Allocation Without Limits

Every one of the 2,458 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Pure-FTPd 1.0.48 - Denial of ServiceCVE-2020-353594.5% likely
2. Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more…CVE-2023-50387CVSS 7.5 · 100% likely
3. SACK can cause extensive memory use via fragmented resend queueCVE-2019-11478Linux · CVSS 5.3 · 94% likely

   Linux

4. Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation framesCVE-2024-27316Apache Software Foundation · CVSS 7.5 · 89% likely

   Apache

5. Allocation of Resources Without Limits or Throttling in GitLabCVE-2023-0921GitLab · CVSS 4.3 · 84% likely

   GitLab

6. Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usageCVE-2024-28182nghttp2 · CVSS 5.3 · 82% likely

   Nghttp2

7. rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR s…CVE-2017-877981% likely
8. Possible DoS translating ASN.1 object identifiersCVE-2023-2650OpenSSL · CVSS 6.5 · 75% likely

   OpenSSL

9. Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE…CVE-2008-5180CVSS 5.3 · 68% likely
10. When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many…CVE-2023-38039curl · CVSS 7.5 · 56% likely

    The Curl Project

11. An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.form…CVE-2023-4669553% likely
12. Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive partsCVE-2023-24998Apache Software Foundation · CVSS 7.5 · 49% likely

    Apache

13. In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a…CVE-2023-23969CVSS 7.5 · 47% likely
14. An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureItems message to TCP port 4241. This wi…CVE-2020-5802Rockwell FactoryTalk Linx · 45% likely
15. Openssh: denial-of-service in opensshCVE-2025-26466Red Hat · CVSS 5.9 · 39% likely

    Red Hat

16. n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of serv…CVE-2022-22950Spring Framework · 37% likely
17. WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991.CVE-2018-758236% likely
18. curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number…CVE-2022-32206https://github.com/curl/curl · CVSS 6.5 · 36% likely
19. SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width and height parameters…CVE-2017-769636% likely
20. Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headersCVE-2025-48976Apache Software Foundation · CVSS 7.5 · 34% likely

    Apache

21. Allocation of Resources Without Limits or Throttling in GitLabCVE-2024-2454GitLab · CVSS 6.5 · 33% likely

    GitLab

22. A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cooki…CVE-2022-32205https://github.com/curl/curl · CVSS 4.3 · 31% likely
23. Apache Tomcat: FileUpload large number of parts with headers DoSCVE-2025-48988Apache Software Foundation · CVSS 7.5 · 31% likely

    Apache

24. Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18,…CVE-2011-041930% likely
25. A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct…CVE-2026-21710nodejs · CVSS 7.5 · 25% likely

    Node.js

26. Allocation of Resources Without Limits or Throttling in GitLabCVE-2024-2878GitLab · CVSS 7.5 · 23% likely

    GitLab

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.