CWE-770
CVEs classified under CWE-770, newest first.
588 CVEsRSS
CVE-2026-47302High· 7.5.NET Denial of Service Vulnerability
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-45646High· 7.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-54448HighTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
GHSA-mqxv-9rm6-w8qcHighEch0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware
CVE-2026-49855High· 7.5tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855)
A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. Th…
CVE-2026-61465Low· 3.3ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than …
CVE-2026-56814Medium· 6.9Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of…
Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of…
CVE-2026-59161High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a smal…
CVE-2026-57220High· 7.5RabbitMQ is a messaging and streaming broker
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an una…
CVE-2026-57212NoneRabbitMQ is a messaging and streaming broker
RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the…
CVE-2026-53653NoneGrav is a file-based Web platform
Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as …
CVE-2026-54063High· 7.5Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
CVE-2026-49866High· 7.5libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
CVE-2026-59899High· 7.5io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) (CVE-2026-59899)
A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing t…
CVE-2026-49754Highmint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)
mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)
CVE-2026-48862Highmint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS
mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS
CVE-2026-49476High· 7.5Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
CVE-2026-59873High· 7.5tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)
A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This o…
CVE-2026-59868Medium· 5.3js-yaml is a JavaScript YAML parser and dumper
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where e…
CVE-2026-56811High· 7.5Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Phoenix socket with…
Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Phoenix socket with…
CVE-2026-55379High· 7.5python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly …
CVE-2026-55078Medium· 6.5Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
CVE-2026-55434Medium· 6.5Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
CVE-2026-11586High· 7.5By default, curl automatically responds to WebSocket PING frames
By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequenti…
CVE-2026-46599High· 7.5golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
GHSA-h72h-ppcx-998pLow· 3.7Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length
Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length
GHSA-443g-gwgp-49x4Low· 3.7zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length
zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length
CVE-2026-14330Medium· 5.5Multiple unbounded alloca() calls in the PulseAudio protocol server.
Multiple unbounded alloca() calls in the PulseAudio protocol server.
CVE-2026-48824Medium· 5.3Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)
Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)
GHSA-65rj-r9fh-jp2vMedium· 5.3SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames
SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames