CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- temporal technologies, inc. temporalio/ringpop-gotemporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip8.7 High
- apache neethiApache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service7.5 High
- apache neethiApache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service7.5 High
- apache neethiApache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion7.5 High
- crossbario autobahn-pythonAutobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation5.3 Medium
- sgl-project sglangSGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx8.2 High
- agronholm anyioAnyIO process-pool workers can block indefinitely on undrained stderr6.8 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +2 more +4 moreCockpit: cockpit: denial of service via unbounded connection thread spawning7.5 High
- sgl-project sglangSGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room8.7 High
- red hat cryostat 4, build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +14 more +16 moreOrg.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload5.9 Medium
- red hat amq broker 7, amq clients, build of apache camel 3.33.3.sp2 +15 more +17 moreIo.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue7.5 High
- red hat amq broker 7, amq clients, build of apache camel 3.33.3.sp2 +15 more +17 moreIo.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams7.5 High
- red hat build of apache camel for spring boot 4, fuse 7, jboss enterprise application platform 7 +1 more +3 moreIo.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits7.5 High
- o-ran-sc smo oamO-RAN-SC SMO OAM VES Collector allocation of resources6.9 Medium
- o-ran-sc smo oamO-RAN-SC SMO OAM VES Collector allocation of resources5.3 Medium
- o-ran-sc smo oamO-RAN-SC SMO OAM VES Collector allocation of resources5.3 Medium
- caddyserver caddyCaddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation6.3 Medium
- caddyserver caddyCaddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS6.9 Medium
- caddyserver caddyCaddy: rewrite placeholder re-expansion6.5 Medium
- datadog dd-trace-cppdd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS7.5 High
- datadog dd-trace-phpDatadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS7.5 High
- valhallaValhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets7.5 High
- @libp2p floodsub, libp2p js-libp2p +1 morelibp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS7.5 High
- red hat exploit intelligence, build of quarkus 3.27.5.sp2, build of quarkus 3.33.3.sp2 +1 more +3 moreQuarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering7.5 High
- wwbn avideoWWBN AVideo userVerifyEmail.php Unauthenticated Access Control6.9 Medium
- qualcomm cologne firmware, fastconnect 7800 firmware, snapdragon x2 elite firmware +5 more +7 moreAllocation of Resources Without Limits or Throttling in OOBM7.4 High
- corednsCoreDNS: Unauthenticated memory exhaustion in custom transports7.5 High
- rabbitmq rabbitmq-java-clientRabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement8.7 High
- vllmvLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation6.5 Medium
- vllmvLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions6.5 Medium
- rabbitmq amqp091-goRabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking8.2 High
- rabbitmq amqp091-goRabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation8.9 High
- nlnet labs unboundRetrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC5.3 Medium
- nlnet labs unboundPossible degradation of service from continuous queries on the same TCP/DoT connection5.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- cthackers adm-zipadm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size8.7 High
- http4sHttp4s Ember HTTP/2: unbounded inbound body buffering7.5 High
- http4sHttp4s Ember HTTP/2: unbounded continuation frame accumulation7.5 High
- http4sHttp4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS7.5 High
- http4sHttp4s Ember HTTP/2: unbounded outbound frame queue7.5 High
- http4sHttp4s: WebSocket decoder accepts unbounded message sizes7.5 High
- go-vikunja vikunjaVikunja before 2.6.0 Denial of Service via Decompression Bomb7.1 High
- go-vikunja vikunjaVikunja before 2.6.0 Resource Exhaustion via Planka Migration7.1 High
- mozilla firefox, thunderbird +1 moreDenial-of-service in the Security component6.5 Medium
- mozilla firefox, thunderbird +1 moreDenial-of-service in the SVG component6.5 Medium
- mozilla firefox, thunderbird +1 moreDenial-of-service in the Audio/Video component6.5 Medium
- mispMISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion6.9 Medium
- apple ipados, visionos, ios and ipados +1 more +3 moreThis issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and...5.5 Medium
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access7.5 High
- Show moreLoading…