CWE-770 · Allocation of Resources Without Limits or Throttling (page 14)
Page 14 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37805 | Medium | 5.5 | 2025-05-08 | In the Linux kernel, the following vulnerability has been resolved: sound/virtio: Fix cancel_sync warnings on uninitialized work_structs Betty reported hitti… |
CVE-2025-32873 | Medium | 5.3 | 2025-05-08 | An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a pot… |
CVE-2025-46727 | High | 7.5 | 2025-05-07 | Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form… |
CVE-2025-36504 | High | 7.5 | 2025-05-07 | When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization. Note: S… |
CVE-2025-1000 | Medium | 5.3 | 2025-05-05 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause… |
CVE-2025-0915 | Medium | 5.3 | 2025-05-05 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 under specific configurations could allow… |
CVE-2025-32777 | | 2025-04-30 | Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacke… | |
CVE-2025-24341 | Medium | 6.5 | 2025-04-30 | A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the… |
CVE-2025-30202 | High | 7.5 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial… |
CVE-2025-43857 | Medium | 6.5 | 2025-04-28 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possib… |
CVE-2025-46687 | Medium | 5.6 | 2025-04-27 | quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also a… |
CVE-2025-30409 | Medium | 5.5 | 2025-04-24 | Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build… |
CVE-2025-0639 | Medium | 6.5 | 2025-04-24 | An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.1… |
CVE-2025-35965 | Medium | 6.5 | 2025-04-24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTask… |
CVE-2025-21605 | High | 7.5 | 2025-04-23 | Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimite… |
CVE-2025-32959 | Medium | 6.5 | 2025-04-22 | CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementation does not restri… |
CVE-2025-32952 | Medium | 6.5 | 2025-04-22 | Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local fil… |
CVE-2025-3734 | Medium | 5.9 | 2025-04-16 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 b… |
CVE-2025-0122 | | 2025-04-11 | A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma… | |
CVE-2024-51461 | Medium | 4.3 | 2025-04-11 | IBM QRadar WinCollect Agent 10.0 through 10.1.13 could allow a remote attacker to cause a denial of service by interrupting an HTTP request that could consume… |
CVE-2025-29917 | Medium | 6.2 | 2025-04-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decode_base64 ke… |
CVE-2025-29916 | Medium | 6.2 | 2025-04-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option… |
CVE-2025-1677 | Medium | 6.5 | 2025-04-10 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of ser… |
CVE-2025-26480 | Medium | 5.3 | 2025-04-10 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.0, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote… |
CVE-2025-32386 | Medium | 6.5 | 2025-04-09 | Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e… |
CVE-2025-3475 | Medium | 6.5 | 2025-04-09 | Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This… |
CVE-2025-32381 | Medium | 6.5 | 2025-04-09 | XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammar… |
CVE-2025-32380 | High | 7.5 | 2025-04-09 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerab… |
CVE-2025-32374 | Medium | 5.9 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted… |
CVE-2025-26682 | High | 7.5 | 2025-04-08 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2025-32025 | | 2025-04-08 | bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for… | |
CVE-2025-32024 | | 2025-04-08 | bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining exc… | |
CVE-2025-32034 | High | 7.5 | 2025-04-07 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1… |
CVE-2025-32032 | High | 7.5 | 2025-04-07 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerab… |
CVE-2025-32031 | High | 7.5 | 2025-04-07 | Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gatew… |
CVE-2025-32030 | High | 7.5 | 2025-04-07 | Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gatew… |
CVE-2025-31496 | High | 7.5 | 2025-04-07 | apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed queries with deeply neste… |
CVE-2025-24317 | Medium | 5.3 | 2025-04-04 | Allocation of resources without limits or throttling issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated a… |
CVE-2025-32049 | High | 7.5 | 2025-04-03 | A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial… |
CVE-2025-27556 | Medium | 5.8 | 2025-04-02 | An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.view… |
CVE-2024-45700 | Medium | 6.5 | 2025-04-02 | Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, whic… |
CVE-2024-10307 | Medium | 4.3 | 2025-03-28 | An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously craft… |
CVE-2025-30350 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior… |
CVE-2025-30225 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior… |
CVE-2025-2559 | Medium | 4.9 | 2025-03-25 | A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens wi… |
CVE-2024-45484 | | 2025-03-25 | An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an un… | |
CVE-2025-1451 | High | 7.5 | 2025-03-20 | A vulnerability in parisneo/lollms-webui v13 arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate t… |
CVE-2025-0315 | High | 7.5 | 2025-03-20 | A vulnerability in ollama/ollama <=0.3.14 allows a malicious user to create a customized GGUF model file, upload it to the Ollama server, and create it. This c… |
CVE-2025-0189 | High | 7.5 | 2025-03-20 | In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket message… |
CVE-2025-0182 | High | 7.5 | 2025-03-20 | A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable versi… |
CVE-2024-9437 | High | 7.5 | 2025-03-20 | SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service (DoS) attack. The vulnerability exists in the resource upload request, where app… |
CVE-2024-9229 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource co… |
