CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- vllmvLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool6.5 Medium
- apache software foundation vysperApache Vysper: Unbounded allocation7.5 High
- benoitc hackneyUnbounded response body buffering and decompression in hackney8.2 High
- mtrudel banditClient-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit8.7 High
- mtrudel banditHTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit8.7 High
- mtrudel banditWebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit8.7 High
- mtrudel banditHTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit8.7 High
- mtrudel banditHTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit8.7 High
- nocodbNocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources6.3 Medium
starmanDebian,perl-StarmanopenSUSE +1 moreStarman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies7.5 HighstarmanDebian,perl-StarmanopenSUSE +1 moreStarman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers7.5 High- vllmvLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override8.7 High
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders4.8 Medium
- labstack echoEcho: BodyDump captures request and response bodies without size limits in v48.2 High
- twistedTwisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer7.5 High
- twistedTwisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer7.5 High
- twistedTwisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree8.7 High
- part-db part-db-serverPart-DB: Attachment Size Limit Bypass via API Base64 Upload5.3 Medium
- part-db part-db-serverPart-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads5.3 Medium
- nationalsecurityagency ghidraGhidra before 12.2 Denial of Service via TAR and ZIP File System Mount6.8 Medium
- nationalsecurityagency ghidraGhidra before 12.2 Denial of Service via Extension Archive Install6.8 Medium
- nationalsecurityagency ghidraGhidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()6.8 Medium
- mongodb c# driverMemory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization8.2 High
- py-pdf fpdf2fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'6.5 Medium
- graphql-python graphql-coreGraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit7.5 High
- knime business hubLarge tables in data apps can bring down execution services in KNIME Hub5.3 Medium
- litespeedtech lsquicIn lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because...7.5 High
- arekinath esamlUnbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion8.2 High
- arekinath esamlUnbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion8.7 High
- bulwarkmail webmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource...5.3 Medium
- bulwarkmail webmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to...3.7 Low
- splunk, splunk enterprise +1 moreDenial of Service (DoS) through the REST API in Splunk Enterprise6.5 Medium
- No product listedAlgorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search7.5 High
- python pillowPillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode6.5 Medium
- binarymuse toml-nodetoml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()7.5 High
- encode django-rest-frameworkDjango REST framework: JSONParser applies an attacker-named codec to the request stream7.5 High
- py-pdf pypdfpypdf: Possible large memory usage for streams with multiple filters6.0 Medium
- py-pdf pypdfpypdf: Possible large memory usage when parsing content streams6.0 Medium
- py-pdf pypdfpypdf: Possible large memory usage when parsing arrays and dictionaries6.0 Medium
- pydantic pydantic-ai-harnessPydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code6.3 Medium
- apache software foundation brpcApache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly7.5 High
- apache software foundation brpcApache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes7.5 High
- apache software foundation brpcApache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count7.5 High
- apache software foundation brpcApache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation7.5 High
- apache software foundation brpcApache bRPC: Remote Memory Exhaustion in RTMP AMF Parser7.5 High
- nlnet labs unboundAggregate DNS name chained pointer decompression work leads to degradation of service.5.3 Medium
- vllmvLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs8.7 High
- No product listedCrypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key7.5 High
- moov-io signedxmlMoov signedxml: Unauthenticated denial of service in exclusive XML canonicalization7.5 High
- python pillowPillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit6.3 Medium
- Show moreLoading…