CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- wp go maps (formerly wp google maps) go maps, wpgmaps wp go maps +1 moreWordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability5.3 Medium
- really simple plugins simple sslWordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability5.3 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- elastic elasticsearchAllocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service4.9 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service6.5 Medium
- erlang otpinets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception8.7 High
- @xmldom xmldomxmldom: Quadratic-memory consumption8.7 High
- erlang otphttpc memory exhaustion via unbounded response header accumulation8.2 High
- erlang otphttpd does not enforce the documented default max_clients connection limit8.7 High
- schneider electric ecostruxure™ modicon communication server, ecostruxure™ opc ua server expert +1 moreCWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could...8.2 High
- rockwell automation armorstart® ltRockwell Automation ArmorStart® LT Denial Of Service8.7 High
- ash-project ash typescriptUnbounded atom creation from client-supplied RPC field names in AshTypescript field formatter8.7 High
- ash-project ash typescriptUnbounded atom creation from typed struct field names in AshTypescript field selector8.2 High
- google androidIn initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent...5.5 Medium
- tornadoweb tornadoTornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop7.5 High
- apache wicketApache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed7.5 High
libhtml-formfu-perlDebian,perl-HTML-FormFuMageia +1 moreHTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements7.5 High- red hat build of apache camel for spring boot 4, enterprise linux 10, enterprise linux 8 +6 more +8 moreUndertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite7.5 High
- ash-project ash adminAshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)8.3 High
- ash-project ash graphqlQuery-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service8.7 High
- ljharb qsqs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)6.3 Medium
- ibm cloud pak for data systemVulnerabilities exists in IBM Cloud Pak for Data System6.2 Medium
- datadog dd-trace-rsdd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS7.5 High
- wpmu dev smush image compression and optimizationWordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability7.5 High
- ericsson codecheckerAuthenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun5.5 Medium
- eclipse foundation jettyA client may send a WebSocket frame with an unknown opcode and a very large declared payload...8.7 High
- No product listedAn issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows...7.5 High
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 9 +2 more +4 moreJwcrypto: jwcrypto: denial of service via malformed jwe tokens5.9 Medium
- spring cloud stream, vmware spring cloud stream +1 moreDynamic destination cache size is not properly bound in Spring Cloud Stream3.1 Low
- spring for graphql, vmware spring for graphql +1 moreSpring for GraphQL WebSocket Client Denial of Service5.9 Medium
- red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4, data grid 8 +13 more +15 moreUndertow-core: undertow: denial of service via websocket permessage-deflate processing7.5 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost8.7 High
- spring framework, vmware spring framework +1 moreSpring Framework maxInMemorySize Bypassed in Jaxb2Decoder9.8 Critical
- spring framework, vmware spring framework +1 moreSpring Framework maxPartSize Ignored in PartEventHttpMessageReader7.5 High
- No product listedAn issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers...7.5 High
- No product listedAn issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of...7.5 High
- No product listedAn issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial...7.5 High
- No product listedAn issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4...7.5 High
- No product listedAn issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of...7.5 High
- No product listedAn issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS...7.5 High
- No product listedAn issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing...7.5 High
- No product listedAn issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of...7.5 High
- No product listedAn issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a...7.5 High
- No product listedAn issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0...7.5 High
- No product listedAn issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of...7.5 High
- pivotal reactor nettyReactor Netty HTTP Server Denial of Service With Pipelined Requests5.3 Medium
- spring integration, vmware spring integration +1 moreUnbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS5.4 Medium
- pterodactyl wingsPterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion7.7 High
- Show moreLoading…