Weaknesses of type CWE-770

1,845 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2024-32871HIGHPimcore Vulnerable to Flooding Server with Thumbnail filesEPSS 0.8%CVE-2023-34994LOWAn improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAEPSS 0.8%CVE-2020-15213MEDIUMDenial of service in tensorflow-liteEPSS 0.8%CVE-2026-50276HIGHdd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-56811HIGHPhoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of serviceEPSS 0.8%CVE-2026-55407MEDIUMBuffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded AllocationEPSS 0.8%CVE-2026-47067HIGHAtom table exhaustion via unrecognized URL schemes in hackneyEPSS 0.8%CVE-2022-35221MEDIUMTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2EPSS 0.8%CVE-2024-9229HIGHDenial of Service (DoS) via Multipart Boundary in stangirard/quivrEPSS 0.8%CVE-2026-16756HIGHAllocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of serviceEPSS 0.8%CVE-2024-24752MEDIUMBref Uploaded Files Not Deleted in Event-Driven FunctionsEPSS 0.8%CVE-2026-15957HIGHUncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapesEPSS 0.8%CVE-2023-43768HIGHAn issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run ouEPSS 0.7%CVE-2024-41742HIGHIBM TXSeries for Multiplatforms denial of serviceEPSS 0.7%CVE-2026-44579HIGHNext.js: Denial of Service via connection exhaustion in applications using Cache ComponentsEPSS 0.7%CVE-2022-4019MEDIUMAuthenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost serverEPSS 0.7%CVE-2026-25535HIGHjsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF DimensionsEPSS 0.7%CVE-2026-42039MEDIUMAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataEPSS 0.7%CVE-2023-21144—In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This EPSS 0.7%CVE-2025-47287HIGHTornado vulnerable to excessive logging caused by malformed multipart form dataEPSS 0.7%