CWE-770— Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.— MITRE CWE catalog

2,617 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-770page 5 of 53

CVE-2025-32777HIGHCVSS 8.2EG 8.2
2025-04-30
Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause deni…
CVE-2023-25568HIGHCVSS 8.2EG 8.2
2023-05-10
Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting eve…
CVE-2021-41840HIGHCVSS 8.2EG 8.2
2022-02-03
An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion o…
CVE-2019-6486HIGHCVSS 8.2EG 8.2
2019-01-24
Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.
CVE-2026-28299HIGHCVSS 7.5EG 8.2
2026-06-02
SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory.
CVE-2021-38463HIGHCVSS 7.3EG 8.1
2021-10-22
The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited memory buffers using API functions.
CVE-2024-27804HIGHCVSS 5.5EG 8.1
2024-05-14
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.3, watchOS 10.5. An app may be able to cause unexpected system termination.
CVE-2021-38465HIGHCVSS 8.0EG 8.0
2021-10-22
The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieved by generating large amounts of installations, which are then saved without limitation in the temp…
CVE-2023-46695HIGHCVSS 7.5EG 8.0
2023-11-02
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of ser…
CVE-2023-24998HIGHCVSS 7.5EG 8.0
2023-02-20
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file …
CVE-2023-23969HIGHCVSS 7.5EG 8.0
2023-02-01
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usag…
CVE-2008-5180HIGHCVSS 5.3EG 7.9
2008-11-20
Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests, which trigger the creation of many sessions.
CVE-2026-43329HIGHCVSS 7.8EG 7.8
2026-05-08
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload a…
CVE-2025-48615HIGHCVSS 7.8EG 7.8
2025-12-08
In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …
CVE-2024-49735HIGHCVSS 7.8EG 7.8
2025-01-21
In multiple locations, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed …
CVE-2021-47137HIGHCVSS 7.8EG 7.8
2024-03-25
In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corruption in RX ring In a situation where memory allocation or dma mapping fails, an invalid address is programmed into the descriptor. This can…
CVE-2023-21110HIGHCVSS 7.8EG 7.8
2023-05-15
In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …
CVE-2022-20492HIGHCVSS 7.8EG 7.8
2023-01-26
In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User inter…
CVE-2022-20490HIGHCVSS 7.8EG 7.8
2023-01-26
In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User i…
CVE-2022-20489HIGHCVSS 7.8EG 7.8
2023-01-26
In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User inter…
CVE-2022-20456HIGHCVSS 7.8EG 7.8
2023-01-26
In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User int…
CVE-2022-42531HIGHCVSS 7.8EG 7.8
2022-12-16
In mmu_map_for_fw of gs_ldfw_load.c, there is a possible mitigation bypass due to Permissive Memory Allocation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed…
CVE-2022-20487HIGHCVSS 7.8EG 7.8
2022-12-13
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. Us…
CVE-2022-20486HIGHCVSS 7.8EG 7.8
2022-12-13
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. Us…
CVE-2022-20485HIGHCVSS 7.8EG 7.8
2022-12-13
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. Us…
CVE-2022-20484HIGHCVSS 7.8EG 7.8
2022-12-13
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. Us…
CVE-2022-20480HIGHCVSS 7.8EG 7.8
2022-12-13
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. Us…
CVE-2022-20479HIGHCVSS 7.8EG 7.8
2022-12-13
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. Us…
CVE-2022-20478HIGHCVSS 7.8EG 7.8
2022-12-13
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. Us…
CVE-2022-37415HIGHCVSS 7.8EG 7.8
2022-08-05
The Uniwill SparkIO.sys driver 1.0 is vulnerable to a stack-based buffer overflow via IOCTL 0x40002008.
CVE-2022-27871HIGHCVSS 7.8EG 7.8
2022-06-21
Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated buffer while parsing PDF files. This vulnerability may be exploited to execute arb…
CVE-2021-44988HIGHCVSS 7.8EG 7.8
2022-01-25
Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c.
CVE-2021-29329HIGHCVSS 7.8EG 7.8
2021-11-19
OpenSource Moddable v10.5.0 was discovered to contain a stack overflow in the fxBinaryExpressionNodeDistribute function at /moddable/xs/sources/xsTree.c.
CVE-2021-29324HIGHCVSS 7.8EG 7.8
2021-11-19
OpenSource Moddable v10.5.0 was discovered to contain a stack overflow via the component /moddable/xs/sources/xsScript.c.
CVE-2021-34854HIGHCVSS 7.8EG 7.8
2021-10-25
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to…
CVE-2021-25173HIGHCVSS 7.8EG 7.8
2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which allows attackers to cause a crash, potentially enabling denia…
CVE-2021-1057HIGHCVSS 7.8EG 7.8
2021-01-08
NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to allocate some resources for which the guest is not authorized, which may lead to integrity and confidentiality loss, de…
CVE-2020-24658HIGHCVSS 7.8EG 7.8
2020-12-24
Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help spot stack-based buffer overflows in local arrays. When this feature is enabled, a protected function writes a guard value to the stack prior to (abo…
CVE-2019-9290HIGHCVSS 7.8EG 7.8
2019-09-27
In tzdata there is possible memory corruption due to a mismatch between allocation and deallocation functions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed …
CVE-2019-10094HIGHCVSS 7.8EG 7.8
2019-08-02
A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22…
CVE-2018-16865HIGHCVSS 7.8EG 7.8
2019-01-11
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-j…
CVE-2018-16864HIGHCVSS 7.8EG 7.8
2019-01-11
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw…
CVE-2017-8253HIGHCVSS 7.8EG 7.8
2017-08-18
In all Qualcomm products with Android releases from CAF using the Linux kernel, kernel memory can potentially be overwritten if an invalid master is sent from userspace.
CVE-2009-2054HIGHCVSS v2 7.8EG 7.8
2009-08-27
Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2a)su1, and 7.1 before 7.1(2a)su1 allows remote attackers to cause a denial of service (file-descriptor exhaus…
CVE-2009-2726HIGHCVSS v2 7.8EG 7.8
2009-08-12
The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Business Edition A.x.x, B.x.x before B.2.5.9, C.2.x before C.2.4.1, and C.3.x before C…
CVE-2026-61617HIGHCVSS 7.7EG 7.7
2026-08-26
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write acc…
CVE-2026-57212HIGHCVSS 7.7EG 7.7
2026-07-10
RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the a…
CVE-2026-23689HIGHCVSS 7.7EG 7.7
2026-02-10
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-…
CVE-2025-9177HIGHCVSS 7.7EG 7.7
2025-10-14
A denial-of-service security issue exists in the affected product and version. The security issue stems from a high number of requests sent to the web server. This could result in a web server crash however; this does not impact I/O contro…
CVE-2024-46933HIGHCVSS 7.7EG 7.7
2025-02-20
An issue was discovered in Atos Eviden BullSequana XH2140 BMC before C4EM-125: OMF_C4E 101.05.0014. Some BullSequana XH products were shipped without proper hardware programming, leading to a potential denial-of-service with privileged acc…

Map vulnerabilities like CWE-770 to your infrastructure

EchelonGraph correlates every CVE — across CWE-770 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →