Allocation of Resources Without Limits or Throttling
CWE-770
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
We track 1,118 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7. 2 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
- Architecture and Design: Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
- Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
Latest Allocation of Resources Without Limits or Throttling vulnerabilities
- 7.5 High severity
stangirard/quivr: Allocation of Resources Without Limits or Throttling
A Denial of Service (DoS) vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource consumption by appending characters to the end of a multipart boundary in an HTTP request. This leads t
- 7.5 High severity
bentoml/bentoml: Allocation of Resources Without Limits or Throttling
BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. This causes the server to continuously process
- 7.5 High severity
berriai/litellm: Allocation of Resources Without Limits or Throttling
A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each ch
- 7.5 High severity
gradio-app/gradio: Allocation of Resources Without Limits or Throttling
A vulnerability in the file upload process of gradio-app/gradio version @gradio/[email protected] allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously
- 7.5 High severity
danswer-ai/danswer: Allocation of Resources Without Limits or Throttling
A vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously
- 7.5 High severity
imartinez/privategpt: Allocation of Resources Without Limits or Throttling
A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these charact
- 7.5 High severity
open-webui/open-webui: Allocation of Resources Without Limits or Throttling
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes
- 7.5 High severity
h2oai/h2o-3: Allocation of Resources Without Limits or Throttling
A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeat
- 7.5 High severity
aimhubio/aim: Allocation of Resources Without Limits or Throttling
A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service (DoS) attack. The issue arises when a large number of tracked metrics are retrieved simultaneously from the Aim web API, causing the web server to become unresponsive. The root cause
- 7.5 High severity
danny-avila/librechat: Allocation of Resources Without Limits or Throttling
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage (the default setting for multer), there is no limit on t
- 7.5 High severity
automatic1111/stable-diffusion-webui: Allocation of Resources Without Limits or Throttling
automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary ch
- 7.5 High severity
binary-husky/gpt_academic: Allocation of Resources Without Limits or Throttling
A vulnerability in binary-husky/gpt_academic version 3.83 allows an attacker to cause a Denial of Service (DoS) by adding excessive characters to the end of a multipart boundary during file upload. This results in the server continuously processing each charac
- 7.5 High severity
szad670401/hyperlpr: Allocation of Resources Without Limits or Throttling
A vulnerability in szad670401/hyperlpr v3.0 allows for a Denial of Service (DoS) attack. The server fails to handle excessive characters appended to the end of multipart boundaries, regardless of the character used. This flaw can be exploited by sending malfor
- 7.5 High severity
gaizhenbiao/chuanhuchatgpt: Allocation of Resources Without Limits or Throttling
An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although a patch was applied for CVE-2024-7807, the issue can still
- 7.5 High severity
haotian-liu/llava: Allocation of Resources Without Limits or Throttling
A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a multipart boundary in a file upload request. This causes the server to continuously process each charact
- 7.5 High severity
shaunwei/realchar: Allocation of Resources Without Limits or Throttling
Realchar version v0.0.4 is vulnerable to an unauthenticated denial of service (DoS) attack. The vulnerability exists in the file upload request handling, where appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request caus
- 7.5 High severity
jsPDF: Uncontrolled Resource Consumption
jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a use
- 7.5 High severity
expr: Allocation of Resources Without Limits or Throttling
Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree (AST) node for each pa
- 7.5 High severity
GitLab: Allocation of Resources Without Limits or Throttling
An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipula
- 7.5 High severity
Cisco IOS XR Software: Allocation of Resources Without Limits or Throttling
A vulnerability in the Internet Key Exchange version 2 (IKEv2) function of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent an affected device from processing any control plane UDP packets. This vulnerability is due to imp
- 7.4 High severity
Cisco IOS XR Software: Allocation of Resources Without Limits or Throttling
A vulnerability in the handling of specific packets that are punted from a line card to a route processor in Cisco IOS XR Software Release 7.9.2 could allow an unauthenticated, adjacent attacker to cause control plane traffic to stop working on multiple Cisco
- 7.5 High severity
Django: Allocation of Resources Without Limits or Throttling
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- 7.5 High severity
opentelemetry-dotnet: Allocation of Resources Without Limits or Throttling
OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trace
- 7.5 High severity
CGI: Allocation of Resources Without Limits or Throttling
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead t
- 7.5 High severity
WeGIA: Allocation of Resources Without Limits or Throttling
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS) vulnerability exists in WeGIA. This vulnerability allows any unauthenticated user to cause the server to become unresponsive by performing
- 9.3 Critical severity
Endpoint Privilege Manager: Allocation of Resources Without Limits or Throttling
Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use. This issue a
- 7.5 High severity
golang.org/x/crypto/ssh: Allocation of Resources Without Limits or Throttling
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
- 7.5 High severity
ASCO 5310 Single-Channel Remote Annunciator: Allocation of Resources Without Limits or Throttling
CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to the webserver of the device.
- 7.5 High severity
Apache James server: Allocation of Resources Without Limits or Throttling
Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations Version 3.7.6
- 7.5 High severity
BIG-IP: Allocation of Resources Without Limits or Throttling
When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosed traffic can cause an increase in CPU resource utilization. Note: Software versions which have reach
- 7.5 High severity
GitLab: Allocation of Resources Without Limits or Throttling
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unu
- 7.5 High severity
GitLab: Allocation of Resources Without Limits or Throttling
An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow.
- 7.5 High severity
GitLab: Allocation of Resources Without Limits or Throttling
A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degrada
- 7.5 High severity
BIND 9: Allocation of Resources Without Limits or Throttling
Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-
- 7.5 High severity
fastify-multipart: Allocation of Resources Without Limits or Throttling
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 a
- 7.5 High severity
M-Files Server: Allocation of Resources Without Limits or Throttling
Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions.
- 7.5 High severity
MySQL Server: Allocation of Resources Without Limits or Throttling
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows unauthenticated attacker with
- 7.5 High severity
Elasticsearch: Allocation of Resources Without Limits or Throttling
An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.
- 7.5 High severity
TXSeries for Multiplatforms: Allocation of Resources Without Limits or Throttling
IBM TXSeries for Multiplatforms 10.1 could allow a remote attacker to cause a denial of service using persistent connections due to improper allocation of resources.
- 7.5 High severity
TXSeries for Multiplatforms: Allocation of Resources Without Limits or Throttling
IBM TXSeries for Multiplatforms 10.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial