Weaknesses of type CWE-770

1,845 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2024-56332MEDIUMNext.js Vulnerable to Denial of Service (DoS) with Server ActionsEPSS 0.8%CVE-2026-72978MEDIUMActive Directory Federation Services (AD FS) Denial of Service VulnerabilityEPSS 0.8%CVE-2023-5625MEDIUMPython-eventlet: patch regression for cve-2021-21419 in some red hat buildsEPSS 0.8%CVE-2023-36357—An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackersEPSS 0.8%CVE-2023-6337HIGHVault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP RequestsEPSS 0.8%CVE-2023-23846HIGHDue to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headersEPSS 0.8%CVE-2022-22212HIGHJunos OS Evolved: A high rate of specific hostbound traffic will cause unexpected hostbound traffic delays or dropsEPSS 0.8%CVE-2024-52581HIGHLitestar allows unbounded resource consumption (DoS vulnerability)EPSS 0.8%CVE-2026-50274HIGHdd-trace-go: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50273HIGHDatadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50272HIGHdd-trace: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-60108HIGHZeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP AnalyzerEPSS 0.8%CVE-2026-50271HIGHdd-trace-py: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2024-25026MEDIUMIBM WebSphere Application Server denial of serviceEPSS 0.8%CVE-2026-40984HIGHMicrometer HTTP server instrumentations DoS vulnerabilityEPSS 0.8%CVE-2025-11447HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-27858HIGHAttacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. AttackeEPSS 0.8%CVE-2024-8966HIGHDenial of Service in gradio-app/gradioEPSS 0.8%CVE-2026-29181HIGHOpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)EPSS 0.8%CVE-2023-0382MEDIUMUncontrolled Resource Consumption in M-Files ServerEPSS 0.8%