CWE-770 · Allocation of Resources Without Limits or Throttling (page 3)
Page 3 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9140 | | 2026-07-14 | A denial-of-service security issue exists in the 1719-AENTR. The security issue stems from improper handling of a UDP unicast network storm, which causes the d… | |
CVE-2026-10573 | | 2026-07-14 | A denial-of-service security issue exists in 1734 POINT I/O™ module. The security issue stems from improper handling of crafted CIP messages, which can cause t… | |
CVE-2026-54429 | High | 7.4 | 2026-07-14 | A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network traffic… |
CVE-2026-59246 | | 2026-07-14 | Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial… | |
CVE-2026-58229 | | 2026-07-14 | Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of… | |
CVE-2026-58488 | | 2026-07-13 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attackers to circumvent the rate-limiting of… | |
CVE-2026-61465 | Low | 3.3 | 2026-07-11 | ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker ca… |
CVE-2026-57220 | High | 7.5 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assemb… |
CVE-2026-57212 | High | 7.7 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies… |
CVE-2026-59161 | High | 7.5 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRow… |
CVE-2026-54063 | High | 7.5 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/… |
CVE-2026-53653 | | 2026-07-10 | Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image… | |
CVE-2026-58661 | Medium | 4.3 | 2026-07-10 | n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-reques… |
CVE-2026-56309 | Medium | 5.4 | 2026-07-10 | Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readabl… |
CVE-2026-56814 | | 2026-07-10 | Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all cons… | |
CVE-2026-40006 | High | 7.5 | 2026-07-10 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability i… |
CVE-2026-60108 | High | 7.5 | 2026-07-09 | Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process t… |
CVE-2026-12590 | Low | 3.7 | 2026-07-09 | Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an un… |
CVE-2026-31984 | High | 7.5 | 2026-07-09 | A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on inp… |
CVE-2026-49866 | High | 7.5 | 2026-07-08 | libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwant… |
CVE-2026-55575 | | 2026-07-08 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a… | |
CVE-2026-14362 | Medium | 4.9 | 2026-07-08 | HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network ac… |
CVE-2026-59873 | High | 7.5 | 2026-07-08 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry coun… |
CVE-2026-59870 | Medium | 5.3 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addI… |
CVE-2026-59868 | Medium | 5.3 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document w… |
CVE-2026-49146 | High | 7.5 | 2026-07-08 | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy f… |
CVE-2026-60001 | Medium | 6.5 | 2026-07-08 | sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. |
CVE-2026-60000 | Low | 3.7 | 2026-07-08 | sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthT… |
CVE-2026-55078 | Medium | 6.5 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8… |
CVE-2026-55434 | Medium | 6.5 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI B… |
CVE-2026-56811 | High | 7.5 | 2026-07-07 | Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attacker to ca… |
CVE-2026-42145 | Low | 3.1 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http… |
CVE-2026-41899 | Medium | 6.5 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authenti… |
CVE-2026-55646 | Medium | 6.5 | 2026-07-06 | vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call r… |
CVE-2026-42546 | Low | 3.8 | 2026-07-06 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2026-13698 | High | 7.5 | 2026-07-06 | A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 clie… |
CVE-2026-56810 | | 2026-07-06 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked… | |
CVE-2026-11586 | High | 7.5 | 2026-07-03 | By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious… |
CVE-2026-58465 | High | 7.5 | 2026-07-02 | Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows una… |
CVE-2026-11946 | High | 7.5 | 2026-07-02 | An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest… |
CVE-2026-9563 | High | 7.5 | 2026-07-02 | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consum… |
CVE-2026-33592 | High | 7.5 | 2026-07-02 | An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is… |
CVE-2026-54428 | High | 7.5 | 2026-07-01 | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allow… |
CVE-2026-56150 | Medium | 6.5 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacke… |
CVE-2026-56149 | Medium | 4.9 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user wi… |
CVE-2026-49087 | Medium | 6.5 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-20216 | High | 7.5 | 2026-07-01 | A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected devic… |
CVE-2026-14330 | Medium | 5.5 | 2026-07-01 | Multiple unbounded alloca() calls in the PulseAudio protocol server. |
CVE-2025-36319 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to cause a temporary denial using a specially crafted HTTP request d… |
