CWE-770 · Allocation of Resources Without Limits or Throttling (page 2)
Page 2 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77633 | High | 7.1 | 2026-09-22 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory use… |
CVE-2026-95666 | Medium | 4.3 | 2026-09-22 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bul… |
CVE-2026-68956 | | 2026-09-22 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeated… | |
CVE-2026-94624 | High | 7.5 | 2026-09-21 | vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a pee… |
CVE-2026-61652 | | 2026-09-21 | Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed comp… | |
CVE-2026-61541 | | 2026-09-21 | Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or foll… | |
CVE-2026-85219 | Low | 3.7 | 2026-09-21 | Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage. |
CVE-2026-61629 | High | 7.5 | 2026-09-21 | nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in… |
CVE-2026-85220 | Low | 3.7 | 2026-09-21 | A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeyp… |
CVE-2026-91866 | High | 7.5 | 2026-09-21 | A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (deni… |
CVE-2026-91865 | High | 7.5 | 2026-09-21 | A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming hug… |
CVE-2026-91864 | High | 7.5 | 2026-09-21 | A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its si… |
CVE-2026-65654 | | 2026-09-21 | github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not appl… | |
CVE-2026-57227 | High | 7.5 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQ… |
CVE-2026-93838 | Medium | 5.9 | 2026-09-18 | SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_R… |
CVE-2026-77528 | Medium | 5.3 | 2026-09-18 | Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessag… |
CVE-2026-57224 | Medium | 6.5 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser i… |
CVE-2026-64847 | | 2026-09-18 | AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool… | |
CVE-2026-91149 | High | 7.5 | 2026-09-18 | A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections t… |
CVE-2026-93688 | High | 7.5 | 2026-09-18 | SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded trans… |
CVE-2026-84447 | High | 7.5 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same… |
CVE-2026-10832 | Medium | 5.9 | 2026-09-18 | A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a special… |
CVE-2026-93491 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single conn… |
CVE-2026-93488 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Int… |
CVE-2026-93572 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP)… |
CVE-2026-93310 | Medium | 5.3 | 2026-09-18 | A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocatio… |
CVE-2026-93309 | Medium | 4.3 | 2026-09-18 | A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a… |
CVE-2026-93308 | Medium | 4.3 | 2026-09-18 | A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing… |
CVE-2026-77281 | Medium | 6.5 | 2026-09-17 | Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and… |
CVE-2026-50277 | High | 7.5 | 2026-09-17 | dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BA… |
CVE-2026-50275 | High | 7.5 | 2026-09-17 | The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distrib… |
CVE-2026-54716 | High | 7.5 | 2026-09-17 | Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targe… |
CVE-2026-50285 | High | 7.5 | 2026-09-17 | Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-control… |
CVE-2026-86040 | High | 7.5 | 2026-09-17 | libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0… |
CVE-2026-87742 | High | 7.5 | 2026-09-17 | A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single… |
CVE-2026-92961 | High | 7.5 | 2026-09-17 | vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary ho… |
CVE-2026-92915 | High | 7.3 | 2026-09-17 | WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables t… |
CVE-2026-25281 | High | 7.4 | 2026-09-17 | Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation. |
CVE-2026-82399 | High | 7.5 | 2026-09-16 | CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/d… |
CVE-2026-81176 | Medium | 5.3 | 2026-09-16 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does… |
CVE-2026-75516 | | 2026-09-16 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start()… | |
CVE-2026-69147 | Medium | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.v… |
CVE-2026-57173 | Medium | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.l… |
CVE-2026-77409 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.dispatch in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in co… | |
CVE-2026-77403 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameM… | |
CVE-2026-85501 | Medium | 5.3 | 2026-09-16 | Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service w… |
CVE-2026-80225 | Medium | 5.3 | 2026-09-16 | In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on… |
CVE-2026-1168 | High | 7.5 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain… |
CVE-2025-14871 | High | 7.5 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain… |
