CWE-770 · Denial of Service
Allocation Without Limits
2,459CVEs
0exploited
1with a public check
36likely (EPSS 10%+)
SortMost likely exploited
2,459 CVEs with CWE-770 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-35359CheckPure-FTPd 1.0.48 - Denial of ServicePureftpd · Pure-Ftpd · 2020-12-26 | – | 4.5% | 2020-12-26 |
| CVE-2023-50387Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more…Thekelleys · Dnsmasq · CVSS 7.5 · 2024-02-14 | 7.5 | 100% | 2024-02-14 |
| CVE-2019-11478SACK can cause extensive memory use via fragmented resend queueLinux · Linux kernel · CVSS 5.3 · 2019-06-18 | 5.3 | 94% | 2019-06-18 |
| CVE-2024-27316Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation framesApache Software Foundation · Apache HTTP Server · CVSS 7.5 · 2024-04-04 | 7.5 | 89% | 2024-04-04 |
| CVE-2023-0921Allocation of Resources Without Limits or Throttling in GitLabGitLab · GitLab · CVSS 4.3 · 2023-06-06 | 4.3 | 84% | 2023-06-06 |
| CVE-2024-28182Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usagenghttp2 · nghttp2 · CVSS 5.3 · 2024-04-04 | 5.3 | 82% | 2024-04-04 |
| CVE-2017-8779rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR s…Rpcbind Project · Rpcbind · 2017-05-04 | – | 81% | 2017-05-04 |
| CVE-2023-2650Possible DoS translating ASN.1 object identifiersOpenSSL · OpenSSL · CVSS 6.5 · 2023-05-30 | 6.5 | 75% | 2023-05-30 |
| CVE-2008-5180Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE…Microsoft · Office Communicator · CVSS 5.3 · 2008-11-20 | 5.3 | 68% | 2008-11-20 |
| CVE-2023-38039When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many…curl · curl · CVSS 7.5 · 2023-09-15 | 7.5 | 56% | 2023-09-15 |
| CVE-2023-46695An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.form…Djangoproject · Django · 2023-11-02 | – | 53% | 2023-11-02 |
| CVE-2023-24998Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive partsApache Software Foundation · Apache Commons FileUpload · CVSS 7.5 · 2023-02-20 | 7.5 | 49% | 2023-02-20 |
| CVE-2023-23969In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a…Djangoproject · Django · CVSS 7.5 · 2023-02-01 | 7.5 | 47% | 2023-02-01 |
| CVE-2020-5802An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureItems message to TCP port 4241. This wi…Rockwellautomation · Rockwell FactoryTalk Linx · 2020-12-29 | – | 45% | 2020-12-29 |
| CVE-2025-26466Openssh: denial-of-service in opensshSiemens · OpenSSH · CVSS 5.9 · 2025-02-28 | 5.9 | 39% | 2025-02-28 |
| CVE-2022-22950n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of serv…Vmware · Spring Framework · 2022-04-01 | – | 37% | 2022-04-01 |
| CVE-2018-7582WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991.Weblogexpert · Weblog Expert · 2018-03-09 | – | 36% | 2018-03-09 |
| CVE-2022-32206curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number…Haxx · https://github.com/curl/curl · CVSS 6.5 · 2022-07-07 | 6.5 | 36% | 2022-07-07 |
| CVE-2017-7696SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width and height parameters…Sap · Sso Authentication Library · 2017-04-14 | – | 36% | 2017-04-14 |
| CVE-2025-48976Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headersApache Software Foundation · Apache Commons FileUpload · CVSS 7.5 · 2025-06-16 | 7.5 | 34% | 2025-06-16 |
| CVE-2024-2454Allocation of Resources Without Limits or Throttling in GitLabGitLab · GitLab · CVSS 6.5 · 2024-05-09 | 6.5 | 33% | 2024-05-09 |
| CVE-2022-32205A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cooki…Haxx · https://github.com/curl/curl · CVSS 4.3 · 2022-07-07 | 4.3 | 31% | 2022-07-07 |
| CVE-2025-48988Apache Tomcat: FileUpload large number of parts with headers DoSApache Software Foundation · Apache Tomcat · CVSS 7.5 · 2025-06-16 | 7.5 | 31% | 2025-06-16 |
| CVE-2011-0419Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18,…Apache · Portable Runtime · 2011-05-16 | – | 30% | 2011-05-16 |
