CWE-770 · Allocation of Resources Without Limits or Throttling (page 5)
Page 5 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-68075 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Broke… |
CVE-2026-67592 | High | 7.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-67591 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proto… |
CVE-2026-67555 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-67553 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proto… |
CVE-2026-66277 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-66275 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proto… |
CVE-2026-68074 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apac… |
CVE-2026-68060 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects… |
CVE-2026-67588 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apac… |
CVE-2026-67465 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apac… |
CVE-2026-66257 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apac… |
CVE-2026-68494 | | 2026-08-04 | The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is inco… | |
CVE-2026-67199 | Medium | 6.5 | 2026-08-04 | Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted e… |
CVE-2026-18401 | | 2026-08-04 | The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 cha… | |
CVE-2026-69152 | High | 7.5 | 2026-08-03 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not appl… |
CVE-2026-69079 | | 2026-08-03 | CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-contr… | |
CVE-2026-13586 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS befor… |
CVE-2026-58063 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS b… |
CVE-2026-20482 | Medium | 6.5 | 2026-08-03 | In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote (proximal/adjacent) denial of service with no additi… |
CVE-2026-59648 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before… |
CVE-2026-59647 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73… |
CVE-2026-15055 | High | 8.2 | 2026-08-03 | In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS befor… |
CVE-2025-71401 | Medium | 5.9 | 2026-08-02 | better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker a… |
CVE-2026-55734 | High | 7.5 | 2026-08-01 | Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom… |
CVE-2026-55733 | High | 7.5 | 2026-08-01 | Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary… |
CVE-2026-54894 | High | 7.5 | 2026-08-01 | Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary… |
CVE-2026-67353 | Medium | 5.3 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no siz… |
CVE-2026-67317 | High | 7.5 | 2026-08-01 | axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be de… |
CVE-2026-67297 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attacker… |
CVE-2026-55497 | Medium | 6.5 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but… |
CVE-2026-14539 | High | 7.5 | 2026-07-31 | An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauth… |
CVE-2026-12733 | High | 7.5 | 2026-07-30 | IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations. |
CVE-2026-16308 | High | 7.5 | 2026-07-30 | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of servic… |
CVE-2026-11897 | High | 7.5 | 2026-07-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A rem… |
CVE-2026-18362 | Medium | 5.9 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. |
CVE-2026-16971 | Medium | 5.9 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. |
CVE-2026-67437 | High | 7.5 | 2026-07-29 | OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2… |
CVE-2026-67432 | High | 7.5 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the… |
CVE-2026-67430 | Medium | 5.3 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the… |
CVE-2026-63119 | Medium | 6.2 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client… |
CVE-2026-15975 | High | 7.5 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-59899 | High | 7.5 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of… |
CVE-2026-15144 | High | 7.3 | 2026-07-29 | @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a… |
CVE-2026-54638 | High | 7.5 | 2026-07-28 | gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled da… |
CVE-2026-54609 | High | 8.6 | 2026-07-28 | QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQ… |
CVE-2026-54345 | High | 7.5 | 2026-07-28 | gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fi… |
CVE-2026-54332 | High | 7.5 | 2026-07-28 | gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attack… |
CVE-2026-61609 | High | 7.5 | 2026-07-28 | Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::conf… |
CVE-2026-47483 | High | 8.2 | 2026-07-28 | NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption… |
CVE-2026-65624 | | 2026-07-28 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process… | |
CVE-2026-59248 | | 2026-07-28 | Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulner… | |
CVE-2026-64646 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.j… |
CVE-2026-59251 | High | 7.5 | 2026-07-27 | Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service… |
CVE-2026-42792 | High | 7.5 | 2026-07-27 | Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erla… |
CVE-2026-10600 | Medium | 4.3 | 2026-07-27 | Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side do… |
CVE-2026-58389 | High | 7.5 | 2026-07-27 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are… |
CVE-2026-55968 | High | 7.5 | 2026-07-27 | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects A… |
CVE-2026-45112 | High | 7.5 | 2026-07-27 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0… |
CVE-2026-66037 | Medium | 6.5 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated a… |
CVE-2026-25800 | High | 7.5 | 2026-07-23 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembl… |
CVE-2026-16756 | High | 7.5 | 2026-07-23 | Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might a… |
CVE-2026-44909 | High | 7.5 | 2026-07-23 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-co… |
CVE-2026-8287 | Medium | 4.3 | 2026-07-23 | Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software all… |
CVE-2026-14257 | High | 7.5 | 2026-07-23 | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (d… |
CVE-2026-13076 | Medium | 6.5 | 2026-07-22 | An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversi… |
CVE-2026-13075 | Medium | 6.5 | 2026-07-22 | An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregat… |
CVE-2026-13074 | Medium | 5.3 | 2026-07-22 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello… |
CVE-2026-13069 | Medium | 6.5 | 2026-07-22 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payloa… |
CVE-2026-65650 | Medium | 4.3 | 2026-07-22 | Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload. |
CVE-2026-11622 | High | 7.5 | 2026-07-22 | A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to b… |
CVE-2026-47013 | Medium | 5.3 | 2026-07-21 | Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Easily exploitable vulnerability allows… |
CVE-2026-42397 | Medium | 6.5 | 2026-07-21 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-15957 | High | 7.5 | 2026-07-21 | Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for R… |
CVE-2026-59848 | Medium | 5.3 | 2026-07-21 | A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded… |
CVE-2026-55831 | High | 7.5 | 2026-07-21 | Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decode… |
CVE-2026-53596 | Medium | 5.3 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforc… |
CVE-2026-48824 | Medium | 5.3 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB… |
CVE-2026-45713 | High | 7.5 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maxi… |
CVE-2026-45712 | Medium | 5.9 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets m… |
CVE-2026-63750 | Medium | 5.3 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffe… |
CVE-2026-15588 | Medium | 5.3 | 2026-07-20 | A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforc… |
CVE-2025-71396 | Medium | 6.5 | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions w… |
CVE-2026-54490 | | 2026-07-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket… | |
CVE-2026-50274 | High | 7.5 | 2026-07-17 | Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing… |
CVE-2026-50272 | High | 7.5 | 2026-07-17 | dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentra… |
CVE-2026-50271 | High | 7.5 | 2026-07-17 | Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage H… |
CVE-2026-44891 | High | 7.5 | 2026-07-17 | Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp… |
CVE-2026-55254 | Medium | 4.8 | 2026-07-17 | NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs permi… |
CVE-2026-54465 | High | 7.5 | 2026-07-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a… |
CVE-2026-54464 | | 2026-07-17 | ### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are lar… | |
CVE-2026-54463 | High | 7.5 | 2026-07-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a len… |
CVE-2026-48504 | Medium | 5.3 | 2026-07-17 | OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforc… |
CVE-2026-49835 | Medium | 5.9 | 2026-07-17 | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.UR… |
CVE-2026-48045 | Medium | 6.5 | 2026-07-17 | Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC… |
CVE-2026-47184 | Medium | 6.5 | 2026-07-17 | Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _… |
CVE-2026-50273 | High | 7.5 | 2026-07-17 | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagatio… |
CVE-2026-49209 | Medium | 6.5 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iter… |
CVE-2026-15007 | | 2026-07-17 | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a repo… | |
CVE-2026-62210 | Medium | 6.5 | 2026-07-17 | OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker r… |