CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type...7.1 High
- quantumnous new-apiNew API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging7.5 High
libnet-oauth-perlDebian,perl-Net-OAuthMageia +1 moreNet::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require6.5 Medium- scribanScriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply8.7 High
- @fastify/multipart, fastify fastify-multipart +1 more@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload7.5 High
- apache strutsApache Struts: Unbounded growth of localized-text caches driven by the request locale7.5 High
- trendnet tew-816drmTRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources6.9 Medium
- filebrowserFileBrowser before 2.63.19 Disk Exhaustion via TUS Upload7.1 High
- spring for graphql, vmware spring for graphql +1 moreSpring for GraphQL Denial of Service via pagination support7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +7 more +9 moreLibdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser5.5 Medium
- go standard library crypto/tlsLimit handshake messages we are willing to accept post-handshake in crypto/tls7.5 High
- go standard library encoding/xmlAdd recursion depth guard during decode in encoding/xml7.5 High
- go standard library net/httpApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http7.5 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in DRDA / DDM5.3 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- elastic elasticsearchAllocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in Host Servers7.5 High
- rsyncproject rsyncrsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion8.7 High
- rsyncproject rsyncrsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall8.7 High
- opensslUnbounded Memory Growth in QUIC Server Incoming Channel Queue7.5 High
- nodejs undiciundici vulnerable to Denial of Service via unbounded decompression of compressed responses5.9 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos7.5 High
- ibm db2IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak3.3 Low
- canonical lxdStorage volume cross-project move and snapshot restore bypass project disk limits8.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab5.3 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in the Debug Server7.5 High
- fortinet fortios, siemens ruggedcom ape1808 +1 moreA allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0...5.0 Medium
- phoenix contact axc f 1152, axc f 1252, axc f 2000 ea +14 more +16 moreUnauthenticated Denial of Service8.7 High
- cisagov malcolmMalcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)7.1 High
- encode django-rest-frameworkDjango REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`5.3 Medium
- coturncoturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS8.2 High
- browserslistBrowserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreRemote Procedure Call Denial of Service Vulnerability7.5 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +5 more +7 moreUndertow-core: oom via missing limits in chunked trailer in eap's undertow7.5 High
- samsung rlottieImproper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or...6.5 Medium
- sap approuter, sap se business ai platform (approuter) +1 moreMultiple vulnerabilities in SAP Business AI Platform (Approuter)4.3 Medium
- sap approuter, sap se business ai platform (approuter) +1 moreMultiple vulnerabilities in SAP Business AI Platform (Approuter)5.9 Medium
- mastodonMastodon: Exhausting data by an unauthenticated request to the admin retention API7.5 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreMl-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener7.5 High
- tbea tlogger (tbea communication box 3rd generation)Unauthenticated Resource Exhaustion8.7 High
- keras-team keras-team/kerasDenial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras5.5 Medium
- hashicorp consul, consul enterprise +1 moreUnauthenticated denial of service via unbounded external gRPC connection acceptance7.5 High
- hashicorp consul, consul enterprise +1 moreUncontrolled resource consumption in the Consul Connect CA roots endpoint5.3 Medium
- hashicorp consul, consul enterprise +1 moreUncontrolled resource consumption in the Consul Connect authorization endpoint4.3 Medium
- atn-b1 cpdlcMalicious Link Control Frames Can Cause Loss of CPDLC Functions6.0 Medium
- Show moreLoading…