Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty.
MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings (max_gas, max_fee_per_gas, max_priority_fee_per_gas, the worst-case gas_limit * max_fee_per_gas <= max_total_fee budget cap, and a validity window) against one transaction at a time, and nothing accounts for exposure across concurrent requests. reserve_hash_atomic/2 is keyed on the transaction hash, so it prevents duplicate broadcast of the same signed transaction but not N distinct sponsored transactions carrying distinct expiring nonces. Committed sponsor exposure is therefore N times max_total_fee, bounded by nothing in the library, and the default 900 second validity window lets co-signed transactions stay broadcastable and uncounted for that entire period.
This issue affects mpp: from 0.2.0 before 0.12.0.
CVE-2026-44253 is a medium severity vulnerability in Wazuh versions from 3.9.0 up to but not including 4.14.5 and from 5.0.0-beta1 up to but not including 5.0.0-beta2. It allows an authenticated cluster node to cause memory exhaustion on the master node by sending specially crafted requests that allocate excessive memory without limits. This can disrupt agent connectivity and alert processing. The issue is fixed in Wazuh versions 4.14.5 and 5.0.0-beta2.
A denial-of-service (DoS) vulnerability exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. The issue arises from improper handling of pagination parameters where non-numeric or array values can cause PHP type errors and unvalidated limits in list queries, leading to resource exhaustion.
A high-severity integer overflow vulnerability exists in libheif versions 1.19.0 through 1.22.999, affecting the parsing of HEIF sequences with the msf1 brand. The flaw allows crafted input to cause unbounded heap allocation due to improper bounds checking and 32-bit arithmetic wraparound, potentially leading to memory exhaustion and process crashes. This issue is fixed in version 1.23.0.
A resource allocation vulnerability in ZcashFoundation's Zebra node prior to version 4.5.0 allows a single unauthenticated P2P peer to monopolize all inbound mempool download concurrency slots. This denial-of-service condition causes legitimate transaction requests to be rejected, though block validation and synchronization remain unaffected. The issue is resolved in Zebra version 4.5.0.
CVE-2026-47628 is a high-severity vulnerability in NVIDIA Triton Inference Server for Linux version 0.0-26.05. It involves allocation of resources without limits or throttling, which could allow an attacker to cause a denial of service condition. No confidentiality or integrity impacts are reported. No known exploits are currently in the wild.
CVE-2026-47683 is a high-severity vulnerability in the open source Node.js sandbox vm2 prior to version 3.11.6. It involves insufficient enforcement of buffer allocation limits, allowing sandboxed code to bypass configured caps on memory allocation. This can lead to large synchronous external-memory allocations that may exhaust the host process. The issue is fixed in vm2 version 3.11.6.
CVE-2026-71486 is a medium severity vulnerability in vllm-project vllm versions prior to 0.26.0. It affects the /v1/completions/derender and /v1/chat/completions/derender API endpoints, which accept client-supplied generated output data without enforcing limits on token counts or response sizes. This allows an authenticated API client to cause uncontrolled CPU and memory consumption proportional to the size of the attacker-supplied token data, bypassing normal generation output bounds.
CVE-2026-75050 is a denial-of-service (DoS) vulnerability in JetBrains YouTrack versions before 2026.1.13901 and 2026.2.17950. The issue arises from crafted type parameters that can be exploited to cause service disruption. This vulnerability is classified under CWE-770, which relates to allocation of resources without limits or throttling. The vulnerability has a CVSS v3.1 score of 7.1, indicating high severity with network attack vector and low attack complexity. A fix is available in version 2026.1.13901.
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11.
Net::OAuth versions before 0.32 for Perl contain a vulnerability where unbounded caching of failed module loads in the smart_require function can lead to memory exhaustion. This occurs because smart_require stores results in a process-global hash without limits or eviction, including entries for every class name queried, even those that fail to load. A remote client can control the number and length of these entries, causing the hash to grow indefinitely in persistent server processes until memory is exhausted. The vulnerability affects versions prior to 0.32.
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
A vulnerability in libdm allows a remote attacker to craft malicious Logical Volume Manager (LVM) metadata with deeply nested structures, causing uncontrolled recursion in the configuration parser. This leads to stack exhaustion and crashes of any LVM command reading the metadata, resulting in a denial of service (DoS). The issue has a medium severity score of 5.7. Red Hat has released an update for Red Hat Hardened Images RPMs to address this flaw.
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
CVE-2026-56853 is a high-severity vulnerability in the Go standard library net/http package. It occurs when a server supports unencrypted HTTP/2 and reads initial bytes from new connections to detect the HTTP/2 client preface. During this process, the ReadHeaderTimeout setting is not applied as expected, leading to allocation of resources without proper limits or throttling. This can cause denial of service by exhausting server resources.
CVE-2026-17076 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper processing of DRDA and DDM resynchronization requests that could allow a remote attacker to cause a denial of service by allocating resources without limits or throttling.
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage maintenance windows could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.