CWE-770 · Allocation of Resources Without Limits or Throttling (page 7)
Page 7 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39904 | Medium | 6.5 | 2026-06-22 | Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a cr… |
CVE-2026-54285 | Medium | 5.3 | 2026-06-22 | opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits whe… |
CVE-2026-54283 | High | 7.5 | 2026-06-22 | Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption wh… |
CVE-2026-54277 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of a… |
CVE-2026-54274 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads… |
CVE-2026-54273 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that… |
CVE-2026-54270 | Medium | 5.3 | 2026-06-22 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns a… |
CVE-2026-42127 | High | 7.5 | 2026-06-22 | The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocati… |
CVE-2024-54178 | Medium | 6.5 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of servi… |
CVE-2026-49337 | Medium | 4.3 | 2026-06-19 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::rea… |
CVE-2025-7737 | High | 8.6 | 2026-06-19 | DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E1090, E1090H: befor… |
CVE-2026-55205 | Medium | 5.3 | 2026-06-18 | Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounde… |
CVE-2026-48990 | Medium | 5.3 | 2026-06-17 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, jo… |
CVE-2026-47774 | High | 7.5 | 2026-06-17 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability i… |
CVE-2026-9675 | High | 7.5 | 2026-06-17 | Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious… |
CVE-2026-12151 | High | 7.5 | 2026-06-17 | Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number o… |
CVE-2026-48779 | High | 7.5 | 2026-06-17 | ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to… |
CVE-2026-27869 | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerabl… | |
CVE-2026-48854 | | 2026-06-15 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash… | |
CVE-2026-48853 | | 2026-06-15 | Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers… | |
CVE-2026-8683 | Medium | 6.5 | 2026-06-15 | Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a maliciou… |
CVE-2026-53522 | Medium | 6.5 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard… |
CVE-2026-50560 | Medium | 5.3 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max he… |
CVE-2026-50011 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregato… |
CVE-2026-48748 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a… |
CVE-2026-46340 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15… |
CVE-2026-45416 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandl… |
CVE-2026-49347 | | 2026-06-12 | Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest… | |
CVE-2026-44890 | High | 7.5 | 2026-06-11 | Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final… |
CVE-2026-44250 | High | 7.5 | 2026-06-11 | Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final… |
CVE-2026-53781 | Medium | 4.3 | 2026-06-11 | Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypa… |
CVE-2026-45802 | | 2026-06-11 | FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an a… | |
CVE-2026-44488 | High | 7.5 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limi… |
CVE-2026-7250 | High | 7.5 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certai… |
CVE-2026-53423 | | 2026-06-11 | Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM a… | |
CVE-2026-1500 | Medium | 6.5 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certai… |
CVE-2026-5497 | High | 7.5 | 2026-06-11 | vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMedi… |
CVE-2026-53460 | High | 7.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for ma… |
CVE-2026-46702 | High | 7.5 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets w… |
CVE-2026-46673 | High | 7.5 | 2026-06-10 | Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocat… |
CVE-2026-45664 | Medium | 5.3 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing c… |
CVE-2026-45031 | Medium | 5.3 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check… |
CVE-2026-10740 | Medium | 5.3 | 2026-06-10 | Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service (de… |
CVE-2026-24720 | Medium | 6.5 | 2026-06-10 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, th… |
CVE-2026-41726 | Medium | 6.5 | 2026-06-10 | When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka… |
CVE-2026-41716 | High | 7.5 | 2026-06-10 | Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated… |
CVE-2026-28237 | Medium | 5.5 | 2026-06-09 | Unrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of availability. |
CVE-2026-49955 | Medium | 5.3 | 2026-06-09 | Hermes WebUI before version 0.51.270 contains a resource exhaustion vulnerability that allows unauthenticated remote attackers to degrade service availability… |
CVE-2026-45591 | High | 7.5 | 2026-06-09 | Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-42570 | High | 7.5 | 2026-06-09 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before versi… |
CVE-2026-41851 | Medium | 5.3 | 2026-06-09 | Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation o… |
CVE-2026-41710 | Medium | 5.9 | 2026-06-09 | An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the… |
CVE-2026-41007 | High | 7.5 | 2026-06-09 | Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0… |
