CWE-770: Allocation of Resources Without Limits or Throttling, page 42
Filter
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
What the weakness is: CWE-770 at MITRE
Ask an AI about CWE-770
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-770: Allocation of Resources Without Limits or Throttling and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/770.html and https://cve.bz/cve/cwe/770?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.5CVE-2023-36368EPSS 0.7%
An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- 7.5CVE-2023-36367EPSS 0.7%
An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- 7.5CVE-2023-36366EPSS 0.7%
An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crafted SQL statements.
- 7.5CVE-2023-36365EPSS 0.7%
An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- 7.5CVE-2023-2828EPSS 3.7%
Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using …
- 7.5CVE-2023-34166EPSS 0.4%
Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart.
- 7.5CVE-2022-48498EPSS 0.4%
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
- 5.5CVE-2023-30903EPSS 0.2%
HP-UX could be exploited locally to create a Denial of Service (DoS) when any physical interface is configured with IPv6/inet6.
- 7.5CVE-2023-21144EPSS 0.7%
In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This could lead to remote denial of service with no additional execution privileges needed. User interac…
- 7.5CVE-2023-34455EPSS 1.8%
snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk in the fileSnappyInputStream.java…
- 4.7CVE-2023-35116EPSS 0.4%
jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, …
- 7.5CVE-2023-34396EPSS 5.5%
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
- 6.5CVE-2023-34149EPSS 5.4%
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.
- 5.5CVE-2023-29767EPSS 0.3%
An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files.
- 7.5CVE-2023-0121EPSS 1.2%
A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to…
- 6.5CVE-2023-2253EPSS 0.9%
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreason…
- 4.3CVE-2023-0921EPSS 84%
A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedl…
- 5.5CVE-2022-48441EPSS 0.07%
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
- 5.5CVE-2022-48440EPSS 0.07%
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
- 6.5CVE-2023-23603EPSS 0.6%
Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability af…
- 6.5CVE-2023-0616EPSS 0.5%
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actio…
- 6.5CVE-2023-32699EPSS 0.6%
MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. The `checkUserPassword` method is used to check whether the password provided by the user matches the password saved i…
- 5.5CVE-2023-33656EPSS 0.4%
A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack by causing the program to consume all available memor…
- 5.5CVE-2023-29737EPSS 0.3%
An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database files.
- 6.5CVE-2023-2650EPSS 74%
Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS,…
- 6.5CVE-2023-33720EPSS 0.6%
mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty.
- 7.8CVE-2023-21110EPSS 0.09%
In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …
- 5.5CVE-2023-20930EPSS 0.08%
In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interact…
- 5.5CVE-2023-31914EPSS 0.3%
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc.
- 7.5CVE-2023-2666EPSS 0.7%
Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.
- 7.5CVE-2023-28356EPSS 0.7%
A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one of the processes, consuming ~120% CPU and rendering the service unresponsive.
- 7.5CVE-2023-25568EPSS 0.9%
Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting eve…
- 9.8CVE-2021-46760EPSS 0.8%
A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentially lead to an attacker leaking sensitive information or achieving code executio…
- 7.5CVE-2023-31472EPSS 20%
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied.
- 9.1CVE-2023-27958EPSS 1.6%
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A remote user may be able to cause unexpected system termination or corrupt kernel memory.
- 7.5CVE-2023-30551EPSS 1.1%
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verificat…
- 5.9CVE-2023-26285EPSS 0.9%
IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow a remote attacker to cause a denial of service due to an error processing invalid data. IBM X-Force ID: 248418.
- 7.5CVE-2023-30455EPSS 1.0%
An issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx endpoint. The GET parameter acc…
- 7.5CVE-2023-28882EPSS 0.7%
Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.
- 7.5CVE-2023-27556EPSS 1.0%
IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocate resources without limits or throttling which could allow a remote attacker to …
- 7.5CVE-2023-29779EPSS 1.2%
Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. After receiving the malicious command, the device wil…
- 5.5CVE-2023-30408EPSS 0.3%
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.
- 5.5CVE-2023-30406EPSS 0.3%
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c.
- 5.3CVE-2023-29479EPSS 0.9%
Ribose RNP before 0.16.3 may hang when the input is malformed.
- 5.5CVE-2023-29570EPSS 0.3%
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).
- 5.5CVE-2023-29575EPSS 0.3%
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.
- 7.5CVE-2023-0383EPSS 0.8%
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption.
- 5.3CVE-2023-26048EPSS 3.4%
Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `…
- 5.3CVE-2023-28968EPSS 0.6%
An Improperly Controlled Sequential Memory Allocation vulnerability in the Juniper Networks Deep Packet Inspection-Decoder (JDPI-Decoder) Application Signature component of Junos OS's AppID service on SRX Series devices will stop the JDPI-…
- 7.5CVE-2018-15472EPSS 0.7%
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using rouge can block for a long time in Sidekiq jobs without any timeout.