CWE-770— Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.— MITRE CWE catalog
2,888 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-770page 30 of 58
- CVE-2023-35116HIGHCVSS 4.7EG 7.52023-06-14
jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, …
- CVE-2026-26477HIGHCVSS 4.3EG 7.52026-04-03
An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.php file
- CVE-2023-34396HIGHCVSS 4.3EG 7.52023-06-14
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
- CVE-2022-28871HIGHCVSS 4.3EG 7.52022-04-25
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the fsicapd component used in certain F-Secure products while scanning larger packages/fuzzed files consume too much memory eventually can crash the scanning…
- CVE-2017-20016HIGHCVSS 4.3EG 7.52022-03-28
A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown code of the component Portscan. The manipulation with an unknown input leads to denial of service.…
- CVE-2021-22174HIGHCVSS 3.7EG 7.52021-02-17
Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file
- CVE-2022-45471HIGHCVSS 3.5EG 7.52022-11-18
In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
- CVE-2015-5963HIGHCVSS v2 5.0EG 7.52015-08-24
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session re…
- CVE-2015-5143HIGHCVSS v2 7.8EG 7.52015-07-14
The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
- CVE-2015-2316HIGHCVSS v2 5.0EG 7.52015-03-25
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the len…
- CVE-2015-1881HIGHCVSS v2 4.0EG 7.52015-02-24
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images us…
- CVE-2015-0222HIGHCVSS v2 5.0EG 7.52015-01-16
ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of S…
- CVE-2012-5499HIGHCVSS v2 5.0EG 7.52014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.
- CVE-2026-25281HIGHCVSS 7.4EG 7.42026-09-17
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.
- CVE-2026-54429HIGHCVSS 7.4EG 7.42026-07-14
A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network traffic, which can exhaust available memory resources in the affected application. This…
- CVE-2026-44247HIGHCVSS 7.4EG 7.42026-05-27
Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoin…
- CVE-2025-68136HIGHCVSS 7.4EG 7.42026-01-21
EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Session`, `IConnection` which open new TCP socket for the ISO15118-20 communications …
- CVE-2025-68133HIGHCVSS 7.4EG 7.42026-01-21
EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to IS…
- CVE-2025-46569HIGHCVSS 7.4EG 7.42025-05-01
Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API enta…
- CVE-2025-20141HIGHCVSS 7.4EG 7.42025-03-12
A vulnerability in the handling of specific packets that are punted from a line card to a route processor in Cisco IOS XR Software Release 7.9.2 could allow an unauthenticated, adjacent attacker to cause control plane traffic to stop worki…
- CVE-2021-1285HIGHCVSS 7.4EG 7.42024-11-18
Multiple Cisco products are affected by a vulnerability in the Ethernet Frame Decoder of the Snort detection engine that could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerabilit…
- CVE-2023-20067HIGHCVSS 7.4EG 7.42023-03-23
A vulnerability in the HTTP-based client profiling feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. T…
- CVE-2021-0217HIGHCVSS 7.4EG 7.42021-01-15
A vulnerability in processing of certain DHCP packets from adjacent clients on EX Series and QFX Series switches running Juniper Networks Junos OS with DHCP local/relay server configured may lead to exhaustion of DMA memory causing a Denia…
- CVE-2020-8203HIGHCVSS 7.4EG 7.42020-07-15
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
- CVE-2018-15373HIGHCVSS 7.4EG 7.42018-10-05
A vulnerability in the implementation of Cisco Discovery Protocol functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust memory on an affected device, resulting in a denia…
- CVE-2026-92915HIGHCVSS 7.3EG 7.32026-09-17
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id d…
- CVE-2026-29168HIGHCVSS 7.3EG 7.32026-05-05
Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.…
- CVE-2023-38507HIGHCVSS 7.3EG 7.32023-09-15
Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized…
- CVE-2022-3423HIGHCVSS 7.3EG 7.32022-10-07
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.
- CVE-2026-41510HIGHCVSS 7.2EG 7.22026-10-06
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlen…
- CVE-2024-45484HIGHCVSS 7.2EG 7.22025-03-25
An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an unauthenticated adjacent attacker to per-form Denial-of-Service (DoS) attacks agai…
- CVE-2026-100302HIGHCVSS 7.1EG 7.12026-11-04
Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit …
- CVE-2026-77467HIGHCVSS 7.1EG 7.12026-10-15
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authentic…
- CVE-2026-61374HIGHCVSS 7.1EG 7.12026-10-02
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- CVE-2026-96609HIGHCVSS 7.1EG 7.12026-09-23
Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription comman…
- CVE-2026-94455HIGHCVSS 7.1EG 7.12026-09-22
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that…
- CVE-2026-77633HIGHCVSS 7.1EG 7.12026-09-22
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional …
- CVE-2026-68956HIGHCVSS 7.1EG 7.12026-09-22
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" cl…
- CVE-2026-49249HIGHCVSS 7.1EG 7.12026-09-02
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of t…
- CVE-2026-41644HIGHCVSS 7.1EG 7.12026-05-07
monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow integration allowed any authenticated user on a self-hosted instance to cause the …
- CVE-2026-35602HIGHCVSS 7.1EG 7.12026-04-10
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file c…
- CVE-2026-39959HIGHCVSS 7.1EG 7.12026-04-09
Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust…
- CVE-2021-26381HIGHCVSS 7.1EG 7.12026-02-10
Improper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a large number of pages, potentially resulting in kernel memory corruption.
- CVE-2025-48041HIGHCVSS 7.1EG 7.12025-09-11
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affec…
- CVE-2025-59045HIGHCVSS 7.1EG 7.12025-09-10
Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-servic…
- CVE-2025-22484HIGHCVSS 7.1EG 7.12025-06-06
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, o…
- CVE-2022-28655HIGHCVSS 7.1EG 7.12024-06-04
is_closing_session() allows users to create arbitrary tcp dbus connections
- CVE-2024-22255HIGHCVSS 7.1EG 7.12024-03-05
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the v…
- CVE-2026-75050HIGHCVSS 6.5EG 7.12026-08-17
In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
- CVE-2021-32036HIGHCVSS 5.4EG 7.12022-02-04
An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service an…
Map vulnerabilities like CWE-770 to your infrastructure
EchelonGraph correlates every CVE — across CWE-770 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →