CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- freerdpFreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length5.3 Medium
- eclipse foundation mnestixUnauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter7.5 High
- am system alo suiteVulnerability due to a lack of request limits in Alosuite’s password recovery functionality.6.9 Medium
- freerdpFreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST7.1 High
- eclipse foundation threadxNetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool8.7 High
- apache software foundation wicketApache Wicket: Configured upload limits are not enforced by the standalone file upload resource8.3 High
- wpgraphqlWPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations6.9 Medium
- unknown wpgraphql smart cache, wpgraphql smart cache +1 moreWPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS6.9 Medium
- No product listedBusiness::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature7.5 High
starletDebianStarlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies7.5 High- No product listedBitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.6.5 Medium
- No product listedBitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit7.5 High
- py-pdf pypdfpypdf: Possible large memory usage when parsing cross-reference streams7.1 High
- py-pdf pypdfpypdf: Possible long runtimes/large memory usage for encrypted PDF files7.1 High
twistedPyPITwisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset7.5 High- unclecode crawl4aiCrawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields8.7 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities6.5 Medium
- hughsk flatflat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys8.2 High
- bytecodealliance wasmtimeWasmtime before 36.0.20 Denial of Service via Borrowed Resource Transfer5.9 Medium
- ovenmedialabs ovenmediaengineOvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length8.7 High
libmime-tools-perlDebian,perl-MIME-toolsopenSUSE +1 moreMIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion7.5 Highlibhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 moreHTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies7.5 Highlibhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 moreHTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block7.5 Highlibhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 moreHTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts6.5 Medium- apache software foundation kafkaApache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing9.1 Critical
- apache software foundation kafkaApache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers9.1 Critical
- apache software foundation kafkaApache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service6.5 Medium
- mtrudel banditHTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit8.7 High
- progress telerik document processing librariesUncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering7.5 High
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...5.3 Medium
- libresslLibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response8.2 High
- eugeny russhpageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)2.3 Low
- eugeny russhrussh's SSH client is susceptible to unbounded allocations via EXT_INFO packets4.3 Medium
- eugeny russhrussh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages3.3 Low
- open-telemetry opentelemetry-pythonOpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation6.3 Medium
- tanium enforceTanium addressed an uncontrolled resource consumption vulnerability in Enforce.4.3 Medium
- tanium endpoint configuration toolset solution, performance-cx +1 moreTanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.5.5 Medium
- tanium enforceTanium addressed a denial of service vulnerability in Enforce.5.3 Medium
- tanium serverTanium addressed a denial of service vulnerability in Tanium Server.5.3 Medium
- knative pkgknative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion6.5 Medium
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 moreSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event8.7 High
- go-joseGo JOSE: DoS when parsing JWKs that contain RSA keys7.5 High
- lxsmnsyc serovalSeroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length7.5 High
- apple ipados, macos, visionos +2 more +4 moreA resource exhaustion issue was addressed with improved input validation. This issue is fixed in...7.5 High
- crossbario autobahn-pythonAutobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)5.9 Medium
- tornadoweb tornadoTornado: Quadratic CPU usage when parsing HTTP headers with line folding5.3 Medium
- tornadoweb tornadoTornado: Event loop blocking and excess memory use from chunked bodies with many small chunks5.3 Medium
- hashicorp consul, consul enterprise +1 moreConsul vulnerable to a denial of service in HTTP APIs7.5 High
- vllmvLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs6.5 Medium
- vllmvLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine6.5 Medium
- Show moreLoading…