CWE-770 · Allocation of Resources Without Limits or Throttling (page 10)
Page 10 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8885 | | 2025-08-12 | Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bounc… | |
CVE-2025-54884 | | 2025-08-06 | Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the generateSecureId and getSecure… | |
CVE-2025-54879 | Medium | 5.3 | 2025-08-06 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5… |
CVE-2025-54869 | | 2025-08-06 | FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below… | |
CVE-2025-8537 | Low | 3.7 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of th… |
CVE-2025-48074 | Medium | 5.5 | 2025-08-01 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3… |
CVE-2025-54939 | Medium | 5.3 | 2025-08-01 | LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. |
CVE-2025-2813 | High | 7.5 | 2025-07-31 | An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80. |
CVE-2025-54575 | Medium | 5.3 | 2025-07-30 | ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension b… |
CVE-2025-54572 | | 2025-07-30 | The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ru… | |
CVE-2025-43211 | Medium | 6.2 | 2025-07-30 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18… |
CVE-2025-5253 | Medium | 6.5 | 2025-07-25 | Allocation of Resources Without Limits or Throttling vulnerability in Kron Technologies Kron PAM allows HTTP DoS. This issue affects Kron PAM: before 3.7. |
CVE-2025-53538 | High | 7.5 | 2025-07-22 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and b… |
CVE-2024-38335 | Medium | 4.5 | 2025-07-22 | IBM Security QRadar Network Threat Analytics 1.0.0 through 1.3.1 could allow a privileged user to cause a denial of service due to improper allocation of resou… |
CVE-2025-54121 | Medium | 5.3 | 2025-07-21 | Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47… |
CVE-2025-44652 | High | 7.5 | 2025-07-21 | In Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attacks when unlimited… |
CVE-2025-53032 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.1.0. Easily exploit… |
CVE-2025-29606 | Medium | 4.3 | 2025-07-14 | py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key. |
CVE-2025-53634 | High | 7.5 | 2025-07-10 | Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a… |
CVE-2025-53629 | High | 7.5 | 2025-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.23.0, incoming requests using Transfer-Encoding: chunked in the he… |
CVE-2025-53628 | High | 8.8 | 2025-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitt… |
CVE-2025-53531 | High | 7.5 | 2025-07-07 | WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This… |
CVE-2025-53530 | High | 7.5 | 2025-07-07 | WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This… |
CVE-2025-48367 | High | 7.5 | 2025-07-07 | Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starv… |
CVE-2025-7070 | Medium | 4.3 | 2025-07-04 | A vulnerability has been found in IROAD Dashcam Q9 up to 20250624 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-3279 | Medium | 6.5 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-52889 | Low | 3.4 | 2025-06-25 | Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables ru… |
CVE-2025-2403 | High | 7.5 | 2025-06-24 | A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and SAM600-IO series dev… |
CVE-2025-52570 | | 2025-06-24 | Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simulta… | |
CVE-2025-52568 | | 2025-06-24 | NeKernal is a free and open-source operating system stack. Prior to version 0.0.3, there are several memory safety issues that can lead to memory corruption, d… | |
CVE-2025-48467 | Medium | 6.5 | 2025-06-24 | Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-service and system unav… |
CVE-2025-48462 | Medium | 4.2 | 2025-06-24 | Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from logging in, thereby prev… |
CVE-2025-52917 | Medium | 4.3 | 2025-06-21 | The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests. |
CVE-2025-3221 | High | 7.5 | 2025-06-21 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a remote attacker to cause a denial of service due to insufficient validation of incomi… |
CVE-2025-4821 | High | 7.5 | 2025-06-18 | Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the pa… |
CVE-2025-4820 | Medium | 5.3 | 2025-06-18 | Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the pa… |
CVE-2025-45526 | Low | 2.9 | 2025-06-17 | A denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, doe… |
CVE-2025-48988 | High | 7.5 | 2025-06-16 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10… |
CVE-2025-48976 | High | 7.5 | 2025-06-16 | Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Com… |
CVE-2025-5996 | Medium | 6.5 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input va… |
CVE-2025-1516 | Medium | 6.5 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input valid… |
CVE-2025-1478 | Medium | 6.5 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input val… |
CVE-2025-25032 | High | 7.5 | 2025-06-11 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of… |
CVE-2025-48448 | Medium | 6.5 | 2025-06-11 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail… |
CVE-2025-4605 | Medium | 6.6 | 2025-06-11 | A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation vulnerability. A malicious actor may leverage… |
CVE-2025-49140 | High | 7.5 | 2025-06-09 | Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can b… |
CVE-2025-48053 | High | 7.5 | 2025-06-09 | Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.bet… |
CVE-2025-25207 | Medium | 5.7 | 2025-06-09 | The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer pers… |
CVE-2025-47950 | High | 7.5 | 2025-06-06 | CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) ser… |
