Weaknesses of type CWE-770

2,186 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2025-4821HIGHIncorrect congestion window growth by invalid ACK rangesEPSS 1.0%CVE-2023-47120HIGHDiscourse DoS through Onebox favicon URLEPSS 1.0%CVE-2022-32958HIGHTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or ThrottlingEPSS 1.0%CVE-2022-35220HIGHTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-1EPSS 1.0%CVE-2023-5625MEDIUMPython-eventlet: patch regression for cve-2021-21419 in some red hat buildsEPSS 1.0%CVE-2023-27901HIGHJenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reEPSS 1.0%CVE-2024-28102MEDIUMJWCrypto vulnerable to JWT bomb Attack in `deserialize` functionEPSS 1.0%CVE-2023-27900HIGHJenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reEPSS 1.0%CVE-2021-31369MEDIUMJunos OS: MX Series: Traffic drops will be observed if MS-MPC/MS-PIC resources are consumed by certain traffic causing a partial DoSEPSS 1.0%CVE-2025-7070MEDIUMIROAD Dashcam Q9 MFA Pairing Request allocation of resourcesEPSS 1.0%CVE-2026-96959HIGH.NET Denial of Service VulnerabilityEPSS 1.0%CVE-2026-47774HIGHEnvoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationEPSS 1.0%CVE-2023-38507HIGHStrapi Improper Rate Limiting vulnerabilityEPSS 1.0%CVE-2026-18649HIGHGstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloadersEPSS 1.0%CVE-2021-0285HIGHJunos OS: QFX5000 Series and EX4600 Series: Continuous traffic destined to a device configured with MC-LAG leading to nodes losing their control connection which can impact trafficEPSS 1.0%CVE-2025-21536MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 aEPSS 1.0%CVE-2023-28119HIGHcrewjam/saml vulnerable to Denial Of Service Via Deflate Decompression BombEPSS 1.0%CVE-2025-21534MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected areEPSS 1.0%CVE-2024-32663HIGHSuricata 's http2 parser contains an improper compressed header handling can lead to resource starvationEPSS 1.0%CVE-2022-22278—A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when usEPSS 1.0%