Weaknesses of type CWE-770

1,833 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2024-12705HIGHDNS-over-HTTPS implementation suffers from multiple issues under heavy query loadEPSS 18.4%CVE-2021-32675HIGHDoS vulnerability in RedisEPSS 16.9%CVE-2025-32873MEDIUMAn issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is EPSS 13.6%CVE-2024-6037HIGHArbitrary Folder Creation in gaizhenbiao/chuanhuchatgptEPSS 10.7%CVE-2021-33910MEDIUMbasic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupEPSS 8.8%CVE-2022-29404—Denial of service in mod_lua r:parsebodyEPSS 6.2%CVE-2023-34396MEDIUMApache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart formsEPSS 5.5%CVE-2023-34149MEDIUMApache Struts: DoS via OOM owing to not properly checking of list boundsEPSS 5.4%CVE-2020-8203—Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.EPSS 5.2%CVE-2024-0760HIGHA flood of DNS messages over TCP may make the server unstableEPSS 4.7%CVE-2020-25648—A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS EPSS 3.9%CVE-2026-48933HIGHA flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerabiEPSS 3.7%CVE-2024-30156HIGHVarnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustiEPSS 3.7%CVE-2022-21294MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions EPSS 3.4%CVE-2026-42198HIGHpgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoSEPSS 3.3%CVE-2022-22971—In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vuEPSS 3.2%CVE-2018-16865HIGHAn allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journaEPSS 3.0%CVE-2021-43045—Possible DOS vulnerabilities in C# Avro SDKEPSS 3.0%CVE-2021-1285HIGHMultiple Cisco Products SNORT Ethernet Frame Decoder Denial of Service VulnerabilityEPSS 2.9%CVE-2019-15165MEDIUMsf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.EPSS 2.8%