CWE-770 · Allocation of Resources Without Limits or Throttling (page 8)
Page 8 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14525 | Medium | 6.4 | 2026-01-26 | A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive… |
CVE-2026-1224 | Medium | 4.9 | 2026-01-26 | Tanium addressed an uncontrolled resource consumption vulnerability in Discover. |
CVE-2021-47895 | High | 7.5 | 2026-01-23 | Nsauditor 3.2.2.0 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Event Description field with a l… |
CVE-2021-47894 | High | 7.5 | 2026-01-23 | Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the application by creating an oversized buff… |
CVE-2021-47893 | High | 7.5 | 2026-01-23 | AgataSoft PingMaster Pro 2.1 contains a denial of service vulnerability in the Trace Route feature that allows attackers to crash the application by overflowin… |
CVE-2025-67221 | High | 7.5 | 2026-01-22 | The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents. |
CVE-2026-1102 | Medium | 5.3 | 2026-01-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allow… |
CVE-2025-13927 | High | 7.5 | 2026-01-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allow… |
CVE-2026-24006 | High | 7.5 | 2026-01-22 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of ob… |
CVE-2026-23963 | Medium | 4.3 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum… |
CVE-2026-23962 | High | 7.5 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the ma… |
CVE-2026-23957 | High | 7.5 | 2026-01-22 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded… |
CVE-2025-68138 | Medium | 4.7 | 2026-01-21 | EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, po… |
CVE-2025-68136 | High | 7.4 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Sessi… |
CVE-2021-47877 | High | 7.5 | 2026-01-21 | GeoGebra Graphing Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the application by inputting an oversized buff… |
CVE-2021-47876 | High | 7.5 | 2026-01-21 | GeoGebra Classic 5.0.631.0-d contains a denial of service vulnerability in the input field that allows attackers to crash the application by sending oversized… |
CVE-2021-47875 | Critical | 9.8 | 2026-01-21 | GeoGebra CAS Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the application by generating a large buffer overfl… |
CVE-2021-47865 | High | 7.5 | 2026-01-21 | ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FTP connections. Atta… |
CVE-2025-68133 | High | 7.4 | 2026-01-21 | EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to termina… |
CVE-2026-21696 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Win… |
CVE-2025-69199 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack prop… |
CVE-2025-11044 | Medium | 6.8 | 2026-01-19 | An Allocation of Resources Without Limits or Throttling vulnerability in the ANSL-Server component of B&R Automation Runtime versions prior to 6.5 and prior to… |
CVE-2026-23490 | High | 7.5 | 2026-01-16 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-… |
CVE-2025-14435 | Medium | 6.8 | 2026-01-16 | Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users t… |
CVE-2025-14822 | Low | 3.1 | 2026-01-16 | Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources v… |
CVE-2021-47793 | High | 7.5 | 2026-01-16 | Telegram Desktop 2.9.2 contains a denial of service vulnerability that allows attackers to crash the application by sending an oversized message payload. Attac… |
CVE-2021-47791 | High | 7.5 | 2026-01-16 | SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that allow attackers to crash the application through specific input manipulati… |
CVE-2026-22045 | Medium | 5.9 | 2026-01-15 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic… |
CVE-2026-22803 | High | 7.5 | 2026-01-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function… |
CVE-2021-47784 | High | 7.5 | 2026-01-15 | Cyberfox Web Browser 52.9.1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the search bar with excess… |
CVE-2021-47771 | Medium | 5.5 | 2026-01-15 | RDP Manager 4.9.9.3 contains a denial of service vulnerability in connection input fields that allows local attackers to crash the application. Attackers can a… |
CVE-2021-47752 | High | 7.5 | 2026-01-15 | AWebServer GhostBuilding 18 contains a denial of service vulnerability that allows remote attackers to overwhelm the server by sending multiple concurrent HTTP… |
CVE-2026-0897 | High | 7.5 | 2026-01-15 | Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote… |
CVE-2026-22917 | Medium | 4.3 | 2026-01-15 | Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service. |
CVE-2026-22036 | Medium | 5.9 | 2026-01-14 | Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize… |
CVE-2026-0543 | Medium | 6.5 | 2026-01-13 | Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted e… |
CVE-2026-0531 | Medium | 6.5 | 2026-01-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrie… |
CVE-2026-0530 | Medium | 6.5 | 2026-01-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. Th… |
CVE-2025-37166 | High | 7.5 | 2026-01-13 | A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-re… |
CVE-2024-58339 | High | 7.5 | 2026-01-12 | LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEn… |
CVE-2026-22773 | Medium | 6.5 | 2026-01-10 | vLLM is an inference and serving engine for large language models (LLMs). In versions from 0.6.4 to before 0.12.0, users can crash the vLLM engine serving mult… |
CVE-2026-22025 | Low | 3.7 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-10569 | Medium | 6.5 | 2026-01-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowe… |
CVE-2025-50334 | High | 7.5 | 2026-01-08 | An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component |
CVE-2025-68151 | High | 7.5 | 2026-01-08 | CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-… |
CVE-2025-66560 | Medium | 5.9 | 2026-01-07 | Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exist… |
