Weaknesses of type CWE-770
2,163 resultsAlocação irrestrita de recursos
É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.
Example
Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.
How to mitigate
Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.
CVE-2021-34568HIGHWAGO I/O-Check Service prone to Allocation of Resources Without Limits or ThrottlingEPSS 1.1%CVE-2021-0261HIGHJunos OS: Denial of Service vulnerability in J-Web and web based (HTTP/HTTPS) services caused by a high number of specific requestsEPSS 1.1%CVE-2024-1765MEDIUMUnlimited resource allocation by QUIC CRYPTO frames flooding in quicheEPSS 1.1%CVE-2024-22189HIGHQUIC's Connection ID Mechanism vulnerable to Memory Exhaustion AttackEPSS 1.1%CVE-2025-21521HIGHVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0EPSS 1.1%CVE-2026-45292MEDIUMopentelemetry-java: Unbounded Memory Allocation in W3C Baggage PropagationEPSS 1.1%CVE-2024-37298HIGHPotential memory exhaustion attack due to sparse slice deserializationEPSS 1.1%CVE-2026-5680HIGHUndertow-core: undertow: denial of service via websocket permessage-deflate processingEPSS 1.1%CVE-2024-49767MEDIUMWerkzeug possible resource exhaustion when parsing file data in formsEPSS 1.1%CVE-2022-43686MEDIUMIn Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing EPSS 1.1%CVE-2024-41128MEDIUMAction Dispatch has possible ReDoS vulnerability in query parameter filteringEPSS 1.1%CVE-2021-32476—A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3EPSS 1.1%CVE-2026-96236HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.1%CVE-2026-3039HIGHBIND 9 server memory exhaustion during GSS-API TKEY negotiationEPSS 1.1%CVE-2026-56814MEDIUMPlug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)EPSS 1.1%CVE-2025-27556MEDIUMAn issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, djangEPSS 1.1%CVE-2026-85319HIGHActive Directory Federation Services (AD FS) Denial of Service VulnerabilityEPSS 1.1%CVE-2022-31394HIGHHyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing aEPSS 1.1%CVE-2023-28837MEDIUMWagtail vulnerable to denial-of-service via memory exhaustion when uploading large filesEPSS 1.1%CVE-2025-50334HIGHAn issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting componentEPSS 1.1%