CWE-770 · Allocation of Resources Without Limits or Throttling (page 3)
Page 3 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-75808 | | 2026-09-08 | Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition through system memory exh… | |
CVE-2026-82753 | | 2026-09-07 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaus… | |
CVE-2026-86452 | High | 7.5 | 2026-09-07 | Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting… |
CVE-2026-19204 | | 2026-09-07 | A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and pot… | |
CVE-2025-52657 | Low | 3.5 | 2026-09-07 | HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact… |
CVE-2022-51008 | Medium | 5.3 | 2026-09-06 | PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacke… |
CVE-2026-85703 | Medium | 6.5 | 2026-09-04 | A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the… |
CVE-2026-84890 | Medium | 5.9 | 2026-09-04 | undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is… |
CVE-2026-85664 | High | 7.5 | 2026-09-04 | Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthentic… |
CVE-2026-82728 | | 2026-09-04 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cau… | |
CVE-2026-82309 | Medium | 4.3 | 2026-09-04 | Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not b… |
CVE-2026-85584 | High | 7.5 | 2026-09-04 | SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attac… |
CVE-2026-85582 | Medium | 6.5 | 2026-09-04 | SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers… |
CVE-2026-85581 | High | 7.5 | 2026-09-04 | SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled… |
CVE-2026-85450 | High | 7.5 | 2026-09-03 | MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that creates unbounded connections and threads without limit… |
CVE-2026-85449 | High | 7.5 | 2026-09-03 | MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by s… |
CVE-2026-85448 | High | 7.5 | 2026-09-03 | MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing(). A… |
CVE-2026-85447 | High | 7.5 | 2026-09-03 | MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating duration or variable list limits. Attackers can registe… |
CVE-2026-84778 | High | 7.5 | 2026-09-03 | Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions. |
CVE-2026-84776 | High | 7.5 | 2026-09-03 | Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. |
CVE-2026-85107 | Medium | 4.3 | 2026-09-03 | A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/… |
CVE-2026-71224 | Medium | 4.7 | 2026-09-03 | A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk me… |
CVE-2026-71219 | Medium | 4.7 | 2026-09-03 | A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the u… |
CVE-2026-78662 | High | 7.5 | 2026-09-02 | Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, d… |
CVE-2026-56855 | High | 7.5 | 2026-09-02 | Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RF… |
CVE-2026-77121 | Medium | 6.5 | 2026-09-02 | A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes fut… |
CVE-2026-49249 | | 2026-09-02 | Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0… | |
CVE-2026-78588 | Medium | 6.5 | 2026-09-02 | Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker ab… |
CVE-2026-78586 | Medium | 6.5 | 2026-09-02 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-84780 | Medium | 5.3 | 2026-09-02 | Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions. |
CVE-2026-84775 | Medium | 5.3 | 2026-09-02 | Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions. |
CVE-2026-72682 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-72652 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-56143 | Medium | 4.9 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user wi… |
CVE-2026-33465 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-83615 | | 2026-09-01 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, a… | |
CVE-2026-74835 | | 2026-09-01 | The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3… | |
CVE-2026-70399 | | 2026-09-01 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of servi… | |
CVE-2026-55951 | | 2026-09-01 | The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to… | |
CVE-2024-10085 | | 2026-09-01 | CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when… | |
CVE-2026-19472 | | 2026-09-01 | A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embe… | |
CVE-2026-77856 | | 2026-09-01 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom ta… | |
CVE-2026-74837 | | 2026-09-01 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom ta… | |
CVE-2026-71257 | High | 7.5 | 2026-08-31 | Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request… |
CVE-2026-19873 | High | 7.5 | 2026-08-31 | HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repea… |
CVE-2026-81624 | High | 7.5 | 2026-08-31 | Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certa… |
CVE-2026-82722 | | 2026-08-31 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM… | |
CVE-2026-81636 | | 2026-08-30 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL… | |
CVE-2026-82562 | Low | 3.7 | 2026-08-30 | ### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`)… |
CVE-2026-3686 | Medium | 6.2 | 2026-08-28 | IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources. |