CVE-2026-69218 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS… |
CVE-2026-69203 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_… |
CVE-2026-69202 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received fr… |
CVE-2026-69213 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by… |
CVE-2026-69209 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragm… |
CVE-2026-53941 | | 2026-09-15 | Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.27.0 until… | |
CVE-2026-91990 | High | 7.5 | 2026-09-15 | Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limi… |
CVE-2026-91987 | Medium | 6.5 | 2026-09-15 | atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pri… |
CVE-2026-91970 | Medium | 6.5 | 2026-09-15 | Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migratio… |
CVE-2026-48987 | Medium | 6.5 | 2026-09-15 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends… |
CVE-2026-92078 | Medium | 6.5 | 2026-09-15 | Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92077 | Medium | 6.5 | 2026-09-15 | Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92063 | Medium | 6.5 | 2026-09-15 | Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
CVE-2026-92003 | | 2026-09-15 | Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote direc… | |
CVE-2026-86892 | Medium | 5.5 | 2026-09-14 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be… |
CVE-2026-13260 | High | 7.5 | 2026-09-14 | IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. |
CVE-2026-54247 | Medium | 4.3 | 2026-09-14 | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body… |
CVE-2026-91080 | High | 7.5 | 2026-09-14 | webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sendin… |
CVE-2026-53752 | High | 7.5 | 2026-09-14 | docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResol… |
CVE-2026-50276 | High | 7.5 | 2026-09-14 | dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or… |
CVE-2026-50270 | High | 7.5 | 2026-09-14 | dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or D… |
CVE-2026-57497 | Medium | 5.3 | 2026-09-14 | webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport caps… |
CVE-2026-54156 | High | 7.5 | 2026-09-14 | node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed i… |
CVE-2026-82439 | Critical | 9.8 | 2026-09-14 | Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever rem… |
CVE-2026-11993 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being proc… |
CVE-2026-90584 | Medium | 5.3 | 2026-09-13 | A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draf… |
CVE-2026-90668 | High | 7.5 | 2026-09-13 | The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial… |
CVE-2026-50018 | Medium | 6.5 | 2026-09-11 | Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration… |
CVE-2026-48496 | Medium | 6.2 | 2026-09-11 | OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and pr… |
CVE-2026-54135 | High | 7.5 | 2026-09-11 | AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP serve… |
CVE-2026-87908 | High | 7.5 | 2026-09-11 | multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound… |
CVE-2026-45769 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2… |
CVE-2026-45768 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to ve… |
CVE-2026-45766 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certa… |
CVE-2026-45765 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3… |
CVE-2026-88012 | Medium | 5.3 | 2026-09-10 | Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.res… |
CVE-2026-88878 | Medium | 5.3 | 2026-09-10 | Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transpor… |
CVE-2026-45763 | Medium | 5.9 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to ve… |
CVE-2026-87011 | High | 7.5 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logo… |
CVE-2023-54394 | Medium | 4.3 | 2026-09-09 | PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory syn… |
CVE-2026-53937 | Medium | 6.2 | 2026-09-09 | MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `k… |
CVE-2026-86075 | High | 7.5 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accept… |
CVE-2026-28633 | Medium | 5.5 | 2026-09-08 | In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to… |
CVE-2026-72978 | Medium | 5.9 | 2026-09-08 | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a net… |
CVE-2026-69374 | Medium | 6.5 | 2026-09-08 | Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network. |
CVE-2026-57099 | High | 7.5 | 2026-09-08 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-82075 | High | 7.5 | 2026-09-08 | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network acce… |
CVE-2026-82054 | Medium | 6.5 | 2026-09-08 | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially craft… |
CVE-2026-62649 | High | 7.5 | 2026-09-08 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing… |
CVE-2026-48888 | High | 7.5 | 2026-09-08 | Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before… |
CVE-2026-86513 | Medium | 5.3 | 2026-09-08 | A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file s… |