CWE-770— Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.— MITRE CWE catalog
2,635 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-770page 27 of 53
- CVE-2017-12430HIGHCVSS 7.5EG 7.52017-08-04
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service.
- CVE-2017-12429HIGHCVSS 7.5EG 7.52017-08-04
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service.
- CVE-2017-1227HIGHCVSS 7.5EG 7.52017-07-31
IBM Tivoli Endpoint Manager could allow a unauthorized user to consume all resources and crash the system. IBM X-Force ID: 123906.
- CVE-2017-11468HIGHCVSS 7.5EG 7.52017-07-20
Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.
- CVE-2017-9350HIGHCVSS 7.5EG 7.52017-06-02
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by checking for a negative length.
- CVE-2017-6653HIGHCVSS 7.5EG 7.52017-05-22
A vulnerability in the TCP throttling process for the GUI of the Cisco Identity Services Engine (ISE) 2.1(0.474) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device where the I…
- CVE-2017-6641HIGHCVSS 7.5EG 7.52017-05-22
A vulnerability in the TCP connection handling functionality of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to disable TCP ports and cause a denial of service (DoS) condition on an affected s…
- CVE-2017-3555HIGHCVSS 7.5EG 7.52017-04-24
Vulnerability in the Oracle iReceivables component of Oracle E-Business Suite (subcomponent: Self Registration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulne…
- CVE-2017-7963HIGHCVSS 7.5EG 7.52017-04-19
The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, st…
- CVE-2017-5850HIGHCVSS 7.5EG 7.52017-03-27
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header.
- CVE-2017-5835HIGHCVSS 7.5EG 7.52017-03-03
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.
- CVE-2016-4074HIGHCVSS 7.5EG 7.52016-05-06
The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.
- CVE-2026-20406HIGHCVSS 6.5EG 7.52026-02-02
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.…
- CVE-2025-48631HIGHCVSS 6.5EG 7.52025-12-08
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not…
- CVE-2022-42311HIGHCVSS 6.5EG 7.52022-11-01
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amo…
- CVE-2022-1510HIGHCVSS 6.5EG 7.52022-05-11
An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious tex…
- CVE-2023-45862HIGHCVSS 5.5EG 7.52023-10-14
An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.
- CVE-2024-1666HIGHCVSS 5.3EG 7.52024-04-16
In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process…
- CVE-2022-34439HIGHCVSS 5.3EG 7.52022-10-21
Dell PowerScale OneFS, versions 8.2.0.x-9.4.0.x contain allocation of Resources Without Limits or Throttling vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service and pe…
- CVE-2021-21000HIGHCVSS 5.3EG 7.52021-05-24
On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime.
- CVE-2018-15458HIGHCVSS 5.3EG 7.52019-01-10
A vulnerability in the Shell Access Filter feature of Cisco Firepower Management Center (FMC), when used in conjunction with remote authentication, could allow an unauthenticated, remote attacker to cause high disk utilization, resulting i…
- CVE-2023-35116HIGHCVSS 4.7EG 7.52023-06-14
jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, …
- CVE-2026-26477HIGHCVSS 4.3EG 7.52026-04-03
An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.php file
- CVE-2022-28871HIGHCVSS 4.3EG 7.52022-04-25
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the fsicapd component used in certain F-Secure products while scanning larger packages/fuzzed files consume too much memory eventually can crash the scanning…
- CVE-2017-20016HIGHCVSS 4.3EG 7.52022-03-28
A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown code of the component Portscan. The manipulation with an unknown input leads to denial of service.…
- CVE-2021-22174HIGHCVSS 3.7EG 7.52021-02-17
Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file
- CVE-2022-45471HIGHCVSS 3.5EG 7.52022-11-18
In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
- CVE-2026-25281HIGHCVSS 7.4EG 7.42026-09-17
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.
- CVE-2026-54429HIGHCVSS 7.4EG 7.42026-07-14
A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network traffic, which can exhaust available memory resources in the affected application. This…
- CVE-2026-44247HIGHCVSS 7.4EG 7.42026-05-27
Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoin…
- CVE-2025-68136HIGHCVSS 7.4EG 7.42026-01-21
EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Session`, `IConnection` which open new TCP socket for the ISO15118-20 communications …
- CVE-2025-68133HIGHCVSS 7.4EG 7.42026-01-21
EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to IS…
- CVE-2025-20141HIGHCVSS 7.4EG 7.42025-03-12
A vulnerability in the handling of specific packets that are punted from a line card to a route processor in Cisco IOS XR Software Release 7.9.2 could allow an unauthenticated, adjacent attacker to cause control plane traffic to stop worki…
- CVE-2021-1285HIGHCVSS 7.4EG 7.42024-11-18
Multiple Cisco products are affected by a vulnerability in the Ethernet Frame Decoder of the Snort detection engine that could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerabilit…
- CVE-2023-20067HIGHCVSS 7.4EG 7.42023-03-23
A vulnerability in the HTTP-based client profiling feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. T…
- CVE-2021-0217HIGHCVSS 7.4EG 7.42021-01-15
A vulnerability in processing of certain DHCP packets from adjacent clients on EX Series and QFX Series switches running Juniper Networks Junos OS with DHCP local/relay server configured may lead to exhaustion of DMA memory causing a Denia…
- CVE-2020-8203HIGHCVSS 7.4EG 7.42020-07-15
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
- CVE-2018-15373HIGHCVSS 7.4EG 7.42018-10-05
A vulnerability in the implementation of Cisco Discovery Protocol functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust memory on an affected device, resulting in a denia…
- CVE-2026-92915HIGHCVSS 7.3EG 7.32026-09-17
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id d…
- CVE-2026-29168HIGHCVSS 7.3EG 7.32026-05-05
Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.…
- CVE-2023-38507HIGHCVSS 7.3EG 7.32023-09-15
Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized…
- CVE-2022-3423HIGHCVSS 7.3EG 7.32022-10-07
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.
- CVE-2026-41510HIGHCVSS 7.2EG 7.22026-10-06
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlen…
- CVE-2024-45484HIGHCVSS 7.2EG 7.22025-03-25
An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an unauthenticated adjacent attacker to per-form Denial-of-Service (DoS) attacks agai…
- CVE-2026-61374HIGHCVSS 7.1EG 7.12026-10-02
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- CVE-2026-63578HIGHCVSS 7.1EG 7.12026-10-02
Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, …
- CVE-2026-63572HIGHCVSS 7.1EG 7.12026-10-02
Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file to cause a denial of service through CP…
- CVE-2026-67235HIGHCVSS 7.1EG 7.12026-09-23
RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was stored without validation against max_message_size. The size check ran only when assembly…
- CVE-2026-96609HIGHCVSS 7.1EG 7.12026-09-23
Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription comman…
- CVE-2026-94455HIGHCVSS 7.1EG 7.12026-09-22
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that…
Map vulnerabilities like CWE-770 to your infrastructure
EchelonGraph correlates every CVE — across CWE-770 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →