CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation thriftApache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound8.2 High
- apache software foundation thriftApache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements8.7 High
- apache software foundation thriftApache Thrift: Python `TJSONProtocol` has a string length limit that is off by default8.2 High
- apache software foundation thriftApache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)8.2 High
- apache software foundation thriftApache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name8.7 High
- legion of the bouncy castle inc. bc-fja, bc-java, bc-lts-java +2 morePassword-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points5.3 Medium
- bouncycastle bc-csharpUnbounded PBE iteration count when decrypting PKCS#8 private keys7.1 High
- bouncycastle bc-csharpUnbounded MAC and bag-decryption iteration counts when loading PKCS#12 files7.1 High
- bouncycastle bc-csharpUnbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion8.7 High
- kvcache-ai mooncakeMooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue8.7 High
- apache software foundation apisixApache APISIX: Batch response aggregation can exhaust worker memory8.2 High
- tornadoweb tornadoTornado before 6.5.9 Denial of Service via Query String6.9 Medium
- py-pdf pypdfpypdf: Possible large memory usage when retrieving Roman page labels8.7 High
- openclaw windows nodeOpenClaw Windows Node before 2026.7.1 Denial of Service7.1 High
- corvusoft restbedrestbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering8.7 High
- corvusoft restbedrestbed through 5.0.0 Denial of Service via Unbounded Header Buffering8.7 High
- @angular router, angular +1 moreAngular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)8.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification...6.5 Medium
- vercel next.jsNext.js: Denial of Service in App Router using Server Actions8.2 High
- wordpress.org two factorWordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability5.3 Medium
- tijmen smit wp store locatorWordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability5.9 Medium
- codesys gateway, development system 3, edge gateway for linux +5 more +7 moreUncontrolled Memory Allocation in CODESYS Gateway Client8.7 High
- apache software foundation mina sshdApache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read6.5 Medium
- apache software foundation mina sshdApache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies7.5 High
- apache software foundation mina sshdApache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension6.5 Medium
- apache software foundation plc4xApache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser8.7 High
- pexip infinityPexip Infinity before 41.0 is affected by improper input validation in the signaling...8.6 High
- pexip infinityPexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web...8.6 High
- watchguard fireware, fireware os +1 moreFireware OS Resource Exhaustion in Login Process Allows Denial of Service8.7 High
- watchguard fireware, fireware os +1 moreFireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service7.1 High
- modeltc lightllmLightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value8.7 High
- eugeny russhRussh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey6.5 Medium
- eclipse foundation threadx netx duoUnbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall8.3 High
- python urllib3urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory8.9 High
- opensslQUIC STREAM Fragment Metadata DoS7.5 High
- mozilla firefox, thunderbird +1 moreDenial-of-service in the Networking component6.5 Medium
- opensslQUIC: Unbounded RETIRE_CONNECTION_ID Backlog7.5 High
- opensslQUIC Connection-Level Flow Control is Not Enforced for Streams5.3 Medium
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreExcessive Memory Allocation in Relative CRLDP Processing5.3 Medium
- mozilla firefox, thunderbird +1 moreDenial-of-service in the Storage: StorageManager component6.5 Medium
- mozilla firefox, thunderbird +1 moreDenial-of-service in the Graphics component6.5 Medium
- nestjs nestNest: Remote process termination via a deeply nested microservice message pattern7.5 High
- jpadilla pyjwtPyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)5.3 Medium
- beaugunderson ip-addressip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process6.3 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint3.7 Low
- f&f filipowski mh-developerDenial of Service in mH-DEVELOPER5.9 Medium
- elixir-mint mintMint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size6.3 Medium
- elixir-mint mintHPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory8.2 High
- nettyNetty before 4.2.18.Final QpackEncoder Unbounded Memory Retention8.7 High
- vllmvLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass6.3 Medium
- Show moreLoading…