CWE-770 · Allocation of Resources Without Limits or Throttling (page 8)
Page 8 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2325 | Medium | 4.3 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which… |
CVE-2021-47959 | High | 7.5 | 2026-05-15 | WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batche… |
CVE-2026-44679 | | 2026-05-14 | Tuist is a virtual platform team for Swift app devs. Prior to 1.180.10, the forgot password flow allows an unauthenticated attacker to repeatedly trigger passw… | |
CVE-2026-44216 | High | 7.5 | 2026-05-14 | Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithme… |
CVE-2026-8468 | | 2026-05-14 | Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart… | |
CVE-2026-8280 | Medium | 6.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have al… |
CVE-2026-1659 | High | 7.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have al… |
CVE-2025-14870 | High | 7.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-42561 | High | 7.5 | 2026-05-13 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header p… |
CVE-2026-28383 | Medium | 6.5 | 2026-05-13 | A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user… |
CVE-2026-28376 | Medium | 6.5 | 2026-05-13 | The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-o… |
CVE-2026-8466 | | 2026-05-13 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart… | |
CVE-2026-44248 | Medium | 5.3 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed a… |
CVE-2026-42587 | High | 7.5 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation… |
CVE-2026-42583 | High | 7.5 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size deco… |
CVE-2026-42582 | High | 7.5 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.ha… |
CVE-2026-44579 | High | 7.5 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the… |
CVE-2026-44004 | High | 7.5 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the… |
CVE-2026-44577 | Medium | 5.9 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default ima… |
CVE-2026-41227 | High | 7.5 | 2026-05-13 | On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Man… |
CVE-2026-40629 | High | 7.5 | 2026-05-13 | When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Softwa… |
CVE-2026-40423 | High | 7.5 | 2026-05-13 | When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software ver… |
CVE-2025-32425 | Medium | 5.5 | 2026-05-13 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, th… |
CVE-2026-39803 | High | 7.5 | 2026-05-13 | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. Th… |
CVE-2026-44931 | | 2026-05-13 | The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c in … | |
CVE-2026-8202 | Medium | 4.3 | 2026-05-13 | Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggreg… |
CVE-2026-40902 | High | 7.5 | 2026-05-12 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndR… |
CVE-2026-40863 | High | 7.5 | 2026-05-12 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader… |
CVE-2026-44240 | High | 7.5 | 2026-05-12 | basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline res… |
CVE-2026-44219 | Low | 3.7 | 2026-05-12 | ciguard is a static security auditor for CI/CD pipelines. From 0.6.0 to 0.8.1, both SCA HTTP clients (src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/… |
CVE-2026-42444 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser… |
CVE-2026-23826 | High | 7.5 | 2026-05-12 | A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sendi… |
CVE-2026-41284 | High | 7.5 | 2026-05-12 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10… |
CVE-2026-42006 | Medium | 4.3 | 2026-05-12 | An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this… |
CVE-2026-22925 | High | 7.5 | 2026-05-12 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application is susceptible to resource exhaustion when subjected to… |
CVE-2026-42256 | Medium | 6.5 | 2026-05-09 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0… |
CVE-2026-42294 | High | 7.5 | 2026-05-09 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhoo… |
CVE-2026-42189 | High | 7.5 | 2026-05-08 | Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-inte… |
CVE-2026-44499 | | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows… | |
CVE-2026-42793 | High | 7.5 | 2026-05-08 | Allocation of Resources Without Limits or Throttling vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via atom table exhaust… |
CVE-2026-44500 | Medium | 5.3 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and prior to zebra-network version 6.0.0, se… |
CVE-2026-43329 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of… |
CVE-2025-69233 | Medium | 6.5 | 2026-05-08 | Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platfor… |
CVE-2026-8124 | Low | 3.3 | 2026-05-08 | A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipul… |
CVE-2026-7541 | High | 7.5 | 2026-05-07 | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending cr… |
CVE-2026-39820 | High | 7.5 | 2026-05-07 | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. |
CVE-2026-41685 | Medium | 4.3 | 2026-05-07 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus serve… |
CVE-2026-41648 | Medium | 5.0 | 2026-05-07 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files parse… |
CVE-2025-14341 | High | 8.3 | 2026-05-07 | Improperly controlled modification of Dynamically-Determined object attributes, Allocation of resources without limits or throttling vulnerability in DivvyDriv… |
CVE-2026-41644 | High | 7.1 | 2026-05-07 | monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow in… |
