CWE-770
2,664 CVEs • Abstraction: Base • Likelihood of Exploit: High
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVEs (2,664)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
3Debian EnvoyproxyRedhat3Debian Linux EnvoyOpenshift Service MeshOct 2, 2026 Mar 4, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks. |
In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumpti...Show more |
1Ibm 1Websphere Application Server Jun 17, 2026 Jan 31, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consu...Show more |
HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3. |
HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 0.10.3. |
IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port. |
1Codesys 15Control For Beaglebone Control For Empc A/imx6Control For Iot2000+12 moreJun 17, 2026 Jan 24, 2020 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition. |
2Oracle Vt4Communications Services Gatekeeper CryptacularWebcenter Sites+1 moreJun 17, 2026 Jan 24, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new...Show more |
2Gnu Opensuse3Backports LeapLibredwgJun 17, 2026 Jan 8, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c. |
2Fedoraproject Thekelleys2Dnsmasq FedoraJun 17, 2026 Jan 7, 2020 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors involving DHCP response creation. |
An attempted excessive memory allocation was discovered in Mat_VarRead5 in mat5.c in matio 1.5.17. |
2Gnu Opensuse3Backports Sle LeapLibredwgJun 17, 2026 Dec 27, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in dwg.spec. |
2Gnu Opensuse3Backports Sle LeapLibredwgJun 17, 2026 Dec 27, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in decode_3dsolid in dwg.spec. |
2Gnu Opensuse3Backports Sle LeapLibredwgJun 17, 2026 Dec 27, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_HATCH_private in dwg.spec. |
2Gnu Opensuse3Backports Sle LeapLibredwgJun 17, 2026 Dec 27, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_SPLINE_private in dwg.spec. |
In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an integer signedness issue that could lead to an attempted excessive memory allocation and denial of service. |
In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than the...Show more |
In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for resource exhaustion or denial of service. |
GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments. |
2Apache Oracle4Commerce Guided Search CxfFlexcube Private Banking+1 moreJun 17, 2026 Nov 6, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a mess...Show more |