CWE-770— Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.— MITRE CWE catalog

2,893 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-770page 47 of 58

CVE-2023-33656MEDIUMCVSS 5.5EG 5.5
2023-05-30
A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack by causing the program to consume all available memor…
CVE-2023-29737MEDIUMCVSS 5.5EG 5.5
2023-05-30
An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database files.
CVE-2023-20930MEDIUMCVSS 5.5EG 5.5
2023-05-15
In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interact…
CVE-2023-31914MEDIUMCVSS 5.5EG 5.5
2023-05-12
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc.
CVE-2023-30408MEDIUMCVSS 5.5EG 5.5
2023-04-24
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.
CVE-2023-30406MEDIUMCVSS 5.5EG 5.5
2023-04-24
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c.
CVE-2023-29570MEDIUMCVSS 5.5EG 5.5
2023-04-24
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).
CVE-2023-29575MEDIUMCVSS 5.5EG 5.5
2023-04-21
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.
CVE-2023-29573MEDIUMCVSS 5.5EG 5.5
2023-04-13
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.
CVE-2022-41727MEDIUMCVSS 5.5EG 5.5
2023-02-28
An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.
CVE-2023-24785MEDIUMCVSS 5.5EG 5.5
2023-02-17
An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea UNPEA feature.
CVE-2022-20494MEDIUMCVSS 5.5EG 5.5
2023-01-26
In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for expl…
CVE-2022-40885MEDIUMCVSS 5.5EG 5.5
2022-10-19
Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service.
CVE-2022-22240MEDIUMCVSS 5.5EG 5.5
2022-10-18
An Allocation of Resources Without Limits or Throttling and a Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenti…
CVE-2022-34308MEDIUMCVSS 5.5EG 5.5
2022-10-07
IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437.
CVE-2022-41846MEDIUMCVSS 5.5EG 5.5
2022-09-30
An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp.
CVE-2022-41845MEDIUMCVSS 5.5EG 5.5
2022-09-30
An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h.
CVE-2022-35089MEDIUMCVSS 5.5EG 5.5
2022-09-21
SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop/swftools/src/gif2swf.
CVE-2020-35534MEDIUMCVSS 5.5EG 5.5
2022-09-01
In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
CVE-2022-1325MEDIUMCVSS 5.5EG 5.5
2022-08-31
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading …
CVE-2022-0480MEDIUMCVSS 5.5EG 5.5
2022-08-29
A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.
CVE-2021-3669MEDIUMCVSS 5.5EG 5.5
2022-08-26
A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.
CVE-2021-3759MEDIUMCVSS 5.5EG 5.5
2022-08-23
A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resour…
CVE-2022-36155MEDIUMCVSS 5.5EG 5.5
2022-08-16
tifig v0.2.2 was discovered to contain a resource allocation issue via operator new(unsigned long) at asan_new_delete.cpp.
CVE-2022-36150MEDIUMCVSS 5.5EG 5.5
2022-08-16
tifig v0.2.2 was discovered to contain a heap-buffer overflow via __asan_memmove at /asan/asan_interceptors_memintrinsics.cpp.
CVE-2022-36146MEDIUMCVSS 5.5EG 5.5
2022-08-16
SWFMill commit 53d7690 was discovered to contain a memory allocation issue via operator new[](unsigned long) at asan_new_delete.cpp.
CVE-2022-35113MEDIUMCVSS 5.5EG 5.5
2022-08-16
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via swf_DefineLosslessBitsTagToImage at /modules/swfbits.c.
CVE-2022-35111MEDIUMCVSS 5.5EG 5.5
2022-08-16
SWFTools commit 772e55a2 was discovered to contain a stack overflow via __sanitizer::StackDepotNode::hash(__sanitizer::StackTrace const&) at /sanitizer_common/sanitizer_stackdepot.cpp.
CVE-2022-35109MEDIUMCVSS 5.5EG 5.5
2022-08-16
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via draw_stroke at /gfxpoly/stroke.c.
CVE-2022-35107MEDIUMCVSS 5.5EG 5.5
2022-08-16
SWFTools commit 772e55a2 was discovered to contain a stack overflow via vfprintf at /stdio-common/vfprintf.c.
CVE-2022-35105MEDIUMCVSS 5.5EG 5.5
2022-08-16
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via /bin/png2swf+0x552cea.
CVE-2022-35104MEDIUMCVSS 5.5EG 5.5
2022-08-16
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via DCTStream::reset() at /xpdf/Stream.cc.
CVE-2022-35219MEDIUMCVSS 5.5EG 5.5
2022-08-02
The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet key parameter. A LAN attacker with general user privilege can exploit this vulnerability to disrupt se…
CVE-2022-35218MEDIUMCVSS 5.5EG 5.5
2022-08-02
The NHI card’s web service component has a heap-based buffer overflow vulnerability due to insufficient validation for packet origin parameter length. A LAN attacker with general user privilege can exploit this vulnerability to disrupt s…
CVE-2021-40609MEDIUMCVSS 5.5EG 5.5
2022-06-28
The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
CVE-2021-40607MEDIUMCVSS 5.5EG 5.5
2022-06-28
The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
CVE-2022-20143MEDIUMCVSS 5.5EG 5.5
2022-06-15
In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for …
CVE-2022-31287MEDIUMCVSS 5.5EG 5.5
2022-06-10
An issue was discovered in Bento4 v1.2. There is an allocation size request error in /Ap4RtpAtom.cpp.
CVE-2022-31285MEDIUMCVSS 5.5EG 5.5
2022-06-10
An issue was discovered in Bento4 1.2. The allocator is out of memory in /Source/C++/Core/Ap4Array.h.
CVE-2022-25169MEDIUMCVSS 5.5EG 5.5
2022-05-16
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
CVE-2022-30775MEDIUMCVSS 5.5EG 5.5
2022-05-16
xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKE_CXX_COMPILER=afl-clang-fast+…
CVE-2021-39670MEDIUMCVSS 5.5EG 5.5
2022-05-10
In setStream of WallpaperManager.java, there is a possible way to cause a permanent DoS due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for …
CVE-2022-20717MEDIUMCVSS 5.5EG 5.5
2022-04-15
A vulnerability in the NETCONF process of Cisco SD-WAN vEdge Routers could allow an authenticated, local attacker to cause an affected device to run out of memory, resulting in a denial of service (DoS) condition. This vulnerability is due…
CVE-2022-26336MEDIUMCVSS 5.5EG 5.5
2022-03-04
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-…
CVE-2022-24614MEDIUMCVSS 5.5EG 5.5
2022-02-24
When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of se…
CVE-2021-46050MEDIUMCVSS 5.5EG 5.5
2022-01-10
A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.
CVE-2021-1121MEDIUMCVSS 5.5EG 5.5
2021-10-29
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel driver, where a vGPU can cause resource starvation among other vGPUs hosted on the same GPU, which may lead to denial of service.
CVE-2021-22461MEDIUMCVSS 5.5EG 5.5
2021-10-28
A component of the HarmonyOS has a Allocation of Resources Without Limits or Throttling vulnerability. Local attackers may exploit this vulnerability to cause nearby process crash.
CVE-2021-0424MEDIUMCVSS 5.5EG 5.5
2021-09-27
In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch …
CVE-2021-0422MEDIUMCVSS 5.5EG 5.5
2021-09-27
In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch …

Map vulnerabilities like CWE-770 to your infrastructure

EchelonGraph correlates every CVE — across CWE-770 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →