CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- atn-b1 cpdlcIn CPDLC, Broadcast Control Frames Can Disconnect Multiple Aircraft Simultaneously6.0 Medium
- divvypayhq absinthe federationAtom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation8.7 High
- open-reception appointment-booking-softwareOpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification3.7 Low
- apache cxfApache CXF: Denial of Service attack via large attachments7.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 extended lifecycle support +11 more +13 moreGstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders7.5 High
- @clerk nuxtNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation7.5 High
- @clerk nuxtNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering7.5 High
- rclonerclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory5.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.5, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text6.5 Medium
- suse rancherRancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service7.5 High
- suse rancherUnauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent4.3 Medium
- apache qpid protonj2Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery7.5 High
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming delivery6.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery6.5 Medium
- apache qpid proton-jApache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery6.5 Medium
- apache qpid protonj2Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded6.5 Medium
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Incoming session flow control window can be exceeded6.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Incoming session flow control window can be exceeded6.5 Medium
- apache qpid proton-jApache Qpid Proton-J: Incoming session flow control window can be exceeded6.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication7.5 High
- apache qpid protonj2Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion7.5 High
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion7.5 High
- apache qpid broker-jApache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion7.5 High
- apache qpid proton-jApache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion7.5 High
- perspective-dev perspectivePerspective 5.0.0 DoS via Loop Expression Evaluation7.1 High
- moby buildkitBuildKit: Possible runtime DoS via unbounded group parsing2.3 Low
- juliangruber brace-expansionbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation7.5 High
- misp cti-transmuteUnauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute8.7 High
- bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 morePKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)5.3 Medium
- bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 moreBCFKS keystore load honours unbounded KDF cost from untrusted file5.3 Medium
- mediatek mt7902 firmware, mt7921 firmware, mt7922 firmware +3 more +5 moreIn wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead...6.5 Medium
- bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreCRMF/CMP password-MAC honours unbounded iteration count6.9 Medium
- bouncycastle bcpg-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreOpenPGP Argon2 S2K honours attacker-chosen memory and passes6.9 Medium
- bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 morePKCS#8 / PBES2 decryptors honour unbounded KDF cost from input5.3 Medium
- hashgraph guardianguardian atom exhaustion in Guardian.Permissions.encode_permissions!/16.9 Medium
- hashgraph guardianAtom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation6.9 Medium
- hashgraph guardianAtom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys6.9 Medium
- freerdpFreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response8.7 High
zaino-statecrates.iozaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit6.9 Medium- pterodactyl wingsWings: Maliciously or erroneously created parsed config files can cause wings process to OOM5.5 Medium
- google mcp-toolbox, mcp toolbox for databases +1 moreDenial of Service via Unrestricted Payload Buffering in MCP Toolbox6.6 Medium
- ibm datapower gateway, datapower gateway 10.5.0, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway affected by denial of service7.5 High
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/27.5 High
- ibm enterprise build of quarkusIBM Enterprise Build of Quarkus is affected by a DoS vulnerability7.5 High
- dfir-iris iris-webDFIR-IRIS Missing Brute Force Protection in User Authentication5.9 Medium
- dfir-iris iris-webDFIR-IRIS Missing Brute Force Protection in OTP Validation5.9 Medium
- olivetinOliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)7.5 High
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport7.5 High
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)6.2 Medium
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood5.3 Medium
- Show moreLoading…