CWE-770 · Allocation of Resources Without Limits or Throttling (page 11)
Page 11 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32380 | High | 7.5 | 2025-04-09 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerab… |
CVE-2025-32374 | Medium | 5.9 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted… |
CVE-2025-26682 | High | 7.5 | 2025-04-08 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2025-32025 | | 2025-04-08 | bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for… | |
CVE-2025-32024 | | 2025-04-08 | bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining exc… | |
CVE-2025-32034 | High | 7.5 | 2025-04-07 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1… |
CVE-2025-32032 | High | 7.5 | 2025-04-07 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerab… |
CVE-2025-32031 | High | 7.5 | 2025-04-07 | Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gatew… |
CVE-2025-32030 | High | 7.5 | 2025-04-07 | Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gatew… |
CVE-2025-31496 | High | 7.5 | 2025-04-07 | apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed queries with deeply neste… |
CVE-2025-24317 | Medium | 5.3 | 2025-04-04 | Allocation of resources without limits or throttling issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated a… |
CVE-2025-32049 | High | 7.5 | 2025-04-03 | A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial… |
CVE-2025-27556 | Medium | 5.8 | 2025-04-02 | An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.view… |
CVE-2024-45700 | Medium | 6.5 | 2025-04-02 | Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, whic… |
CVE-2024-10307 | Medium | 4.3 | 2025-03-28 | An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously craft… |
CVE-2025-30350 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior… |
CVE-2025-30225 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior… |
CVE-2025-2559 | Medium | 4.9 | 2025-03-25 | A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens wi… |
CVE-2024-45484 | | 2025-03-25 | An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an un… | |
CVE-2025-1451 | High | 7.5 | 2025-03-20 | A vulnerability in parisneo/lollms-webui v13 arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate t… |
CVE-2025-0315 | High | 7.5 | 2025-03-20 | A vulnerability in ollama/ollama <=0.3.14 allows a malicious user to create a customized GGUF model file, upload it to the Ollama server, and create it. This c… |
CVE-2025-0189 | High | 7.5 | 2025-03-20 | In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket message… |
CVE-2025-0182 | High | 7.5 | 2025-03-20 | A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable versi… |
CVE-2024-9437 | High | 7.5 | 2025-03-20 | SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service (DoS) attack. The vulnerability exists in the resource upload request, where app… |
CVE-2024-9229 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource co… |
CVE-2024-9056 | High | 7.5 | 2025-03-20 | BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-)… |
CVE-2024-8984 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes… |
CVE-2024-8966 | High | 7.5 | 2025-03-20 | A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can appen… |
CVE-2024-8028 | High | 7.5 | 2025-03-20 | A vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By… |
CVE-2024-8018 | High | 7.5 | 2025-03-20 | A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number… |
CVE-2024-7983 | High | 7.5 | 2025-03-20 | In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause… |
CVE-2024-7768 | High | 7.5 | 2025-03-20 | A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET… |
CVE-2024-12778 | High | 7.5 | 2025-03-20 | A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service (DoS) attack. The issue arises when a large number of tracked metrics are retriev… |
CVE-2024-11171 | High | 7.5 | 2025-03-20 | In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipar… |
CVE-2024-10935 | High | 7.5 | 2025-03-20 | automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multi… |
CVE-2024-10714 | High | 7.5 | 2025-03-20 | A vulnerability in binary-husky/gpt_academic version 3.83 allows an attacker to cause a Denial of Service (DoS) by adding excessive characters to the end of a… |
CVE-2024-10713 | High | 7.5 | 2025-03-20 | A vulnerability in szad670401/hyperlpr v3.0 allows for a Denial of Service (DoS) attack. The server fails to handle excessive characters appended to the end of… |
CVE-2024-10650 | High | 7.5 | 2025-03-20 | An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payl… |
CVE-2024-10225 | High | 7.5 | 2025-03-20 | A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a mul… |
CVE-2024-10051 | High | 7.5 | 2025-03-20 | Realchar version v0.0.4 is vulnerable to an unauthenticated denial of service (DoS) attack. The vulnerability exists in the file upload request handling, where… |
CVE-2025-29770 | Medium | 6.5 | 2025-03-19 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vLLM to support struc… |
CVE-2025-29907 | High | 7.5 | 2025-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and den… |
CVE-2025-29786 | High | 7.5 | 2025-03-17 | Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it… |
CVE-2025-1257 | Medium | 6.5 | 2025-03-13 | An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability i… |
CVE-2024-13054 | Medium | 6.5 | 2025-03-13 | An issue was discovered in GitLab CE/EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. where a denial of service vulnera… |
CVE-2025-20209 | High | 7.5 | 2025-03-12 | A vulnerability in the Internet Key Exchange version 2 (IKEv2) function of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent an… |
CVE-2025-20141 | High | 7.4 | 2025-03-12 | A vulnerability in the handling of specific packets that are punted from a line card to a route processor in Cisco IOS XR Software Release 7.9.2 could allow an… |