CVE-2025-66838 | Medium | 6.5 | 2026-01-07 | In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unr… |
CVE-2025-15474 | | 2026-01-07 | AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy… | |
CVE-2020-36907 | High | 7.5 | 2026-01-06 | Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Atta… |
CVE-2025-69229 | Medium | 5.3 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excess… |
CVE-2025-69228 | High | 7.5 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an A… |
CVE-2025-69223 | High | 7.5 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against… |
CVE-2025-68456 | Critical | 9.1 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger databa… |
CVE-2025-64422 | Medium | 4.3 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /logi… |
CVE-2025-57705 | Medium | 4.9 | 2026-01-02 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker… |
CVE-2025-47208 | Medium | 6.5 | 2026-01-02 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker… |
CVE-2025-68272 | High | 7.5 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an una… |
CVE-2022-50799 | High | 7.5 | 2025-12-30 | Fetch FTP Client 5.8.2 contains a denial of service vulnerability that allows attackers to trigger 100% CPU consumption by sending long server responses. Attac… |
CVE-2022-50695 | High | 7.5 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to arbitrary hosts throu… |
CVE-2025-68148 | Medium | 4.3 | 2025-12-27 | FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to… |
CVE-2025-11419 | High | 7.5 | 2025-12-23 | A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2… |
CVE-2021-47713 | High | 7.5 | 2025-12-22 | Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with exces… |
CVE-2025-14299 | Medium | 6.5 | 2025-12-20 | The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on th… |
CVE-2025-68390 | Medium | 4.9 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Exces… |
CVE-2025-68389 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130… |
CVE-2025-68388 | Medium | 5.3 | 2025-12-18 | Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory an… |
CVE-2025-68384 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CA… |
CVE-2025-14466 | Medium | 5.3 | 2025-12-16 | A vulnerability in the web interface of the Güralp Fortimus Series, Minimus Series and Certimus Series allows an unauthenticated attacker with network access t… |
CVE-2025-68156 | High | 7.5 | 2025-12-16 | Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`… |
CVE-2025-64702 | Medium | 5.3 | 2025-12-11 | quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 clien… |
CVE-2025-4097 | Medium | 6.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allo… |
CVE-2025-14157 | Medium | 6.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 6.3 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowe… |
CVE-2025-12562 | High | 7.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allo… |
CVE-2025-66473 | High | 7.5 | 2025-12-10 | XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which… |
CVE-2025-9368 | | 2025-12-09 | A security issue exists within 432ES-IG3 Series A, which affects GuardLink® EtherNet/IP Interface, resulting in denial-of-service. A manual power cycle is requ… | |
CVE-2025-41694 | Medium | 6.5 | 2025-12-09 | A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resu… |
CVE-2025-41693 | Medium | 4.3 | 2025-12-09 | A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a r… |
CVE-2025-36140 | Medium | 6.5 | 2025-12-08 | IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resource… |
CVE-2025-48569 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additiona… |
CVE-2025-48615 | High | 7.8 | 2025-12-08 | In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalatio… |
CVE-2025-48603 | Medium | 5.5 | 2025-12-08 | In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of serv… |
CVE-2025-66418 | High | 7.5 | 2025-12-05 | urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbo… |
CVE-2025-12385 | | 2025-12-03 | Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS… | |
CVE-2025-63402 | Medium | 5.5 | 2025-12-03 | An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the n… |
CVE-2025-13751 | Medium | 5.5 | 2025-12-03 | Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the… |
CVE-2025-65113 | Medium | 6.5 | 2025-11-29 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerability in the AJAX flagging system allows… |
CVE-2025-64334 | High | 7.5 | 2025-11-26 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 t… |
CVE-2025-7449 | Medium | 6.5 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowe… |
CVE-2025-12571 | High | 7.5 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allo… |
CVE-2025-65942 | Low | 2.7 | 2025-11-25 | VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8… |
CVE-2025-62426 | Medium | 6.5 | 2025-11-21 | vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints… |
CVE-2025-58181 | Medium | 5.3 | 2025-11-19 | SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded m… |
CVE-2025-11243 | | 2025-11-19 | Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM (before v1.6) allows Excessive Allocation via network. | |
CVE-2025-65015 | High | 7.5 | 2025-11-18 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1… |
CVE-2025-54320 | Medium | 4.3 | 2025-11-18 | In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated… |
CVE-2025-13165 | High | 7.5 | 2025-11-17 | EasyFlow GP developed by Digiwin has a Denial of service vulnerability, allowing unauthenticated remote attackers to send specific requests that result in deni… |
CVE-2025-59089 | Medium | 5.9 | 2025-11-12 | If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcpr… |
CVE-2025-12748 | Medium | 5.5 | 2025-11-11 | A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A m… |
CVE-2025-64529 | Medium | 6.5 | 2025-11-10 | SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the e… |
CVE-2025-64509 | High | 7.5 | 2025-11-10 | Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive C… |