CWE-770 · Allocation of Resources Without Limits or Throttling (page 13)
Page 13 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9784 | High | 7.5 | 2025-09-02 | A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to a… |
CVE-2024-58259 | High | 8.2 | 2025-09-02 | A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authe… |
CVE-2025-30261 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-30260 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-29900 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-29899 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-29898 | Medium | 6.5 | 2025-08-29 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-29890 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-58058 | Medium | 5.3 | 2025-08-28 | xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte s… |
CVE-2025-6203 | High | 7.5 | 2025-08-28 | A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU c… |
CVE-2025-4225 | Medium | 5.3 | 2025-08-27 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that that under certain… |
CVE-2025-3601 | Medium | 6.5 | 2025-08-27 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have could h… |
CVE-2025-57810 | High | 7.5 | 2025-08-26 | jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and den… |
CVE-2025-43762 | Medium | 6.5 | 2025-08-22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-43752 | Medium | 6.5 | 2025-08-22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-4437 | Medium | 5.7 | 2025-08-20 | There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts… |
CVE-2025-36047 | Medium | 5.3 | 2025-08-14 | IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remot… |
CVE-2025-55199 | Medium | 6.5 | 2025-08-14 | Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to… |
CVE-2025-55197 | High | 7.5 | 2025-08-13 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requi… |
CVE-2025-2614 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed… |
CVE-2025-1477 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed… |
CVE-2025-55163 | High | 7.5 | 2025-08-13 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS… |
CVE-2025-54500 | Medium | 5.3 | 2025-08-13 | An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HT… |
CVE-2025-8916 | | 2025-08-13 | Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bounc… | |
CVE-2025-50172 | Medium | 6.5 | 2025-08-12 | Allocation of resources without limits or throttling in Windows DirectX allows an authorized attacker to deny service over a network. |
CVE-2025-40570 | Low | 2.4 | 2025-08-12 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V10.0), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 6M… |
CVE-2025-43736 | Medium | 4.3 | 2025-08-12 | A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0… |
CVE-2025-8885 | | 2025-08-12 | Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bounc… | |
CVE-2025-54884 | | 2025-08-06 | Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the generateSecureId and getSecure… | |
CVE-2025-54879 | Medium | 5.3 | 2025-08-06 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5… |
CVE-2025-54869 | | 2025-08-06 | FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below… | |
CVE-2025-8537 | Low | 3.7 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of th… |
CVE-2025-48074 | Medium | 5.5 | 2025-08-01 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3… |
CVE-2025-54939 | Medium | 5.3 | 2025-08-01 | LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. |
CVE-2025-2813 | High | 7.5 | 2025-07-31 | An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80. |
CVE-2025-54575 | Medium | 5.3 | 2025-07-30 | ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension b… |
CVE-2025-54572 | | 2025-07-30 | The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ru… | |
CVE-2025-43211 | Medium | 6.2 | 2025-07-30 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18… |
CVE-2025-5253 | Medium | 6.5 | 2025-07-25 | Allocation of Resources Without Limits or Throttling vulnerability in Kron Technologies Kron PAM allows HTTP DoS. This issue affects Kron PAM: before 3.7. |
CVE-2025-53538 | High | 7.5 | 2025-07-22 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and b… |
CVE-2024-38335 | Medium | 4.5 | 2025-07-22 | IBM Security QRadar Network Threat Analytics 1.0.0 through 1.3.1 could allow a privileged user to cause a denial of service due to improper allocation of resou… |
CVE-2025-54121 | Medium | 5.3 | 2025-07-21 | Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47… |
CVE-2025-44652 | High | 7.5 | 2025-07-21 | In Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attacks when unlimited… |
CVE-2025-53032 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.1.0. Easily exploit… |
CVE-2025-29606 | Medium | 4.3 | 2025-07-14 | py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key. |
CVE-2025-53634 | High | 7.5 | 2025-07-10 | Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a… |
CVE-2025-53629 | High | 7.5 | 2025-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.23.0, incoming requests using Transfer-Encoding: chunked in the he… |
CVE-2025-53628 | High | 8.8 | 2025-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitt… |
CVE-2025-53531 | High | 7.5 | 2025-07-07 | WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This… |
CVE-2025-53530 | High | 7.5 | 2025-07-07 | WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This… |
CVE-2025-48367 | High | 7.5 | 2025-07-07 | Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starv… |
