 High
- rockwell automation 1734 point i/o1734 POINT I/OTM - Denial of Service via Malformed Inputs on CIP Object6.3 Medium
- rockwell automation 1718-aentr/1719-aentr1718-AENTR/1719-AENTR - Denial of Service8.7 High
- siemens simatic s7-plcsim advancedA vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected...6.0 Medium
- elixir-mint mintZero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory6.3 Medium
- elixir-mint mintUnbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS8.2 High
- hedgedocHedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofing6.9 Medium
- imagemagickImageMagick before 7.1.2-26 Memory Allocation Policy Bypass4.8 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS7.5 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size7.1 High
- getgrav gravGrav: Unauthenticated denial of service via unbounded image derivative dimensions8.7 High
- excelizeExcelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)7.5 High
- excelizeExcelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation8.7 High
- n8nn8n - Disk Space Exhaustion via Data-Table File Upload Endpoint5.3 Medium
- cap-go capgoCapgo - Plan Bypass via Unrestricted Attachment Upload Endpoint5.3 Medium
- elixir-plug plugPlug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)6.9 Medium
- Show moreLoading…