CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- @fastify/rate-limit, fastify fastify\/rate-limit +1 more@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation7.3 High
- gotd tdtd has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode7.5 High
- quiet-terminal-interactive qtineonQTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding8.6 High
- gopacketGoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS6.9 Medium
- gopacketGoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)6.9 Medium
- nvidia dcgm, dcgm exporter +1 moreNVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints,...8.2 High
- convoypanel panelPterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)7.5 High
- ninenines cowboyCowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion6.9 Medium
- ninenines cowlibUnbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS8.7 High
- erlang otp, erlang\/otp, erlang\/public key +2 moreDenial of service via exponential certificate policy tree growth in path validation8.7 High
- erlang erts, otp, erlang\/otp +2 moreepmd permanent DoS via EMFILE on accept(2) in erts6.3 Medium
- mattermost, mattermost server +1 moreDenial of service via unbounded document content extraction in Mattermost Server4.3 Medium
- apache thriftApache Thrift: Rust binary protocol non-strict path missing string size limit8.7 High
- apache thriftApache Thrift: Node.js quadratic-time DoS in server receive transports8.7 High
- apache thriftApache Thrift: Unbounded Read Leading to Denial of Service6.9 Medium
- etcd-io etcdetcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline8.7 High
- omnifacesOmniFaces: Forged combined-resource IDs and related output/push boundaries8.2 High
- http4s blazehttp4s-blaze-server: Unbounded WebSocket message aggregation7.5 High
- quic-go webtransport-gowebtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules5.3 Medium
- cloudreveCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)6.5 Medium
- ffmpegFFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()7.1 High
- aws aws-smithy-http-serverAllocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service8.7 High
- bizimhesap information systems industry and trade inc. online pre-accounting softwareUnrestricted File Upload in BizimHesap Information Systems' Online Pre-Accounting Software4.3 Medium
- juliangruber brace-expansionbrace-expansion DoS via unbounded expansion length causing an out-of-memory process crash7.5 High
- dompdfDompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps6.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreQueryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service6.9 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 more$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAggregation Framework Memory Exhaustion Leading to Process Termination7.1 High
- elggElgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar...4.3 Medium
- isc bind, bind 9 +1 morePotential memory usage beyond configured limits7.5 High
- honojs node-server@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake5.3 Medium
google.golang.org/grpcGo,rootio-google.golang.org/grpcRoot +1 moregRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities8.8 High- fasterxml jackson-corejackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)8.7 High
- oracle corporation java se, oracle jdk, jre +2 moreVulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is...5.3 Medium
- gitea open source git serverDenial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint6.5 Medium
- gitea open source git serverUnbounded Arch package file metadata can cause resource amplification in Gitea package uploads4.3 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- meta react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack +2 morereact-server-dom: Denial of Service in Server Functions7.5 High
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: denial of service via sftp responses with unknown request ids5.3 Medium
- guzzleguzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service6.9 Medium
- axiosaxios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream6.3 Medium
- freescout-help-desk freescoutFreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)5.3 Medium
- axiosaxios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON6.3 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.19 +29 more +31 moreGdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering5.3 Medium
- libgit2libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header5.3 Medium
- oisf suricataSuricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages7.5 High
- oisf suricataSuricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion6.5 Medium
- zalando skipperSkipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS4.3 Medium
- Show moreLoading…