CVE-2025-7070 | Medium | 4.3 | 2025-07-04 | A vulnerability has been found in IROAD Dashcam Q9 up to 20250624 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-3279 | Medium | 6.5 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-52889 | Low | 3.4 | 2025-06-25 | Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables ru… |
CVE-2025-2403 | High | 7.5 | 2025-06-24 | A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and SAM600-IO series dev… |
CVE-2025-52570 | | 2025-06-24 | Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simulta… | |
CVE-2025-52568 | | 2025-06-24 | NeKernal is a free and open-source operating system stack. Prior to version 0.0.3, there are several memory safety issues that can lead to memory corruption, d… | |
CVE-2025-48467 | Medium | 6.5 | 2025-06-24 | Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-service and system unav… |
CVE-2025-48462 | Medium | 4.2 | 2025-06-24 | Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from logging in, thereby prev… |
CVE-2025-52917 | Medium | 4.3 | 2025-06-21 | The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests. |
CVE-2025-3221 | High | 7.5 | 2025-06-21 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a remote attacker to cause a denial of service due to insufficient validation of incomi… |
CVE-2025-4821 | High | 7.5 | 2025-06-18 | Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the pa… |
CVE-2025-4820 | Medium | 5.3 | 2025-06-18 | Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the pa… |
CVE-2025-45526 | Low | 2.9 | 2025-06-17 | A denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, doe… |
CVE-2025-48988 | High | 7.5 | 2025-06-16 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10… |
CVE-2025-48976 | High | 7.5 | 2025-06-16 | Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Com… |
CVE-2025-5996 | Medium | 6.5 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input va… |
CVE-2025-1516 | Medium | 6.5 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input valid… |
CVE-2025-1478 | Medium | 6.5 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input val… |
CVE-2025-25032 | High | 7.5 | 2025-06-11 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of… |
CVE-2025-48448 | Medium | 6.5 | 2025-06-11 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail… |
CVE-2025-4605 | Medium | 6.6 | 2025-06-11 | A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation vulnerability. A malicious actor may leverage… |
CVE-2025-49140 | High | 7.5 | 2025-06-09 | Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can b… |
CVE-2025-48053 | High | 7.5 | 2025-06-09 | Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.bet… |
CVE-2025-25207 | Medium | 5.7 | 2025-06-09 | The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer pers… |
CVE-2025-47950 | High | 7.5 | 2025-06-06 | CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) ser… |
CVE-2025-29872 | High | 7.5 | 2025-06-06 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t… |
CVE-2025-22484 | | 2025-06-06 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t… | |
CVE-2024-58114 | Medium | 4.0 | 2025-06-06 | Resource allocation control failure vulnerability in the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-5683 | Medium | 5.5 | 2025-06-05 | When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, f… |
CVE-2025-49007 | Medium | 5.3 | 2025-06-04 | Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-D… |
CVE-2018-25112 | High | 7.5 | 2025-06-04 | An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creating large amounts of… |
CVE-2025-49000 | Low | 3.5 | 2025-06-03 | InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so… |
CVE-2025-46807 | | 2025-06-02 | A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimat… | |
CVE-2025-3050 | Medium | 5.3 | 2025-05-29 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a… |
CVE-2025-48738 | | 2025-05-23 | An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows unauthentic… | |
CVE-2025-48375 | Medium | 5.3 | 2025-05-23 | Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-bas… |
CVE-2024-7803 | Medium | 6.5 | 2025-05-23 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook i… |
CVE-2025-0993 | High | 7.5 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authentic… |
CVE-2025-3111 | Medium | 6.5 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input val… |
CVE-2025-2853 | Medium | 6.5 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation i… |
CVE-2025-4416 | High | 7.5 | 2025-05-21 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track… |
CVE-2025-47793 | Medium | 4.3 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or… |
CVE-2025-47287 | High | 7.5 | 2025-05-15 | Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warni… |
CVE-2025-29957 | Medium | 6.2 | 2025-05-13 | Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally. |
CVE-2025-29954 | Medium | 5.9 | 2025-05-13 | Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2025-26677 | High | 7.5 | 2025-05-13 | Uncontrolled resource consumption in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-3632 | High | 7.5 | 2025-05-12 | IBM 4769 Developers Toolkit 7.0.0 through 7.5.52 could allow a remote attacker to cause a denial of service in the Hardware Security Module (HSM) due to improp… |
CVE-2024-8973 | Medium | 6.5 | 2025-05-09 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17… |
CVE-2025-4432 | Medium | 5.3 | 2025-05-09 | A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to indu… |