CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- openclaw clawhubClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API6.9 Medium
- linux, linux kernel +1 moresmb/client: validate new EOF for zero range5.5 Medium
- linux, linux kernel +1 moreksmbd: rate limit unmapped SID errors5.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder7.5 High
- containerdContainerd has image-pull DoS via crafted OCI index graph amplification6.9 Medium
- docmostDocmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service6.5 Medium
- wazuhWazuh Manager cluster header parsing allows pre-authentication memory exhaustion7.5 High
- goauthentik authentikauthentik: Denial of Service via Document Type Declarations in SAML Messages7.5 High
- bytecodealliance wasmtimeWasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API1.0 Low
- kvcache-ai mooncakekvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources5.3 Medium
hiredisDebianhiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in...7.5 HighlibfyamlDebianlibfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When...6.5 Medium- fasterxml jackson-dataformats-binaryjackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service7.5 High
- fasterxml jackson-dataformats-binaryjackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service7.5 High
- klever-io klever-goKlever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)7.5 High
- typelevel jawnJawn: Uncontrolled nesting depth in JSON parser7.5 High
- drupal combined image styleCombined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-1885.3 Medium
- drupal webformWebform - Less critical - Denial of service - SA-CONTRIB-2026-1707.5 High
- moquetteMoquette fails open when configured authentication or authorization classes cannot load9.3 Critical
- moquetteMoquette client IDs can cause cross-session H2 durable-queue corruption8.8 High
- moquetteMoquette publishes Last-Will messages without enforcing write authorization8.7 High
- moquetteMoquette unbounded per-session message queues allow memory exhaustion8.7 High
- moquetteMoquette deeply nested MQTT topics can cause stack exhaustion8.7 High
- moquetteMoquette malformed shared subscriptions can crash command processing8.7 High
- moquetteMoquette uncaught MQTT command exceptions can terminate shared session event loops8.7 High
- moquetteMoquette pattern ACL wildcard injection allows cross-tenant authorization bypass9.6 Critical
- fasterxml jackson-corejackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth7.5 High
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities6.5 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software5.3 Medium
- arubanetworks analytics and location engine, hewlett packard enterprise (hpe) ale +1 moreUnauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)5.3 Medium
- gitroomhq postiz-appUnauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key7.1 High
- cloudreveCloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service7.1 High
- radare radare2radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser5.5 Medium
- radare radare2radare2: Uncontrolled memory allocation in radare2 dmp64 parser5.5 Medium
- mattermost, mattermost server +1 moreUnbounded post ID array in the bulk reactions endpoint allows denial of service4.3 Medium
- apache software foundation tomcatApache Tomcat: AJP DoS via missing request body7.5 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size7.1 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Web-STOMP unbounded pre-auth accumulation6.3 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Stream-protocol frame length never validated against frame_max6.3 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Consistent-hash exchange unbounded weight6.0 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Super-stream partitions unbounded allocation5.9 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS8.2 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Stream protocol skips per vhost per user connection limits6.0 Medium
- erlang otpSSH daemon allocates unbounded idle session channels, bypassing max_channels7.1 High
- vllmvLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions8.7 High
- kap-sh zaprosZapros has an Unbounded Content-Encoding decompression chain that allows denial of service6.9 Medium
- kap-sh zaprosZapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)8.7 High
- thinkst opencanaryDenial-of-Service in the OpenCanary Redis service3.7 Low
- lucasdillmann nginx-ignitionnginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware7.5 High
- thinkst applied research canaryDenial-of-Service in the Thinkst Canary Redis service3.7 Low
- Show moreLoading…