CVE-2025-21866 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC Erhar… |
CVE-2024-58089 | High | 7.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double accounting race when btrfs_run_delalloc_range() failed [BUG] When runni… |
CVE-2025-27911 | Medium | 6.5 | 2025-03-11 | An issue was discovered in Datalust Seq before 2024.3.13545. Expansion of identifiers in message templates can be used to bypass the system "Event body limit b… |
CVE-2025-27795 | Medium | 4.3 | 2025-03-07 | ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits. |
CVE-2024-57972 | Medium | 6.5 | 2025-03-06 | The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) through 10.0.22621.1… |
CVE-2025-26699 | Medium | 5.0 | 2025-03-06 | An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter… |
CVE-2025-27513 | High | 7.5 | 2025-03-05 | OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when… |
CVE-2025-27219 | Medium | 5.8 | 2025-03-04 | In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method do… |
CVE-2025-27419 | High | 7.5 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS) vulnerability exists in WeGIA. This v… |
CVE-2025-26466 | Medium | 5.9 | 2025-02-28 | A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of p… |
CVE-2025-22273 | | 2025-02-28 | Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword"… | |
CVE-2025-27157 | Medium | 5.3 | 2025-02-27 | Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `… |
CVE-2025-22869 | High | 7.5 | 2025-02-26 | SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at… |
CVE-2025-27144 | | 2025-02-24 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSO… | |
CVE-2023-51339 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Event Ticketing System v1.0 allows attackers to send an excessive amount of email for a… |
CVE-2024-46933 | High | 7.7 | 2025-02-20 | An issue was discovered in Atos Eviden BullSequana XH2140 BMC before C4EM-125: OMF_C4E 101.05.0014. Some BullSequana XH products were shipped without proper ha… |
CVE-2023-51334 | Medium | 5.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cinema Booking System v1.0 allows attackers to send an excessive amount of email for a l… |
CVE-2023-51310 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amo… |
CVE-2023-51309 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amount of email for a… |
CVE-2023-51297 | Medium | 6.5 | 2025-02-19 | A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of email for a leg… |
CVE-2024-49589 | Medium | 6.5 | 2025-02-18 | Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument (size). |
CVE-2025-26819 | High | 8.6 | 2025-02-15 | Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections. |
CVE-2025-1059 | High | 7.5 | 2025-02-13 | CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to t… |
CVE-2024-12379 | Medium | 6.5 | 2025-02-12 | A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an at… |
CVE-2025-25186 | Medium | 6.5 | 2025-02-10 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0… |
CVE-2025-21690 | Medium | 5.5 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persis… |
CVE-2025-1072 | Medium | 6.5 | 2025-02-07 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5… |
CVE-2024-37358 | High | 8.6 | 2025-02-06 | Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated use… |
CVE-2024-38316 | Medium | 4.3 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email f… |
CVE-2025-24312 | High | 7.5 | 2025-02-05 | When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclose… |
CVE-2024-2878 | High | 7.5 | 2025-02-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2024-9631 | High | 7.5 | 2025-02-05 | An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2023-6386 | Medium | 6.5 | 2025-02-05 | A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16… |
CVE-2024-12705 | High | 7.5 | 2025-01-29 | Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affec… |
CVE-2024-56316 | High | 7.5 | 2025-01-27 | In AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to cause a permanent De… |
CVE-2025-24127 | Medium | 5.5 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ve… |
CVE-2025-24112 | Medium | 5.5 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3. Parsing a file may lead to an unexpected app term… |
CVE-2025-24086 | Medium | 5.5 | 2025-01-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3… |
CVE-2024-54497 | Medium | 6.5 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.4, macOS Sequoia 15.2, macOS Sonoma 14.7.3, macOS Ve… |
CVE-2025-0695 | Medium | 5.3 | 2025-01-27 | An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the comp… |
CVE-2024-55195 | High | 7.5 | 2025-01-23 | An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the program to requests to al… |
CVE-2025-24033 | High | 7.5 | 2025-01-23 | @fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not dele… |
CVE-2025-0635 | High | 7.5 | 2025-01-23 | Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain condit… |
CVE-2024-43708 | Medium | 6.5 | 2025-01-23 | An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI… |
CVE-2024-52972 | Medium | 6.5 | 2025-01-23 | An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can… |
CVE-2024-57722 | High | 7.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create. |
CVE-2025-23028 | Medium | 5.3 | 2025-01-22 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1… |
CVE-2025-21543 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and… |
CVE-2025-21536 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and… |
CVE-2025-21534 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected are 8.0.39 and prior… |
CVE-2025-21531 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21525 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior… |
CVE-2025-21522 | Medium | 6.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and pr… |