Weaknesses of type CWE-770

2,145 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-54332MEDIUMGoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoSEPSS 0.8%CVE-2026-54345MEDIUMGoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)EPSS 0.8%CVE-2022-35221MEDIUMTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2EPSS 0.8%CVE-2023-0382MEDIUMUncontrolled Resource Consumption in M-Files ServerEPSS 0.8%CVE-2022-4019MEDIUMAuthenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost serverEPSS 0.8%CVE-2026-12151HIGHundici WebSocket client vulnerable to denial of service via fragment count bypassEPSS 0.8%CVE-2024-7768HIGHDenial of Service in h2oai/h2o-3EPSS 0.8%CVE-2026-3505HIGHUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.EPSS 0.8%CVE-2026-27880HIGHOpenFeature evaluation API reads input data with no boundsEPSS 0.8%CVE-2026-54156HIGHnode-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoSEPSS 0.8%CVE-2026-48853CRITICALRemote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcEPSS 0.8%CVE-2023-4011MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-67432HIGHMCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportEPSS 0.8%CVE-2026-85447HIGHMOOS-IvP through 24.8.1 pRealm Unbounded REALMCAST_REQ Subscription Denial of ServiceEPSS 0.8%CVE-2026-85448HIGHMOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State RetentionEPSS 0.8%CVE-2025-5996MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-25949HIGHTraefik: TCP readTimeout bypass via STARTTLS on PostgresEPSS 0.8%CVE-2024-45412MEDIUMYeti affected by a Potential Denial of Service due to the One Milion Unicode characters attackEPSS 0.8%CVE-2024-41742HIGHIBM TXSeries for Multiplatforms denial of serviceEPSS 0.8%CVE-2021-46760CRITICALA malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory accesEPSS 0.8%