CVE-2026-40984 | High | 7.5 | 2026-06-09 | In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: mic… |
CVE-2026-40983 | High | 7.5 | 2026-06-09 | In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Mic… |
CVE-2026-43973 | High | 7.5 | 2026-06-08 | Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 re… |
CVE-2026-45290 | High | 7.5 | 2026-06-05 | Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR3-20260417.085727-30` impacts pub… |
CVE-2026-50589 | Medium | 5.3 | 2026-06-05 | In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and… |
CVE-2026-40898 | Medium | 5.3 | 2026-06-04 | quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client… |
CVE-2026-36499 | Medium | 6.5 | 2026-06-04 | A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to request an excessive numb… |
CVE-2025-46638 | High | 7.5 | 2026-06-04 | Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. An unauthenticated remote attacker could potentially exploit t… |
CVE-2026-44545 | Medium | 5.3 | 2026-06-03 | daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0… |
CVE-2026-48597 | Medium | 5.9 | 2026-06-02 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mi… |
CVE-2026-35202 | | 2026-06-02 | Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass th… | |
CVE-2026-34077 | High | 7.5 | 2026-06-02 | React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potenti… |
CVE-2026-28299 | High | 8.2 | 2026-06-02 | SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due… |
CVE-2026-49754 | | 2026-06-02 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint cl… | |
CVE-2026-48862 | | 2026-06-02 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint cl… | |
CVE-2026-45682 | Medium | 5.1 | 2026-06-02 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMa… |
CVE-2026-45554 | Medium | 5.3 | 2026-06-02 | NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path paramet… |
CVE-2026-49140 | Medium | 4.3 | 2026-06-01 | Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix channel media download handler that allows authenticated room members t… |
CVE-2026-40990 | Medium | 5.7 | 2026-06-01 | OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function… |
CVE-2026-10533 | Medium | 5.0 | 2026-06-01 | A flaw was found in OpenShift Container Platform. Completed pods with restartPolicy: Never do not count toward ResourceQuota pod limits, and Kubernetes events… |
CVE-2026-49361 | High | 7.5 | 2026-06-01 | Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthentica… |
CVE-2026-48187 | Medium | 5.7 | 2026-06-01 | An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion… |
CVE-2026-46599 | High | 7.5 | 2026-05-29 | The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in t… |
CVE-2026-45352 | Medium | 5.3 | 2026-05-29 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbo… |
CVE-2026-44697 | High | 8.6 | 2026-05-29 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decom… |
CVE-2026-49324 | Medium | 4.6 | 2026-05-29 | Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network… |
CVE-2026-45023 | Medium | 5.4 | 2026-05-28 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.59, POST /api/blocks/{b… |
CVE-2026-45292 | Medium | 5.3 | 2026-05-28 | opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1… |
CVE-2026-45078 | Medium | 5.5 | 2026-05-28 | Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and l… |
CVE-2026-48735 | Medium | 5.5 | 2026-05-28 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory u… |
CVE-2026-44247 | Medium | 6.8 | 2026-05-27 | Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on inc… |
CVE-2026-1402 | Medium | 6.5 | 2026-05-27 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain… |
CVE-2026-6053 | Medium | 5.5 | 2026-05-27 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when a specially crafted query is run with range partitioned tabl… |
CVE-2026-1718 | High | 7.1 | 2026-05-27 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service with a specially crafted query when autonomous transactions are e… |
CVE-2025-11482 | High | 7.5 | 2026-05-26 | An Allocation of Resources Without Limits or Throttling vulnerability in the OPC-UA Server used in PPT30 Operating System versions before 1.8.0 may be used by… |
CVE-2026-47067 | High | 7.5 | 2026-05-25 | Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unr… |
CVE-2026-42626 | Medium | 5.9 | 2026-05-22 | HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing). An unauthenticated… |
CVE-2026-44070 | Low | 3.1 | 2026-05-21 | An unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial… |
CVE-2026-8488 | Medium | 4.3 | 2026-05-20 | Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVE… |
CVE-2026-8486 | Medium | 5.3 | 2026-05-20 | Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automatio… |
CVE-2026-8469 | | 2026-05-20 | Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom ta… | |
CVE-2026-3039 | High | 7.5 | 2026-05-20 | BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processi… |
CVE-2026-9064 | High | 7.5 | 2026-05-20 | A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per L… |
CVE-2026-41292 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options… |
CVE-2025-57798 | Medium | 5.5 | 2026-05-19 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service… |
CVE-2026-45557 | Medium | 5.8 | 2026-05-19 | Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker in control of a domain can cause a vulnerable… |
CVE-2026-33232 | High | 7.5 | 2026-05-19 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vu… |