Weaknesses of type CWE-770
1,836 resultsAlocação irrestrita de recursos
É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.
Example
Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.
How to mitigate
Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.
CVE-2023-5379HIGHUndertow: ajp request closes connection exceeding maxrequestsizeEPSS 1.0%CVE-2023-25578HIGHStarlite DoS vulnerability when parsing multipart request bodyEPSS 1.0%CVE-2025-21491MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8EPSS 1.0%CVE-2023-42457HIGHplone.rest vulnerable to Denial of Service when ++api++ is used many timesEPSS 1.0%CVE-2023-27556MEDIUMIBM Safer Payments denial of serviceEPSS 1.0%CVE-2026-56170HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.0%CVE-2022-3295MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 1.0%CVE-2022-3298MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 1.0%CVE-2019-10163LOWA Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to EPSS 1.0%CVE-2024-46668HIGHAn allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 throEPSS 1.0%CVE-2026-42587HIGHNetty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSEPSS 1.0%CVE-2021-42142HIGHAn issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. EPSS 1.0%CVE-2025-4432MEDIUMRing: some aes functions may panic when overflow checking is enabled in ringEPSS 1.0%CVE-2023-47120HIGHDiscourse DoS through Onebox favicon URLEPSS 1.0%CVE-2023-27901HIGHJenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reEPSS 1.0%CVE-2023-27900HIGHJenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reEPSS 1.0%CVE-2024-28102MEDIUMJWCrypto vulnerable to JWT bomb Attack in `deserialize` functionEPSS 1.0%CVE-2022-3212HIGHDoS in axum-core due to missing request size limitEPSS 1.0%CVE-2024-54497MEDIUMThe issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.4, macOS Sequoia 15.2, macOS SonoEPSS 1.0%CVE-2021-31369MEDIUMJunos OS: MX Series: Traffic drops will be observed if MS-MPC/MS-PIC resources are consumed by certain traffic causing a partial DoSEPSS 1.0%