CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- rabbitmq amqp091-goamqp091-go: Pre-negotiation frame limit is not enforced to 4KB6.3 Medium
- darylldoyle svg-sanitizerenshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash6.5 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl6.5 Medium
- progressive robot ltd hmailserverAllocation of Resources Without Limits or Throttling in hMailServer4.3 Medium
- progressive robot ltd hmailserverAllocation of Resources Without Limits or Throttling in hMailServer5.3 Medium
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway Denial of Service7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- excelizeExcelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days7.5 High
- drupal examples for developersExamples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-2154.3 Medium
- cisco nx-os softwareCisco NX-OS Software Denial of Service Vulnerability5.8 Medium
- No product listedOpen5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources6.9 Medium
- imagemagickImageMagick: Denial of service in MVG decoder5.3 Medium
- imagemagickImageMagick: Denial of service in ASE decoder because of missing security checks5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreSssd: sssd-kcm: local denial of service via excessive memory preallocation5.5 Medium
- corazawaf corazaOWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding7.2 High
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreSssd: sssd: denial of service via incomplete identity provider authentication requests6.2 Medium
- yawkat lz4-javayawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs5.3 Medium
- elastic elasticsearchAllocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service6.5 Medium
- modelcontextprotocol typescript-sdkMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server7.5 High
- eset spol. s.r.o protect on-premDenial-of-service vulnerability in ESET PROTECT On-Prem6.9 Medium
- baseapp wpbase cacheWordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreSssd: sssd: denial of service via unbounded negative cache growth5.5 Medium
- vllmvLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach5.3 Medium
- docling, docling-project docling-slim +1 moreDocling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)4.3 Medium
- penpotPenpot: Repeated chunk index causes temporary-storage amplification5.3 Medium
- ash-project ashFiltering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash8.2 High
- apache strutsApache Struts: Unbounded request body read in the REST plugin6.5 Medium
- makeplane planePlane: Improper validation allows arbitrary modification of API token rate limits5.4 Medium
- laradashboardLaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints6.9 Medium
- legion of the bouncy castle inc. bc-java, bc-lts-java +1 moreLegacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider5.3 Medium
- lxsmnsyc serovalSeroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization7.5 High
- apache software foundation thriftApache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize6.9 Medium
- apache software foundation thriftApache Thrift: Java TSaslTransport post-auth data-frame missing size limit7.1 High
- apache software foundation thriftApache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count8.7 High
- apache software foundation thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)8.2 High
- apache software foundation thriftApache Thrift: Buffered transport reads are not accounted against MaxMessageSize6.9 Medium
- apache software foundation thriftApache Thrift: C++ THttpTransport grows its line buffer without bound9.2 Critical
- apache software foundation thriftApache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound8.2 High
- apache software foundation thriftApache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound8.2 High
- bytecodealliance wasmtimeWasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes5.9 Medium
- bytecodealliance wasmtimeWasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff5.1 Medium
- apache software foundation thriftApache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic8.2 High
- apache software foundation thriftApache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound8.2 High
- apache software foundation thriftApache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`6.3 Medium
- zcashfoundation zebraZebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages6.9 Medium
- apache software foundation thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes a…8.7 High
- apache software foundation thriftApache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)8.2 High
- apache software foundation thriftApache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation8.7 High
- apache software foundation thriftApache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound8.2 High
- apache software foundation thriftApache Thrift: PHP `TJSONProtocol` string/number readers have no size bound8.2 High
- Show moreLoading…