CWE-770 · Allocation of Resources Without Limits or Throttling (page 11)
Page 11 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58343 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58342 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58341 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58340 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2026-24133 | Medium | 6.5 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If g… |
CVE-2026-22780 | Medium | 4.4 | 2026-02-02 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. Prior to 0.8.2, a heap overflow can be exploited when a malicious mach0 file, havi… |
CVE-2026-20406 | Medium | 6.5 | 2026-02-02 | In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base sta… |
CVE-2020-37039 | High | 7.5 | 2026-01-30 | Frigate 2.02 contains a denial of service vulnerability that allows attackers to crash the application by sending oversized input to the command line interface… |
CVE-2020-37038 | High | 7.5 | 2026-01-30 | Code Blocks 20.03 contains a denial of service vulnerability that allows attackers to crash the application by manipulating input in the FSymbols search field… |
CVE-2025-36387 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given spe… |
CVE-2025-36123 | Medium | 6.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service whe… |
CVE-2025-36098 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-36070 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur… |
CVE-2025-2668 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenti… |
CVE-2025-68934 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payload… |
CVE-2025-61728 | Medium | 6.5 | 2026-01-28 | archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of servic… |
CVE-2025-61726 | High | 7.5 | 2026-01-28 | The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited… |
CVE-2025-68659 | Medium | 4.3 | 2026-01-28 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulner… |
CVE-2020-36943 | High | 7.5 | 2026-01-28 | aSc TimeTables 2021.6.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting subject title fields with exce… |
CVE-2026-24738 | Medium | 6.5 | 2026-01-27 | gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts TLVs with lengths that can range up to 4… |
CVE-2026-23881 | High | 7.7 | 2026-01-27 | Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyver… |
CVE-2026-22259 | High | 7.5 | 2026-01-27 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of mem… |
CVE-2026-22258 | High | 7.5 | 2026-01-27 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, lea… |
CVE-2025-55102 | High | 7.5 | 2026-01-27 | A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet To… |
CVE-2020-36950 | Medium | 6.5 | 2026-01-27 | Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. A… |
CVE-2020-36949 | High | 7.5 | 2026-01-27 | TapinRadio 2.13.7 contains a denial of service vulnerability in the application proxy settings that allows attackers to crash the program by overflowing input… |
CVE-2020-36946 | High | 7.5 | 2026-01-27 | SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an ov… |
CVE-2025-14525 | Medium | 6.4 | 2026-01-26 | A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive… |
CVE-2026-1224 | Medium | 4.9 | 2026-01-26 | Tanium addressed an uncontrolled resource consumption vulnerability in Discover. |
CVE-2021-47895 | High | 7.5 | 2026-01-23 | Nsauditor 3.2.2.0 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Event Description field with a l… |
CVE-2021-47894 | High | 7.5 | 2026-01-23 | Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the application by creating an oversized buff… |
CVE-2021-47893 | High | 7.5 | 2026-01-23 | AgataSoft PingMaster Pro 2.1 contains a denial of service vulnerability in the Trace Route feature that allows attackers to crash the application by overflowin… |
CVE-2025-67221 | High | 7.5 | 2026-01-22 | The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents. |
CVE-2026-1102 | Medium | 5.3 | 2026-01-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allow… |
CVE-2025-13927 | High | 7.5 | 2026-01-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allow… |
CVE-2026-24006 | High | 7.5 | 2026-01-22 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of ob… |
CVE-2026-23963 | Medium | 4.3 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum… |
CVE-2026-23962 | High | 7.5 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the ma… |
CVE-2026-23957 | High | 7.5 | 2026-01-22 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded… |
CVE-2025-68138 | Medium | 4.7 | 2026-01-21 | EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, po… |
CVE-2025-68136 | High | 7.4 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Sessi… |
CVE-2021-47877 | High | 7.5 | 2026-01-21 | GeoGebra Graphing Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the application by inputting an oversized buff… |
CVE-2021-47876 | High | 7.5 | 2026-01-21 | GeoGebra Classic 5.0.631.0-d contains a denial of service vulnerability in the input field that allows attackers to crash the application by sending oversized… |
CVE-2021-47875 | Critical | 9.8 | 2026-01-21 | GeoGebra CAS Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the application by generating a large buffer overfl… |
CVE-2021-47865 | High | 7.5 | 2026-01-21 | ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FTP connections. Atta… |
CVE-2025-68133 | High | 7.4 | 2026-01-21 | EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to termina… |
CVE-2026-21696 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Win… |
CVE-2025-69199 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack prop… |
CVE-2025-11044 | Medium | 6.8 | 2026-01-19 | An Allocation of Resources Without Limits or Throttling vulnerability in the ANSL-Server component of B&R Automation Runtime versions prior to 6.5 and prior to… |
