CWE-770 · Allocation of Resources Without Limits or Throttling (page 10)
Page 10 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2581 | Medium | 5.9 | 2026-03-12 | This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptor… |
CVE-2026-1526 | High | 7.5 | 2026-03-12 | The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSoc… |
CVE-2026-32141 | High | 7.5 | 2026-03-12 | flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JS… |
CVE-2026-31890 | Medium | 5.5 | 2026-03-12 | Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1… |
CVE-2026-31961 | Medium | 5.5 | 2026-03-11 | Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory allocation vulnerability… |
CVE-2026-31960 | Medium | 5.3 | 2026-03-11 | Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the… |
CVE-2019-25464 | Medium | 5.5 | 2026-03-11 | InputMapper 1.6.10 contains a buffer overflow vulnerability in the username field that allows local attackers to crash the application by entering an excessive… |
CVE-2026-31866 | High | 7.5 | 2026-03-11 | flagd is a feature flag daemon with a Unix philosophy. Prior to 0.14.2, flagd exposes OFREP (/ofrep/v1/evaluate/...) and gRPC (evaluation.v1, evaluation.v2) en… |
CVE-2025-13929 | High | 7.5 | 2026-03-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allow… |
CVE-2025-13690 | Medium | 6.5 | 2026-03-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allo… |
CVE-2025-12576 | Medium | 6.5 | 2026-03-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that under certain con… |
CVE-2026-32062 | High | 7.5 | 2026-03-11 | OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media… |
CVE-2026-31826 | Medium | 5.5 | 2026-03-10 | pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory us… |
CVE-2026-30946 | High | 7.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated atta… |
CVE-2026-26130 | High | 7.5 | 2026-03-10 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-30827 | High | 7.5 | 2026-03-07 | express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the d… |
CVE-2026-29795 | Medium | 4.0 | 2026-03-06 | stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate… |
CVE-2026-26018 | High | 7.5 | 2026-03-06 | CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows a… |
CVE-2026-29062 | High | 7.5 | 2026-03-06 | jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before v… |
CVE-2026-29612 | Medium | 5.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger… |
CVE-2026-29609 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory… |
CVE-2026-28478 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limit… |
CVE-2026-28452 | Medium | 5.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers… |
CVE-2026-28394 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through… |
CVE-2026-28342 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users… |
CVE-2026-26998 | Medium | 4.4 | 2026-03-05 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth… |
CVE-2026-20103 | High | 8.6 | 2026-03-04 | A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defen… |
CVE-2026-3520 | High | 7.5 | 2026-03-04 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of S… |
CVE-2026-27932 | High | 7.5 | 2026-03-03 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource ex… |
CVE-2026-27601 | Medium | 5.9 | 2026-03-03 | Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very… |
CVE-2026-25673 | High | 7.5 | 2026-03-03 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which… |
CVE-2026-27887 | | 2026-02-26 | Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin is configured to allow connections to… | |
CVE-2026-27633 | High | 7.5 | 2026-02-26 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 have a Denial of Service (DoS) vulnerability via memory exhau… |
CVE-2026-27630 | High | 7.5 | 2026-02-26 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as S… |
CVE-2026-2845 | Medium | 6.5 | 2026-02-25 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed… |
CVE-2026-1725 | Medium | 5.3 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed an unauthenticated… |
CVE-2026-1662 | High | 7.5 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allow… |
CVE-2025-3525 | Medium | 6.5 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have, under… |
CVE-2026-3201 | Medium | 4.7 | 2026-02-25 | USB HID protocol dissector memory exhaustion in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service |
CVE-2026-27695 | Medium | 4.3 | 2026-02-25 | zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same Dyn… |
CVE-2026-27572 | High | 7.5 | 2026-02-24 | Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields`… |
CVE-2026-27204 | Medium | 6.5 | 2026-02-24 | Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susc… |
CVE-2026-25899 | High | 7.5 | 2026-02-24 | Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbound… |
CVE-2026-27571 | Medium | 5.9 | 2026-02-24 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed mes… |
CVE-2026-25985 | High | 7.5 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file con… |
CVE-2026-27729 | Medium | 5.9 | 2026-02-24 | Astro is a web framework. In versions 9.0.0 through 9.5.3, Astro server actions have no default request body size limit, which can lead to memory exhaustion Do… |
CVE-2026-26047 | Medium | 6.5 | 2026-02-21 | A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits c… |
CVE-2026-27026 | Medium | 5.5 | 2026-02-20 | pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes… |
CVE-2026-26313 | High | 7.5 | 2026-02-19 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an attacker can cause high memory usage by sen… |
