CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- rabbitmq amqp091-goamqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload8.9 High
- oracle corporation java seVulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle...6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- rustdeskRustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec8.7 High
stomperUbuntustomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP...7.5 High- govcert-lu eml parsereml_parser: DoS via deeply nested parens in Received headers7.5 High
- govcert-lu eml parsereml_parser: Parser DoS via deeply nested parentheses in e-mail headers5.3 Medium
- mervinpraison praisonaiPraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)6.5 Medium
- opensslQUIC ACK-only Packet Retention Can Cause Memory Exhaustion7.5 High
- opensslCMP Indefinite Cache Growth of ExtraCerts5.9 Medium
- cakephp authenticationCakePHP: Potential Authentication bypass with CookieAuthenticator9.1 Critical
- dji air 3, air 3s, avata 2 +13 more +15 moreDJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion6.0 Medium
- bluewave-labs checkmateCheckmate: Pre-auth Denial of Service via File Upload on Registration7.5 High
- spring ai, vmware spring ai +1 moreUnbounded persistent session allocation via repeated initialize requests7.5 High
- ruby resolvAn issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class,...7.5 High
- spring micrometer tracingMicrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability5.3 Medium
- nationalsecurityagency ghidraGhidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb6.7 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.5 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.5 High
- apple containerAn attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend…7.5 High
- axllent mailpitMailpit: SMTP DATA line reader buffers over-limit input before size enforcement5.3 Medium
- mtrudel banditHTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit8.7 High
- axllent mailpitMailpit: Thumbnail generation decodes unbounded image dimensions before scaling5.3 Medium
- apple swift-nio, swiftnio +1 moreAn unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active con…5.3 Medium
io.netty.incubator:netty-incubator-codec-bhttpMavennetty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields8.7 High- node-opcuanode-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS7.5 High
kcl-libcrates.io,zoo-kclPyPI +1 moreZoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service6.9 Medium- libeventLibevent: Unbounded memory accumulation in WebSocket server via fragmented frames7.5 High
- jhy soupjsoup Uncontrolled Resource Consumption in XmlTreeBuilder8.7 High
- bytecodealliance wasmtimeWasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams6.9 Medium
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreIpa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read7.5 High
- freeipa, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreIpa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding4.3 Medium
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreIpa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read7.5 High
- ibm reliable scalable cluster technology (rsct), reliable scalable cluster technology +1 moreReliable Scalable Cluster Technology Denial-of-Service6.5 Medium
- modelcontextprotocol php-sdkMCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service6.9 Medium
- inspektor-gadgetInspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS6.9 Medium
- zenhive mpp, machine payments protocol +1 moreTempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain8.3 High
- cisco industrial ethernet switchesCisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability5.3 Medium
- wazuhWazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation4.9 Medium
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.38.7 High
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...4.4 Medium
- nvidia triton inference serverNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause...7.5 High
- wazuh, wazuh wazuh-manager +1 moreWazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context7.1 High
- nexcess starter templates by kadence wpWordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability7.5 High
- arcadedata arcadedbArcadeDB before 26.8.1 Denial of Service via range()5.3 Medium
- plutext docx4j, org.docx4j docx4j-core +1 moredocx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service7.5 High
- dep0we atomic-agents-stackatomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model7.1 High
- vllmvLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds4.3 Medium
- patriksimek vm2vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass8.7 High
- patriksimek vm2vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike8.7 High
- Show moreLoading…