Allocation of Resources Without Limits or Throttling
CWE-770
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
We track 1,118 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7. 2 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
- Architecture and Design: Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
- Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
Latest Allocation of Resources Without Limits or Throttling vulnerabilities
- 7.5 High severity
open62541/open62541: Allocation of Resources Without Limits or Throttling
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exp
- 7.5 High severity
opcua: Allocation of Resources Without Limits or Throttling
All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vul
- 7.5 High severity
node-opcua: Allocation of Resources Without Limits or Throttling
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit.
- 7.5 High severity
ASNeG/OpcUaStack: Allocation of Resources Without Limits or Throttling
All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending
- 7.5 High severity
FreeOpcUa/freeopcua: Allocation of Resources Without Limits or Throttling
All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
- 7.5 High severity
Mtower: Allocation of Resources Without Limits or Throttling
TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a Numaker-PFM-M2351 TEE kernel crash.
- 7.5 High severity
RUGGEDCOM RM1224 LTE(4G) EU: Allocation of Resources Without Limits or Throttling
Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute force prevention and lead to a denial of service condition for the duration of the attack.
- 7.5 High severity
Apache Avro: Allocation of Resources Without Limits or Throttling
It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apa
- 7.5 High severity
Apache Avro: Loop with Unreachable Exit Condition
It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro versio
- 7.5 High severity
Triplecross: Allocation of Resources Without Limits or Throttling
A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. This occurs because there is no limit to the length of the output of the executed command.
- 7.5 High severity
rust-websocket: Allocation of Resources Without Limits or Throttling
Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affect
- 7.5 High severity
discourse: Allocation of Resources Without Limits or Throttling
Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. User
- 7.5 High severity
Junos OS Evolved: Allocation of Resources Without Limits or Throttling
An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows unauthenticated network based attacker to cause a Denial of Service (DoS). On all Junos Evolved platforms ho
- 7.5 High severity
Pexip Infinity: Allocation of Resources Without Limits or Throttling
Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling.
- 7.5 High severity
Mediawiki: Allocation of Resources Without Limits or Throttling
An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of
- 7.5 High severity
SUSE Manager Server 4.1: Missing Authentication for Critical Functionality
A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 sp
- 7.8 High severity
Autodesk AutoCAD product suite, Revit, Design…: Allocation of Resources Without Limits or Throttling
Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated buffer while parsing PDF files. This vulnerability may be exploited to execute arbitrary code.
- 7.5 High severity
Spring Cloud Function: Allocation of Resources Without Limits or Throttling
In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.
- 7.5 High severity
Apache HTTP Server: Allocation of Resources Without Limits or Throttling
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
- 7.5 High severity
Apache HTTP Server: Allocation of Resources Without Limits or Throttling
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
- 7.5 High severity
CRI-O: Allocation of Resources Without Limits or Throttling
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after com
- 7.5 High severity
Cisco Firepower Threat Defense Software: Allocation of Resources Without Limits or Throttling
A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper hand
- 7.5 High severity
Cisco Firepower Threat Defense Software: Allocation of Resources Without Limits or Throttling
A vulnerability in the connection handling function in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper traff
- 7.5 High severity
Cisco Firepower Threat Defense Software: Allocation of Resources Without Limits or Throttling
A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause unlimited memory consumption, which could lead to a denial of service (DoS) condition on an aff
- 7.5 High severity
SonicOS: Allocation of Resources Without Limits or Throttling
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack
- 7.5 High severity
Zammad: Allocation of Resources Without Limits or Throttling
A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount of generated e-mail messages.
- 7.5 High severity
All F-Secure Endpoint Protection products on…: Allocation of Resources Without Limits or Throttling
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the fsicapd component used in certain F-Secure products while scanning larger packages/fuzzed files consume too much memory eventually can crash the scanning engine. The exploit
- 7.5 High severity
Cisco Aironet Access Point Software: Allocation of Resources Without Limits or Throttling
A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service (DoS) conditi
- 7.8 High severity
NVIDIA FLARE: Allocation of Resources Without Limits or Throttling
NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.
- 7.5 High severity
twisted: Allocation of Resources Without Limits or Throttling
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using
- 7.5 High severity
Nomad: Allocation of Resources Without Limits or Throttling
HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.
- 7.5 High severity
Pexip Infinity: Allocation of Resources Without Limits or Throttling
Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily causing denial of service.
- 7.5 High severity
client_golang: Allocation of Resources Without Limits or Throttling
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Serv
- 7.5 High severity
Apache ActiveMQ Artemis: Allocation of Resources Without Limits or Throttling
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
- 7.5 High severity
Sidekiq: Allocation of Resources Without Limits or Throttling
In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
- 7.5 High severity
Junos OS: Inefficient Algorithmic Complexity
An Insufficient Algorithmic Complexity combined with an Allocation of Resources Without Limits or Throttling vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series and MX Series with SPC3 allows an unauthenticated networ
- 8.6 High severity
Cisco IOS XR Software DVMRP Memory Exhaustion Exploited
Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it con
- 8.6 High severity
Cisco IOS XR Software DVMRP Memory Exhaustion Exploited
A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue managemen