CVE-2026-57080 | High | 7.5 | 2026-06-30 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _proc… |
CVE-2026-12818 | | 2026-06-30 | Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service. | |
CVE-2026-53426 | | 2026-06-29 | Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parse_document/2 accepts a {:json, json… | |
CVE-2025-32423 | | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vuln… | |
CVE-2025-32394 | | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vuln… | |
CVE-2026-48933 | High | 7.5 | 2026-06-26 | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all su… |
CVE-2026-13322 | Low | 3.8 | 2026-06-26 | A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input in… |
CVE-2026-54448 | Medium | 6.5 | 2026-06-25 | Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no… |
CVE-2026-54037 | Medium | 6.5 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-7105 added forkIpLimiter and forkUserLimit… |
CVE-2026-54024 | Medium | 6.5 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 (commit bb58a2d0) added limits: { fi… |
CVE-2026-40211 | Medium | 5.3 | 2026-06-25 | An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed a… |
CVE-2026-12760 | Medium | 6.5 | 2026-06-24 | A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented pa… |
CVE-2026-49851 | High | 7.5 | 2026-06-24 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately… |
CVE-2026-54297 | High | 7.5 | 2026-06-24 | Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedPar… |
CVE-2026-11972 | | 2026-06-23 | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take… | |
CVE-2026-46553 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the upload-by-URL path did not enforce NC_ATTACHMENT_FIELD_SIZE against either t… | |
CVE-2026-46551 | Medium | 6.5 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_… |
CVE-2025-61028 | High | 7.5 | 2026-06-23 | An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-54365 | High | 7.5 | 2026-06-23 | Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP… |
CVE-2026-56324 | High | 8.2 | 2026-06-22 | Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the… |
CVE-2026-56255 | Medium | 4.3 | 2026-06-22 | Capgo before 12.128.2 contains a denial of service vulnerability in the POST /app/demo endpoint that allows authenticated users with org write permissions to c… |
CVE-2026-48515 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's multi-dimensional array formatters read dimension lengt… |
CVE-2026-48514 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatterBase<T>.Deserialize reads an attacker-controlled byteLeng… |
CVE-2026-48510 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it… |
CVE-2026-39904 | Medium | 6.5 | 2026-06-22 | Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a cr… |
CVE-2026-54285 | Medium | 5.3 | 2026-06-22 | opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits whe… |
CVE-2026-54283 | High | 7.5 | 2026-06-22 | Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption wh… |
CVE-2026-54277 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of a… |
CVE-2026-54274 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads… |
CVE-2026-54273 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that… |
CVE-2026-54270 | Medium | 5.3 | 2026-06-22 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns a… |
CVE-2026-42127 | High | 7.5 | 2026-06-22 | The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocati… |
CVE-2024-54178 | Medium | 6.5 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of servi… |
CVE-2026-49337 | Medium | 4.3 | 2026-06-19 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::rea… |
CVE-2025-7737 | High | 8.6 | 2026-06-19 | DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E1090, E1090H: befor… |
CVE-2026-55205 | Medium | 5.3 | 2026-06-18 | Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounde… |
CVE-2026-48990 | Medium | 5.3 | 2026-06-17 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, jo… |
CVE-2026-47774 | High | 7.5 | 2026-06-17 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability i… |
CVE-2026-9675 | High | 7.5 | 2026-06-17 | Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious… |
CVE-2026-12151 | High | 7.5 | 2026-06-17 | Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number o… |
CVE-2026-48779 | High | 7.5 | 2026-06-17 | ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to… |
CVE-2026-27869 | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerabl… | |
CVE-2026-48854 | | 2026-06-15 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash… | |
CVE-2026-48853 | | 2026-06-15 | Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers… | |
CVE-2026-8683 | Medium | 6.5 | 2026-06-15 | Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a maliciou… |
CVE-2026-53522 | Medium | 6.5 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard… |
CVE-2026-50560 | Medium | 5.3 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max he… |
CVE-2026-50011 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregato… |
CVE-2026-48748 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a… |
CVE-2026-46340 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15… |
CVE-2026-45416 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandl… |