CVE-2021-22210: Allocation of Resources Without Limits or Throttling

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring a query parameter and returning a considerable amount of results...

CVE-2020-28491: Allocation of Resources Without Limits or Throttling

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception...

CVE-2020-29486: Allocation of Resources Without Limits or Throttling

An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a node away. However, node ownership has quota implications. Any guest can run another guest out of quota, or create an unbounded number of nodes owned by dom0, thus running...

CVE-2020-29570: Allocation of Resources Without Limits or Throttling

An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is reversed. The consumer assumes, seeing the former initialized, that the latter are also ready for use. Malicious or buggy guest kernels c...

CVE-2020-29568: Allocation of Resources Without Limits or Throttling

An issue was discovered in Xen through 4.14.x. Some OSes such as Linux, FreeBSD, and NetBSD are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OO...

CVE-2020-13342: Allocation of Resources Without Limits or Throttling

An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email...

CVE-2020-9494: Allocation of Resources Without Limits or Throttling

Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread...

CVE-2017-18899: Allocation of Resources Without Limits or Throttling

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting...

CVE-2020-14405: Allocation of Resources Without Limits or Throttling

An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size...

CVE-2020-13250: Allocation of Resources Without Limits or Throttling

HashiCorp Consul and Consul Enterprise include an HTTP API introduced in 1.2.0 and DNS introduced in 1.4.3 caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4...

CVE-2018-5743: Allocation of Resources Without Limits or Throttling

By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of...

CVE-2019-4338: Allocation of Resources Without Limits or Throttling

IBM Security Guardium Big Data Intelligence 4.0 SonarG does not properly restrict the size or amount of resources that are requested or influenced by an actor. This weakness can be used to consume more resources than intended. IBM X-Force ID: 161417...

CVE-2019-10171: Allocation of Resources Without Limits or Throttling

It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service...

CVE-2017-13190: Allocation of Resources Without Limits or Throttling

A vulnerability in the Android media framework libhevc related to handling pscodecobj memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68299873...

CVE-2017-12944: Allocation of Resources Without Limits or Throttling

The TIFFReadDirEntryArray function in tifread.c in LibTIFF 4.0.8 mishandles memory allocation for short files, which allows remote attackers to cause a denial of service allocation failure and application crash in the TIFFFetchStripThing function in tifdirread.c during a tiff2pdf invocation...