CVE-2026-54788 | High | 7.5 | 2026-08-28 | dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses… |
CVE-2026-81285 | High | 7.5 | 2026-08-28 | Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions. |
CVE-2026-58107 | | 2026-08-28 | CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompr… | |
CVE-2026-37736 | High | 7.5 | 2026-08-28 | An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2026-80179 | Medium | 5.9 | 2026-08-28 | A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malfor… |
CVE-2026-59303 | Low | 3.1 | 2026-08-27 | Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud S… |
CVE-2026-59289 | High | 7.5 | 2026-08-27 | Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying reposito… |
CVE-2026-59287 | Medium | 5.9 | 2026-08-27 | Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring f… |
CVE-2026-81699 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory… |
CVE-2026-80212 | High | 7.5 | 2026-08-27 | An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcPa… |
CVE-2026-5680 | High | 7.5 | 2026-08-27 | A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negoti… |
CVE-2026-30073 | High | 7.5 | 2026-08-27 | An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request. |
CVE-2026-30071 | High | 7.5 | 2026-08-27 | An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2026-30070 | High | 7.5 | 2026-08-27 | An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2026-30067 | High | 7.5 | 2026-08-27 | An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a… |
CVE-2026-30063 | High | 7.5 | 2026-08-27 | An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query. |
CVE-2026-30062 | High | 7.5 | 2026-08-27 | An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU. |
CVE-2026-30060 | High | 7.5 | 2026-08-27 | An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration. |
CVE-2026-30059 | High | 7.5 | 2026-08-27 | An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Request message. |
CVE-2026-30057 | High | 7.5 | 2026-08-27 | An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request. |
CVE-2026-30051 | High | 7.5 | 2026-08-27 | An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying… |
CVE-2026-30050 | High | 7.5 | 2026-08-27 | An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS… |
CVE-2026-47891 | Critical | 9.8 | 2026-08-27 | A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7… |
CVE-2026-47885 | High | 7.5 | 2026-08-27 | The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Sprin… |
CVE-2026-47874 | Medium | 5.3 | 2026-08-27 | The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessiv… |
CVE-2026-47859 | Medium | 5.4 | 2026-08-27 | RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet cou… |
CVE-2026-61617 | High | 7.7 | 2026-08-26 | Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforc… |
CVE-2026-79921 | | 2026-08-26 | amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process… | |
CVE-2026-71054 | Medium | 6.5 | 2026-08-26 | Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unaut… |
CVE-2026-26445 | High | 7.5 | 2026-08-26 | stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, which, combined with th… |
CVE-2026-77801 | Medium | 6.5 | 2026-08-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain c… |
CVE-2026-73108 | High | 7.5 | 2026-08-26 | RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the… |
CVE-2026-53965 | | 2026-08-25 | The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads… | |
CVE-2026-55620 | High | 7.5 | 2026-08-25 | eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0… |
CVE-2026-55619 | Medium | 5.3 | 2026-08-25 | eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0… |
CVE-2026-55531 | Medium | 6.5 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize req… |
CVE-2026-63075 | High | 7.5 | 2026-08-25 | Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC… |
CVE-2026-63074 | Medium | 5.9 | 2026-08-25 | Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (fo… |
CVE-2026-79661 | Medium | 6.5 | 2026-08-25 | Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers… |
CVE-2026-77337 | | 2026-08-24 | CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3… | |
CVE-2026-78321 | | 2026-08-24 | The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's interna… | |
CVE-2026-55241 | High | 7.5 | 2026-08-21 | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful… |
CVE-2026-59279 | High | 7.5 | 2026-08-21 | The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not r… |
CVE-2026-59323 | Medium | 5.3 | 2026-08-21 | An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object alloc… |
CVE-2026-67447 | Medium | 5.3 | 2026-08-20 | Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.Rea… |
CVE-2026-64773 | High | 7.5 | 2026-08-20 | An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's d… |
CVE-2026-54389 | Medium | 5.5 | 2026-08-20 | Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by sup… |
CVE-2026-17170 | High | 7.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an allocation size. |
CVE-2026-17163 | High | 7.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an array size field. |
CVE-2026-74836 | | 2026-08-20 | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HT… |