CVE-2026-41484 | Medium | 5.3 | 2026-05-06 | OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP. In versions 1.15.0 and earlier, when a reques… |
CVE-2026-41483 | Medium | 5.9 | 2026-05-06 | OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlier, the AzureVmMetaDataRequestor class m… |
CVE-2026-41310 | Medium | 5.3 | 2026-05-06 | OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts… |
CVE-2026-6860 | Medium | 5.3 | 2026-05-06 | A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the serve… |
CVE-2026-32934 | High | 7.5 | 2026-05-05 | CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory grow… |
CVE-2026-32689 | | 2026-05-05 | Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix allows a denial of service via the long-poll transport's NDJSON… | |
CVE-2025-66369 | High | 7.5 | 2026-05-05 | An issue was discovered in MM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2026-29168 | High | 7.3 | 2026-05-05 | Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data. This issue affects Apache HTTP Serv… |
CVE-2026-42437 | High | 7.5 | 2026-05-05 | OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames w… |
CVE-2026-7776 | High | 7.5 | 2026-05-04 | Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes… |
CVE-2026-7768 | High | 7.5 | 2026-05-04 | @fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenti… |
CVE-2026-42236 | High | 7.5 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client registration endpoint accepted unauthe… |
CVE-2026-42154 | High | 7.5 | 2026-05-04 | Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not v… |
CVE-2026-42440 | High | 7.5 | 2026-05-04 | OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader Versions Affected: before 1.9.5 before 2.5.9 before 3.0.0-M3 … |
CVE-2025-70071 | Medium | 5.9 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray() |
CVE-2025-70069 | High | 7.5 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method |
CVE-2026-6948 | Medium | 4.9 | 2026-05-04 | Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel. This allows a compromised or rogue… |
CVE-2026-42788 | | 2026-05-01 | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated memory exhaustion via oversized HTTP/2 frames. 'El… | |
CVE-2026-42786 | | 2026-05-01 | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. Th… | |
CVE-2026-39804 | | 2026-05-01 | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when… | |
CVE-2026-43507 | Medium | 5.3 | 2026-05-01 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML pars… |
CVE-2025-36122 | Medium | 6.5 | 2026-04-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a… |
CVE-2025-51846 | High | 7.5 | 2026-04-30 | CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a Crypt… |
CVE-2026-42198 | High | 7.5 | 2026-04-29 | pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during… |
CVE-2026-42420 | Medium | 4.3 | 2026-04-28 | OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exp… |
CVE-2026-41408 | Medium | 4.3 | 2026-04-28 | OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup op… |
CVE-2026-41400 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. R… |
CVE-2026-41399 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network… |
CVE-2026-32688 | High | 7.5 | 2026-04-27 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table ex… |
CVE-2026-42039 | High | 7.5 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit… |
CVE-2026-42036 | Medium | 5.3 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response s… |
CVE-2026-42034 | Medium | 5.3 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedi… |
CVE-2026-21728 | High | 7.5 | 2026-04-24 | Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mit… |
CVE-2026-41324 | High | 7.5 | 2026-04-24 | basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory… |
CVE-2026-41309 | High | 8.2 | 2026-04-24 | Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An a… |
CVE-2026-41173 | Medium | 5.9 | 2026-04-23 | The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTelemetry.Sampler.AWS… |
CVE-2026-41078 | Medium | 5.9 | 2026-04-23 | OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the int… |
CVE-2026-34062 | Medium | 5.3 | 2026-04-22 | nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `MessageCodec::read_request` and `read_response` call `read_to_end()` o… |
CVE-2026-1660 | Medium | 6.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certai… |
CVE-2025-6016 | Medium | 6.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have al… |
CVE-2025-3922 | Medium | 6.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have a… |
CVE-2025-0186 | Medium | 6.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have a… |
CVE-2026-33595 | Medium | 5.3 | 2026-04-22 | A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not prop… |
CVE-2026-33594 | Medium | 5.3 | 2026-04-22 | A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate int… |
CVE-2026-33254 | Medium | 5.3 | 2026-04-22 | An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service… |
CVE-2026-33260 | Medium | 5.3 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server… |
CVE-2026-33258 | Medium | 5.3 | 2026-04-22 | By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches. |
CVE-2026-33257 | Medium | 5.3 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server… |
CVE-2026-33256 | Medium | 5.3 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server… |
CVE-2026-22018 | Low | 3.7 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported ver… |