Weaknesses of type CWE-770
2,199 resultsAlocação irrestrita de recursos
É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.
Example
Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.
How to mitigate
Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.
CVE-2022-22278—A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when usEPSS 1.0%CVE-2026-93488HIGHIo.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streamsEPSS 1.0%CVE-2022-43768HIGHA vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-EPSS 1.0%CVE-2023-30636HIGHTiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error, with RpcStatus UNAVAILABLE for "not leader") upon an attempt tEPSS 1.0%CVE-2024-2818MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 1.0%CVE-2023-45130HIGHFrontier opcode SUICIDE touches too many storage values on large contractsEPSS 1.0%CVE-2022-20950MEDIUMA vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remoEPSS 1.0%CVE-2026-109468HIGHASP.NET Core Denial of Service VulnerabilityEPSS 0.9%CVE-2020-14322—In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of deniEPSS 0.9%CVE-2023-26285MEDIUMIBM MQ denial of serviceEPSS 0.9%CVE-2024-36462HIGHAllocation of resources without limits or throttling (uncontrolled resource consumption)EPSS 0.9%CVE-2018-3738—protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.EPSS 0.9%CVE-2021-22919—A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)EPSS 0.9%CVE-2025-22869HIGHPotential denial of service in golang.org/x/cryptoEPSS 0.9%CVE-2022-22153HIGHSRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet dropsEPSS 0.9%CVE-2020-14336—A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allowEPSS 0.9%CVE-2024-28863MEDIUMnode-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validationEPSS 0.9%CVE-2024-23835HIGHSuricata's pgsql: memory exhaustion use on record parsingEPSS 0.9%CVE-2026-96300MEDIUMRPC Endpoint Mapper Service Denial of Service VulnerabilityEPSS 0.9%CVE-2026-70399HIGHhttpd does not enforce the documented default max_clients connection limitEPSS 0.9%