CVE-2026-26312 | Medium | 6.5 | 2026-02-19 | Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4 where accessing a… |
CVE-2026-25535 | High | 7.5 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If… |
CVE-2019-25350 | High | 7.5 | 2026-02-18 | XMedia Recode 3.4.8.6 contains a denial of service vulnerability that allows attackers to crash the application by loading a specially crafted .m3u playlist fi… |
CVE-2025-14876 | Medium | 5.5 | 2026-02-18 | A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to un… |
CVE-2019-25342 | High | 7.5 | 2026-02-12 | Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the database export API endp… |
CVE-2026-26076 | High | 7.5 | 2026-02-12 | ntpd-rs is a full-featured implementation of the Network Time Protocol. Prior to 1.7.1, an attacker can remotely induce moderate increases (2-4 times above nor… |
CVE-2026-25949 | High | 7.5 | 2026-02-12 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticate… |
CVE-2026-21434 | Medium | 5.3 | 2026-02-12 | webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's… |
CVE-2026-20608 | Medium | 5.5 | 2026-02-11 | This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS T… |
CVE-2026-1837 | High | 7.5 | 2026-02-11 | A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized un… |
CVE-2025-58471 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57711 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57710 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57708 | Medium | 6.5 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-54161 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator a… |
CVE-2025-54155 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator a… |
CVE-2025-54151 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2025-54150 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2025-54149 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2026-1458 | Medium | 6.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain co… |
CVE-2026-1456 | Medium | 6.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticate… |
CVE-2026-1387 | Medium | 6.5 | 2026-02-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed… |
CVE-2025-8099 | High | 7.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2021-26381 | | 2026-02-10 | Improper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a large number of pages… | |
CVE-2026-1850 | Medium | 6.5 | 2026-02-10 | Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. |
CVE-2026-1848 | High | 7.5 | 2026-02-10 | Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections excee… |
CVE-2026-1847 | Medium | 6.5 | 2026-02-10 | Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall… |
CVE-2026-23689 | High | 7.7 | 2026-02-10 | Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can re… |
CVE-2025-15317 | Medium | 6.5 | 2026-02-09 | Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server. |
CVE-2026-0398 | Medium | 5.3 | 2026-02-09 | Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor. |
CVE-2025-31990 | Medium | 6.8 | 2026-02-07 | Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the syst… |
CVE-2026-25804 | Critical | 9.1 | 2026-02-06 | Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment sys… |
CVE-2026-25762 | High | 7.5 | 2026-02-06 | AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file… |
CVE-2025-32393 | Medium | 6.5 | 2026-02-05 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2020-37143 | High | 7.5 | 2026-02-05 | ProficySCADA for iOS 5.0.25920 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the password input fie… |
CVE-2020-37139 | High | 8.4 | 2026-02-05 | Odin Secure FTP Expert 7.6.3 contains a local denial of service vulnerability that allows attackers to crash the application by manipulating site information f… |
CVE-2020-37134 | High | 7.5 | 2026-02-05 | UltraVNC Viewer 1.2.4.0 contains a denial of service vulnerability that allows attackers to crash the application by manipulating VNC Server input. Attackers c… |
CVE-2026-25579 | Medium | 6.5 | 2026-02-04 | Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supp… |
CVE-2025-1823 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using specially crafted SQL query that consumes e… |
CVE-2024-39724 | Medium | 5.3 | 2026-02-04 | IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not properly limit the allocation of system resou… |
CVE-2026-25140 | High | 7.5 | 2026-02-04 | apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromis… |
CVE-2026-25122 | Medium | 5.5 | 2026-02-04 | apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip… |
CVE-2026-24514 | Medium | 6.5 | 2026-02-03 | A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending larg… |
CVE-2026-25224 | Low | 3.7 | 2026-02-03 | Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response hand… |
CVE-2020-37085 | High | 7.5 | 2026-02-03 | VirtualTablet Server 3.0.2 contains a denial of service vulnerability that allows attackers to crash the service by sending oversized string payloads through t… |
CVE-2020-37067 | Critical | 9.8 | 2026-02-03 | Filetto 1.0 FTP server contains a denial of service vulnerability in the FEAT command processing that allows attackers to crash the service. Attackers can send… |
CVE-2025-58348 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58347 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58346 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58345 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58344 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |