CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- rabbitmq rabbitmq-serverRabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation6.0 Medium
- red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 moreDpdk: dpdk: missing memory size validation before mmap in vhost memory region setup6.5 Medium
- giteaGitea Maven checksum upload quota bypass and memory exhaustion4.3 Medium
- micropyramid bottlecrmBottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import5.3 Medium
- ow2 asmOW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer6.8 Medium
- ow2 asmOW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter4.8 Medium
- rustlsrustls before 0.23.46 Denial of Service via Brotli Certificate Decompression6.3 Medium
- bytecodealliance wasmtimeWasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles6.9 Medium
- microsoft sql server 2019 (gdr), sql server 2019 for x64-based systems (cu32) +1 moreMicrosoft SQL Server Denial of Service Vulnerability5.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreRPC Endpoint Mapper Service Denial of Service Vulnerability5.9 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreActive Directory Federation Services (AD FS) Denial of Service Vulnerability7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Netlogon Denial of Service Vulnerability6.5 Medium
- microsoft windows server 2012 r2, windows server 2012 r2 (server core installation), windows server 2016 +7 more +9 moreActive Directory Federation Services (AD FS) Denial of Service Vulnerability7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreActive Directory Federation Services (AD FS) Denial of Service Vulnerability7.5 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreMicrosoft OpenSSH for Windows Denial of Service Vulnerability7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows SMB Server Denial of Service Vulnerability7.5 High
- misskey-dev misskeyMisskey: Lack of rate limiting and size restrictions in RSS fetching API8.7 High
- esa sleapi-jSLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service5.3 Medium
- grafana enterprise, oss +1 moreUnbounded memory allocation in the Prometheus rule conversion API6.5 Medium
- rockwell automation 1732e armorblock® i/o1732E ArmorBlock® - Multiple Vulnerabilities8.7 High
- freerdpFreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read7.1 High
- microsoft .net, .net framework, .net framework 3.5 +8 more +10 more.NET Denial of Service Vulnerability7.5 High
- microsoft asp.net core 10.0, asp.net core 11.0, asp.net core 8.0 +3 more +5 moreASP.NET Core Denial of Service Vulnerability7.5 High
- microsoft asp.net core 10.0, asp.net core 8.0, asp.net core 9.0 +2 more +4 moreASP.NET Core Denial of Service Vulnerability7.5 High
- microsoft visual studio 2022 version 17.14, visual studio 2026 version 18.10, microsoft.aspnetcore.signalr.common +1 more +3 moreASP.NET Core Denial of Service Vulnerability7.5 High
- ibm db2IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions6.5 Medium
- gitoxidelabs gix-packGitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count7.1 High
- surrealdb, surrealdb surrealism-runtime +1 moreSurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering6.9 Medium
- siyuan-note siyuanSiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template7.1 High
- open-webuiOpen WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex7.1 High
- hexpm hexHex exhausts memory and disk on oversized or compressed responses from an untrusted mirror2.1 Low
- sgl-project sglangSGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters8.7 High
- sgl-project sglangSGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing8.7 High
- sgl-project sglangSGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload8.7 High
- logicaldoc community editionLogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet8.7 High
- zhayujie cowagentzhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources5.3 Medium
- mark3labs mcp-gomcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering8.7 High
- hatchet-dev hatchetHatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint6.9 Medium
- modelcontextprotocol kotlin-sdkMCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket8.7 High
- grafana enterprise, oss, nanogit +2 moreGit Sync memory exhaustion via a malicious Git server5.3 Medium
- getkin kin-openapikin-openapi deepObject query decoding repeatedly compiles an invariant regular expression5.3 Medium
- contaoContao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check5.3 Medium
- google guavaDenial of Service via Eager Array Allocation During Deserialization in Guava8.2 High
- xerial snappy-javaXerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service8.7 High
- apache cxfApache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.7.5 High
- mongodb ops managerOps Manager Uncontrolled Resource Consumption in Monitoring Endpoints6.9 Medium
- openprinting cupsOpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission...3.3 Low
- go standard library mime/multipart, net/textproto +1 moreMemory limit bypass when parsing MIME headers in net/textproto, mime/multipart7.5 High
- go standard library net/httpLack of limit on size of parsed Range headers in net/http7.5 High
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access6.5 Medium
- Show moreLoading…