CWE · MITRE source
CWE-770Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (15)AI
Showing the 11 most specific. Generic controls that address many weakness types are collapsed below.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-10 | Network Disconnect | SC | Imposes an inactivity-based limit on network resource allocation, throttling the number of concurrently held connections. |
SC-22 | Architecture and Provisioning for Name/Address Resolution Service | SC | Redundant provisioning limits the effectiveness of uncontrolled allocation attacks on resolution infrastructure. |
SC-36 | Distributed Processing and Storage | SC | Decentralized allocation inherently caps the resources available to any one component or attacker, countering unbounded allocation weaknesses. |
CP-4 | Contingency Plan Testing | CP | Plan testing exercises resource allocation limits and throttling during simulated failures, directly addressing weaknesses that allow unbounded resource use. |
CP-5 | Contingency Plan Update | CP | Contingency plan updates ensure recovery strategies address unbounded resource allocation, making it harder for attackers to exploit lack of throttling to cause prolonged outages. |
CP-7 | Alternate Processing Site | CP | Provides continuity when unbounded resource allocation at the primary site leads to exhaustion and downtime. |
SI-13 | Predictable Failure Prevention | SI | Pre-planned substitution limits the window an attacker can exploit unbounded allocation to cause predictable component failure. |
SI-8 | Spam Protection | SI | The control enforces limits on message volume and unsolicited traffic, reducing the impact of resource allocations without throttling. |
AC-10 | Concurrent Session Control | AC | This control implements explicit throttling on session allocation, addressing the weakness of allocating resources without limits. |
PL-6 | Security-related Activity Planning | PL | Explicit planning of security-related actions requires defining limits, windows, and resource allocations, making allocation without throttling far less likely. |
PM-6 | Measures of Performance | PM | Measures of performance include tracking allocation behavior and throttling effectiveness, reducing the window for resource exhaustion attacks. |
Show 4 more broadly-applicable controls
SC-47 | Alternate Communications Paths | SC | Unbounded allocation or throttling attacks on one path are contained; the alternate path preserves organizational command functions. |
SC-5 | Denial-of-service Protection | SC | Requires throttling and limits on resource allocation to prevent exhaustion. |
SC-6 | Resource Availability | SC | Implements the missing limits and throttling on resource allocation that this weakness describes. |
CP-8 | Telecommunications Services | CP | Alternate services allow operations to continue when primary allocation of resources lacks limits or throttling. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-27316 | 6.9 | 7.5 | 0.8941 | 2024-04-04 |
CVE-2023-2650 | 6.8 | 6.5 | 0.9208 | 2023-05-30 |
CVE-2017-8779 | 6.4 | 7.5 | 0.8138 | 2017-05-04 |
CVE-2008-5180 | 5.7 | 5.3 | 0.7673 | 2008-11-20 |
CVE-2025-26466 | 4.9 | 5.9 | 0.6237 | 2025-02-28 |
CVE-2017-6640 | 4.7 | 9.8 | 0.4610 | 2017-06-08 |
CVE-2023-50387 | 4.6 | 7.5 | 0.5199 | 2024-02-14 |
CVE-2017-5850 | 4.5 | 7.5 | 0.4959 | 2017-03-27 |
CVE-2025-26682 | 4.3 | 7.5 | 0.4703 | 2025-04-08 |
CVE-2020-3569 KEV | 4.0 | 8.6 | 0.0469 | 2020-09-23 |
CVE-2021-36630 | 3.9 | 7.5 | 0.3992 | 2023-01-18 |
CVE-2020-3566 KEV | 3.8 | 8.6 | 0.0214 | 2020-08-29 |
CVE-2018-7582 | 3.7 | 7.5 | 0.3603 | 2018-03-09 |
CVE-2025-26677 | 3.7 | 7.5 | 0.3591 | 2025-05-13 |
CVE-2023-24998 | 3.5 | 7.5 | 0.3317 | 2023-02-20 |
CVE-2023-26048 | 3.3 | 5.3 | 0.3678 | 2023-04-18 |
CVE-2021-36798 | 3.2 | 7.5 | 0.2768 | 2021-08-09 |
CVE-2019-5737 | 3.1 | 7.5 | 0.2635 | 2019-03-28 |
CVE-2023-31472 | 3.1 | 7.5 | 0.2669 | 2023-05-09 |
CVE-2011-0419 | 2.9 | 0.0 | 0.4878 | 2011-05-16 |
CVE-2019-11478 | 2.8 | 5.3 | 0.2976 | 2019-06-19 |
CVE-2023-21144 | 2.7 | 7.5 | 0.2013 | 2023-06-15 |
CVE-2025-50172 | 2.7 | 6.5 | 0.2363 | 2025-08-12 |
CVE-2019-6975 | 2.6 | 7.5 | 0.1840 | 2019-02-11 |
CVE-2024-28182 | 2.6 | 5.3 | 0.2497 | 2024-04-04 |