| CVE-2026-21710A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct…nodejs · node · CVSS 7.5 · 2026-03-30 | 7.5 | 25% | 2026-03-30 |
| CVE-2024-2878Allocation of Resources Without Limits or Throttling in GitLabGitLab · GitLab · CVSS 7.5 · 2025-02-05 | 7.5 | 23% | 2025-02-05 |
| CVE-2023-31472An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a com…Gl-Inet · Gl-S20 Firmware · CVSS 7.5 · 2023-05-09 | 7.5 | 20% | 2023-05-09 |
| CVE-2024-12705DNS-over-HTTPS implementation suffers from multiple issues under heavy query loadISC · BIND 9 · CVSS 7.5 · 2025-01-29 | 7.5 | 19% | 2025-01-29 |
| CVE-2017-5850httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header.Openbsd · Openbsd · 2017-03-27 | – | 17% | 2017-03-27 |
| CVE-2019-1002100In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch…Kubernetes · Kubernetes · CVSS 6.5 · 2019-04-01 | 6.5 | 17% | 2019-04-01 |
| CVE-2021-32675DoS vulnerability in Redisredis · redis · CVSS 7.5 · 2021-10-04 | 7.5 | 16% | 2021-10-04 |
| CVE-2025-32873An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-ser…djangoproject · Django · CVSS 5.3 · 2025-05-08 | 5.3 | 14% | 2025-05-08 |
| CVE-2020-8416IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port.Iktm · Bearftp · 2020-01-29 | – | 14% | 2020-01-29 |
| CVE-2005-2970Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections,…Apache · Http Server · 2005-10-25 | – | 14% | 2005-10-25 |
| CVE-2008-2364The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim r…Apache · Http Server · 2008-06-13 | – | 13% | 2008-06-13 |
| CVE-2009-4017PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to…Php · Php · 2009-11-24 | – | 12% | 2009-11-24 |
| CVE-2024-6037Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgptgaizhenbiao · gaizhenbiao/chuanhuchatgpt · CVSS 7.5 · 2024-07-10 | 7.5 | 11% | 2024-07-10 |
| CVE-2020-11612The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte strea…Netty · Netty · 2020-04-07 | – | 9.2% | 2020-04-07 |
| CVE-2021-33910basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled…Systemd Project · Systemd · CVSS 5.5 · 2021-07-20 | 5.5 | 8.8% | 2021-07-20 |
| CVE-2019-17359The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is…Bouncycastle · Bc-Java · 2019-10-08 | – | 8.8% | 2019-10-08 |
| CVE-2018-10237Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this librar…Google · Guava · 2018-04-26 | – | 8.4% | 2018-04-26 |
| CVE-2021-39293In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic.…Golang · Go · 2022-01-24 | – | 6.9% | 2022-01-24 |
| CVE-2022-29404Denial of service in mod_lua r:parsebodyApache Software Foundation · Apache HTTP Server · 2022-06-08 | – | 6.6% | 2022-06-08 |
| CVE-2009-2726The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Business Edition A.x.x, B.…Digium · Asterisk · 2009-08-12 | – | 6.5% | 2009-08-12 |
| CVE-2018-5743Limiting simultaneous TCP clients was ineffectiveISC · BIND 9 · CVSS 7.5 · 2019-10-09 | 7.5 | 6.4% | 2019-10-09 |
| CVE-2019-12406Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type att…Apache · Apache CXF · 2019-11-06 | – | 6.3% | 2019-11-06 |
| CVE-2022-41717Excessive memory growth in net/http and golang.org/x/net/http2Go standard library · net/http · 2022-12-08 | – | 6.2% | 2022-12-08 |
| CVE-2023-34396Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart formsApache Software Foundation · Apache Struts · CVSS 4.3 · 2023-06-14 | 4.3 | 5.5% | 2023-06-14 |
| CVE-2023-34149Apache Struts: DoS via OOM owing to not properly checking of list boundsApache Software Foundation · Apache Struts · CVSS 4.3 · 2023-06-14 | 4.3 | 5.4% | 2023-06-14 |
| CVE-2016-4074The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fix…Jq Project · Jq · 2016-05-06 | – | 5.4% | 2016-05-06 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.