CVE-2026-23490 | High | 7.5 | 2026-01-16 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-… |
CVE-2025-14435 | Medium | 6.8 | 2026-01-16 | Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users t… |
CVE-2025-14822 | Low | 3.1 | 2026-01-16 | Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources v… |
CVE-2021-47793 | High | 7.5 | 2026-01-16 | Telegram Desktop 2.9.2 contains a denial of service vulnerability that allows attackers to crash the application by sending an oversized message payload. Attac… |
CVE-2021-47791 | High | 7.5 | 2026-01-16 | SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that allow attackers to crash the application through specific input manipulati… |
CVE-2026-22045 | Medium | 5.9 | 2026-01-15 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic… |
CVE-2026-22803 | High | 7.5 | 2026-01-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function… |
CVE-2021-47784 | High | 7.5 | 2026-01-15 | Cyberfox Web Browser 52.9.1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the search bar with excess… |
CVE-2021-47771 | Medium | 5.5 | 2026-01-15 | RDP Manager 4.9.9.3 contains a denial of service vulnerability in connection input fields that allows local attackers to crash the application. Attackers can a… |
CVE-2021-47752 | High | 7.5 | 2026-01-15 | AWebServer GhostBuilding 18 contains a denial of service vulnerability that allows remote attackers to overwhelm the server by sending multiple concurrent HTTP… |
CVE-2026-0897 | High | 7.5 | 2026-01-15 | Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote… |
CVE-2026-22917 | Medium | 4.3 | 2026-01-15 | Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service. |
CVE-2026-22036 | Medium | 5.9 | 2026-01-14 | Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize… |
CVE-2026-0543 | Medium | 6.5 | 2026-01-13 | Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted e… |
CVE-2026-0531 | Medium | 6.5 | 2026-01-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrie… |
CVE-2026-0530 | Medium | 6.5 | 2026-01-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. Th… |
CVE-2025-37166 | High | 7.5 | 2026-01-13 | A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-re… |
CVE-2024-58339 | High | 7.5 | 2026-01-12 | LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEn… |
CVE-2026-22773 | Medium | 6.5 | 2026-01-10 | vLLM is an inference and serving engine for large language models (LLMs). In versions from 0.6.4 to before 0.12.0, users can crash the vLLM engine serving mult… |
CVE-2026-22025 | Low | 3.7 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-10569 | Medium | 6.5 | 2026-01-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowe… |
CVE-2025-50334 | High | 7.5 | 2026-01-08 | An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component |
CVE-2025-68151 | High | 7.5 | 2026-01-08 | CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-… |
CVE-2025-66560 | Medium | 5.9 | 2026-01-07 | Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exist… |
CVE-2025-66838 | Medium | 6.5 | 2026-01-07 | In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unr… |
CVE-2025-15474 | | 2026-01-07 | AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy… | |
CVE-2020-36907 | High | 7.5 | 2026-01-06 | Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Atta… |
CVE-2025-69229 | Medium | 5.3 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excess… |
CVE-2025-69228 | High | 7.5 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an A… |
CVE-2025-69223 | High | 7.5 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against… |
CVE-2025-68456 | Critical | 9.1 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger databa… |
CVE-2025-64422 | Medium | 4.3 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /logi… |
CVE-2025-57705 | Medium | 4.9 | 2026-01-02 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker… |
CVE-2025-47208 | Medium | 6.5 | 2026-01-02 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker… |
CVE-2025-68272 | High | 7.5 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an una… |
CVE-2022-50799 | High | 7.5 | 2025-12-30 | Fetch FTP Client 5.8.2 contains a denial of service vulnerability that allows attackers to trigger 100% CPU consumption by sending long server responses. Attac… |
CVE-2022-50695 | High | 7.5 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to arbitrary hosts throu… |
CVE-2025-68148 | Medium | 4.3 | 2025-12-27 | FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to… |
CVE-2025-11419 | High | 7.5 | 2025-12-23 | A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2… |
CVE-2021-47713 | High | 7.5 | 2025-12-22 | Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with exces… |
CVE-2025-14299 | Medium | 6.5 | 2025-12-20 | The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on th… |
CVE-2025-68390 | Medium | 4.9 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Exces… |
CVE-2025-68389 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130… |
CVE-2025-68388 | Medium | 5.3 | 2025-12-18 | Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory an… |
CVE-2025-68384 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CA… |
CVE-2025-14466 | Medium | 5.3 | 2025-12-16 | A vulnerability in the web interface of the Güralp Fortimus Series, Minimus Series and Certimus Series allows an unauthenticated attacker with network access t… |
CVE-2025-68156 | High | 7.5 | 2025-12-16 | Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`… |
CVE-2025-64702 | Medium | 5.3 | 2025-12-11 | quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 clien… |
CVE-2025-4097 | Medium | 6.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allo… |
CVE-2025-14157 | Medium | 6.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 6.3 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowe… |
CVE-2025-12562 | High | 7.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allo… |