CVE-2025-29872 | High | 7.5 | 2025-06-06 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t… |
CVE-2025-22484 | | 2025-06-06 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t… | |
CVE-2024-58114 | Medium | 4.0 | 2025-06-06 | Resource allocation control failure vulnerability in the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-5683 | Medium | 5.5 | 2025-06-05 | When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, f… |
CVE-2025-49007 | Medium | 5.3 | 2025-06-04 | Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-D… |
CVE-2018-25112 | High | 7.5 | 2025-06-04 | An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creating large amounts of… |
CVE-2025-49000 | Low | 3.5 | 2025-06-03 | InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so… |
CVE-2025-46807 | | 2025-06-02 | A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimat… | |
CVE-2025-3050 | Medium | 5.3 | 2025-05-29 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a… |
CVE-2025-48738 | | 2025-05-23 | An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows unauthentic… | |
CVE-2025-48375 | Medium | 5.3 | 2025-05-23 | Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-bas… |
CVE-2024-7803 | Medium | 6.5 | 2025-05-23 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook i… |
CVE-2025-0993 | High | 7.5 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authentic… |
CVE-2025-3111 | Medium | 6.5 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input val… |
CVE-2025-2853 | Medium | 6.5 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation i… |
CVE-2025-4416 | High | 7.5 | 2025-05-21 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track… |
CVE-2025-47793 | Medium | 4.3 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or… |
CVE-2025-47287 | High | 7.5 | 2025-05-15 | Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warni… |
CVE-2025-29957 | Medium | 6.2 | 2025-05-13 | Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally. |
CVE-2025-29954 | Medium | 5.9 | 2025-05-13 | Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2025-26677 | High | 7.5 | 2025-05-13 | Uncontrolled resource consumption in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-3632 | High | 7.5 | 2025-05-12 | IBM 4769 Developers Toolkit 7.0.0 through 7.5.52 could allow a remote attacker to cause a denial of service in the Hardware Security Module (HSM) due to improp… |
CVE-2024-8973 | Medium | 6.5 | 2025-05-09 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17… |
CVE-2025-4432 | Medium | 5.3 | 2025-05-09 | A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to indu… |
CVE-2025-37805 | Medium | 5.5 | 2025-05-08 | In the Linux kernel, the following vulnerability has been resolved: sound/virtio: Fix cancel_sync warnings on uninitialized work_structs Betty reported hitti… |
CVE-2025-32873 | Medium | 5.3 | 2025-05-08 | An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a pot… |
CVE-2025-46727 | High | 7.5 | 2025-05-07 | Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form… |
CVE-2025-36504 | High | 7.5 | 2025-05-07 | When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization. Note: S… |
CVE-2025-1000 | Medium | 5.3 | 2025-05-05 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause… |
CVE-2025-0915 | Medium | 5.3 | 2025-05-05 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 under specific configurations could allow… |
CVE-2025-32777 | | 2025-04-30 | Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacke… | |
CVE-2025-24341 | Medium | 6.5 | 2025-04-30 | A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the… |
CVE-2025-30202 | High | 7.5 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial… |
CVE-2025-43857 | Medium | 6.5 | 2025-04-28 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possib… |
CVE-2025-46687 | Medium | 5.6 | 2025-04-27 | quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also a… |
CVE-2025-30409 | Medium | 5.5 | 2025-04-24 | Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build… |
CVE-2025-0639 | Medium | 6.5 | 2025-04-24 | An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.1… |
CVE-2025-35965 | Medium | 6.5 | 2025-04-24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTask… |
CVE-2025-21605 | High | 7.5 | 2025-04-23 | Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimite… |
CVE-2025-32959 | Medium | 6.5 | 2025-04-22 | CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementation does not restri… |
CVE-2025-32952 | Medium | 6.5 | 2025-04-22 | Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local fil… |
CVE-2025-3734 | Medium | 5.9 | 2025-04-16 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 b… |
CVE-2025-0122 | | 2025-04-11 | A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma… | |
CVE-2024-51461 | Medium | 4.3 | 2025-04-11 | IBM QRadar WinCollect Agent 10.0 through 10.1.13 could allow a remote attacker to cause a denial of service by interrupting an HTTP request that could consume… |
CVE-2025-29917 | Medium | 6.2 | 2025-04-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decode_base64 ke… |
CVE-2025-29916 | Medium | 6.2 | 2025-04-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option… |
CVE-2025-1677 | Medium | 6.5 | 2025-04-10 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of ser… |
CVE-2025-26480 | Medium | 5.3 | 2025-04-10 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.0, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote… |
CVE-2025-32386 | Medium | 6.5 | 2025-04-09 | Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e… |
CVE-2025-3475 | Medium | 6.5 | 2025-04-09 | Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This… |
CVE-2025-32381 | Medium | 6.5 | 2025-04-09 | XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammar… |