CWE-770 · Allocation of Resources Without Limits or Throttling (page 2)
Page 2 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-67353 | Medium | 5.3 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no siz… |
CVE-2026-67317 | | 2026-08-01 | axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be de… | |
CVE-2026-67297 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attacker… |
CVE-2026-55497 | Medium | 6.5 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but… |
CVE-2026-14539 | High | 7.5 | 2026-07-31 | An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauth… |
CVE-2026-12733 | High | 7.5 | 2026-07-30 | IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations. |
CVE-2026-16308 | High | 7.5 | 2026-07-30 | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of servic… |
CVE-2026-11897 | High | 7.5 | 2026-07-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A rem… |
CVE-2026-18362 | Medium | 5.9 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. |
CVE-2026-16971 | Medium | 5.9 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. |
CVE-2026-67437 | High | 7.5 | 2026-07-29 | OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2… |
CVE-2026-67432 | High | 7.5 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the… |
CVE-2026-67430 | Medium | 5.3 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the… |
CVE-2026-63119 | Medium | 6.2 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client… |
CVE-2026-15975 | High | 7.5 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-59899 | High | 7.5 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of… |
CVE-2026-15144 | High | 7.3 | 2026-07-29 | @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a… |
CVE-2026-54638 | High | 7.5 | 2026-07-28 | gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled da… |
CVE-2026-54609 | High | 8.6 | 2026-07-28 | QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQ… |
CVE-2026-54345 | High | 7.5 | 2026-07-28 | gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fi… |
CVE-2026-54332 | High | 7.5 | 2026-07-28 | gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attack… |
CVE-2026-61609 | High | 7.5 | 2026-07-28 | Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::conf… |
CVE-2026-47483 | High | 8.2 | 2026-07-28 | NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption… |
CVE-2026-65624 | | 2026-07-28 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process… | |
CVE-2026-59248 | | 2026-07-28 | Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulner… | |
CVE-2026-64646 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.j… |
CVE-2026-59251 | High | 7.5 | 2026-07-27 | Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service… |
CVE-2026-42792 | High | 7.5 | 2026-07-27 | Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erla… |
CVE-2026-10600 | Medium | 4.3 | 2026-07-27 | Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side do… |
CVE-2026-58389 | High | 7.5 | 2026-07-27 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are… |
CVE-2026-55968 | High | 7.5 | 2026-07-27 | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects A… |
CVE-2026-45112 | High | 7.5 | 2026-07-27 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0… |
CVE-2026-66037 | Medium | 6.5 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated a… |
CVE-2026-25800 | High | 7.5 | 2026-07-23 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembl… |
CVE-2026-16756 | High | 7.5 | 2026-07-23 | Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might a… |
CVE-2026-44909 | High | 7.5 | 2026-07-23 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-co… |
CVE-2026-8287 | Medium | 4.3 | 2026-07-23 | Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software all… |
CVE-2026-14257 | High | 7.5 | 2026-07-23 | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (d… |
CVE-2026-13076 | Medium | 6.5 | 2026-07-22 | An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversi… |
CVE-2026-13075 | Medium | 6.5 | 2026-07-22 | An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregat… |
CVE-2026-13074 | Medium | 5.3 | 2026-07-22 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello… |
CVE-2026-13069 | Medium | 6.5 | 2026-07-22 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payloa… |
CVE-2026-65650 | Medium | 4.3 | 2026-07-22 | Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload. |
CVE-2026-11622 | High | 7.5 | 2026-07-22 | A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to b… |
CVE-2026-47013 | Medium | 5.3 | 2026-07-21 | Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Easily exploitable vulnerability allows… |
CVE-2026-42397 | Medium | 6.5 | 2026-07-21 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-15957 | High | 7.5 | 2026-07-21 | Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for R… |
CVE-2026-59848 | Medium | 5.3 | 2026-07-21 | A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded… |
CVE-2026-55831 | High | 7.5 | 2026-07-21 | Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decode… |
CVE-2026-53596 | Medium | 5.3 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforc… |
CVE-2026-48824 | Medium | 5.3 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB… |
CVE-2026-45713 | High | 7.5 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maxi… |
CVE-2026-45712 | Medium | 5.9 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets m… |
CVE-2026-63750 | Medium | 5.3 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffe… |
CVE-2026-15588 | Medium | 5.3 | 2026-07-20 | A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforc… |
CVE-2025-71396 | Medium | 6.5 | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions w… |
CVE-2026-54490 | | 2026-07-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket… | |
CVE-2026-50274 | High | 7.5 | 2026-07-17 | Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing… |
CVE-2026-50272 | High | 7.5 | 2026-07-17 | dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentra… |
CVE-2026-50271 | High | 7.5 | 2026-07-17 | Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage H… |
CVE-2026-44891 | High | 7.5 | 2026-07-17 | Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp… |
CVE-2026-55254 | Medium | 4.8 | 2026-07-17 | NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs permi… |
CVE-2026-54465 | High | 7.5 | 2026-07-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a… |
CVE-2026-54464 | | 2026-07-17 | ### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are lar… | |
CVE-2026-54463 | High | 7.5 | 2026-07-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a len… |
CVE-2026-48504 | Medium | 5.3 | 2026-07-17 | OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforc… |
CVE-2026-49835 | Medium | 5.9 | 2026-07-17 | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.UR… |
CVE-2026-48045 | Medium | 6.5 | 2026-07-17 | Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC… |
CVE-2026-47184 | Medium | 6.5 | 2026-07-17 | Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _… |
CVE-2026-50273 | High | 7.5 | 2026-07-17 | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagatio… |
CVE-2026-49209 | Medium | 6.5 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iter… |
CVE-2026-15007 | | 2026-07-17 | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a repo… | |
CVE-2026-62210 | Medium | 6.5 | 2026-07-17 | OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker r… |
CVE-2026-54340 | High | 7.5 | 2026-07-17 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK d… |
CVE-2026-44453 | High | 7.5 | 2026-07-16 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloc… |
CVE-2026-44433 | Medium | 5.3 | 2026-07-16 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a… |
CVE-2026-55407 | | 2026-07-16 | Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's p… | |
CVE-2026-21729 | High | 7.5 | 2026-07-16 | Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. |
CVE-2026-23538 | High | 7.5 | 2026-07-16 | A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections wit… |
CVE-2026-59762 | High | 7.5 | 2026-07-15 | When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System… |
CVE-2026-13585 | | 2026-07-15 | Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface drive… | |
CVE-2026-46629 | Medium | 6.5 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-cont… |
CVE-2026-49476 | High | 7.5 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory… |
CVE-2026-24271 | Medium | 6.2 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits o… |
CVE-2026-50651 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-50648 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network. |
CVE-2026-50525 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-15711 | High | 7.5 | 2026-07-14 | A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which man… |
CVE-2026-47302 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-59886 | High | 7.5 | 2026-07-14 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact… |
CVE-2026-59200 | High | 7.5 | 2026-07-14 | Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the P… |
CVE-2026-56170 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-50506 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-49788 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network. |
CVE-2026-49787 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. |
CVE-2026-45646 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-62641 | Medium | 4.3 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size. |
CVE-2026-60081 | High | 7.5 | 2026-07-14 | DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data… |
CVE-2026-59204 | High | 7.5 | 2026-07-14 | Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000… |
CVE-2026-12707 | High | 7.5 | 2026-07-14 | Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. … |