CVE-2024-9056 | High | 7.5 | 2025-03-20 | BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-)… |
CVE-2024-8984 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes… |
CVE-2024-8966 | High | 7.5 | 2025-03-20 | A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can appen… |
CVE-2024-8028 | High | 7.5 | 2025-03-20 | A vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By… |
CVE-2024-8018 | High | 7.5 | 2025-03-20 | A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number… |
CVE-2024-7983 | High | 7.5 | 2025-03-20 | In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause… |
CVE-2024-7768 | High | 7.5 | 2025-03-20 | A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET… |
CVE-2024-12778 | High | 7.5 | 2025-03-20 | A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service (DoS) attack. The issue arises when a large number of tracked metrics are retriev… |
CVE-2024-11171 | High | 7.5 | 2025-03-20 | In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipar… |
CVE-2024-10935 | High | 7.5 | 2025-03-20 | automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multi… |
CVE-2024-10714 | High | 7.5 | 2025-03-20 | A vulnerability in binary-husky/gpt_academic version 3.83 allows an attacker to cause a Denial of Service (DoS) by adding excessive characters to the end of a… |
CVE-2024-10713 | High | 7.5 | 2025-03-20 | A vulnerability in szad670401/hyperlpr v3.0 allows for a Denial of Service (DoS) attack. The server fails to handle excessive characters appended to the end of… |
CVE-2024-10650 | High | 7.5 | 2025-03-20 | An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payl… |
CVE-2024-10225 | High | 7.5 | 2025-03-20 | A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a mul… |
CVE-2024-10051 | High | 7.5 | 2025-03-20 | Realchar version v0.0.4 is vulnerable to an unauthenticated denial of service (DoS) attack. The vulnerability exists in the file upload request handling, where… |
CVE-2025-29770 | Medium | 6.5 | 2025-03-19 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vLLM to support struc… |
CVE-2025-29907 | High | 7.5 | 2025-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and den… |
CVE-2025-29786 | High | 7.5 | 2025-03-17 | Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it… |
CVE-2025-1257 | Medium | 6.5 | 2025-03-13 | An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability i… |
CVE-2024-13054 | Medium | 6.5 | 2025-03-13 | An issue was discovered in GitLab CE/EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. where a denial of service vulnera… |
CVE-2025-20209 | High | 7.5 | 2025-03-12 | A vulnerability in the Internet Key Exchange version 2 (IKEv2) function of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent an… |
CVE-2025-20141 | High | 7.4 | 2025-03-12 | A vulnerability in the handling of specific packets that are punted from a line card to a route processor in Cisco IOS XR Software Release 7.9.2 could allow an… |
CVE-2025-21866 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC Erhar… |
CVE-2024-58089 | High | 7.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double accounting race when btrfs_run_delalloc_range() failed [BUG] When runni… |
CVE-2025-27911 | Medium | 6.5 | 2025-03-11 | An issue was discovered in Datalust Seq before 2024.3.13545. Expansion of identifiers in message templates can be used to bypass the system "Event body limit b… |
CVE-2025-27795 | Medium | 4.3 | 2025-03-07 | ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits. |
CVE-2024-57972 | Medium | 6.5 | 2025-03-06 | The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) through 10.0.22621.1… |
CVE-2025-26699 | Medium | 5.0 | 2025-03-06 | An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter… |
CVE-2025-27513 | High | 7.5 | 2025-03-05 | OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when… |
CVE-2025-27219 | Medium | 5.8 | 2025-03-04 | In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method do… |
CVE-2025-27419 | High | 7.5 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS) vulnerability exists in WeGIA. This v… |
CVE-2025-26466 | Medium | 5.9 | 2025-02-28 | A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of p… |
CVE-2025-22273 | | 2025-02-28 | Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword"… | |
CVE-2025-27157 | Medium | 5.3 | 2025-02-27 | Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `… |
CVE-2025-22869 | High | 7.5 | 2025-02-26 | SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at… |
CVE-2025-27144 | | 2025-02-24 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSO… | |
CVE-2023-51339 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Event Ticketing System v1.0 allows attackers to send an excessive amount of email for a… |
CVE-2024-46933 | High | 7.7 | 2025-02-20 | An issue was discovered in Atos Eviden BullSequana XH2140 BMC before C4EM-125: OMF_C4E 101.05.0014. Some BullSequana XH products were shipped without proper ha… |
CVE-2023-51334 | Medium | 5.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cinema Booking System v1.0 allows attackers to send an excessive amount of email for a l… |
CVE-2023-51310 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amo… |
CVE-2023-51309 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amount of email for a… |
CVE-2023-51297 | Medium | 6.5 | 2025-02-19 | A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of email for a leg… |
CVE-2024-49589 | Medium | 6.5 | 2025-02-18 | Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument (size). |
CVE-2025-26819 | High | 8.6 | 2025-02-15 | Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections. |
CVE-2025-1059 | High | 7.5 | 2025-02-13 | CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to t… |
CVE-2024-12379 | Medium | 6.5 | 2025-02-12 | A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an at… |
CVE-2025-25186 | Medium | 6.5 | 2025-02-10 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0… |
CVE-2025-21690 | Medium | 5.5 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persis… |