Weaknesses of type CWE-770

1,845 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2023-36371—An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SEPSS 0.7%CVE-2023-36368—An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafEPSS 0.7%CVE-2023-36366—An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crEPSS 0.7%CVE-2023-36369—An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.7%CVE-2023-36370—An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQEPSS 0.7%CVE-2023-36367—An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SEPSS 0.7%CVE-2026-42561HIGHPython-Multipart: Denial of Service via unbounded multipart part headersEPSS 0.7%CVE-2023-36365—An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) viEPSS 0.7%CVE-2026-44577MEDIUMNext.js: Denial of Service in the Image Optimization APIEPSS 0.7%CVE-2024-52805HIGHSynapse allows unsupported content types to lead to memory exhaustionEPSS 0.7%CVE-2023-47746MEDIUMIBM Db2 denial of serviceEPSS 0.7%CVE-2023-27596HIGHOpenSIPS has vulnerability in the codec_delete_XX() functionsEPSS 0.7%CVE-2024-45797HIGHLibHTP's unbounded header handling leads to denial serviceEPSS 0.7%CVE-2022-1333LOWA specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of ServiceEPSS 0.7%CVE-2026-57212HIGHRabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_sizeEPSS 0.7%CVE-2026-25673HIGHPotential denial-of-service vulnerability in URLField via Unicode normalization on WindowsEPSS 0.7%CVE-2024-23820MEDIUMOpenFGA DoSEPSS 0.7%CVE-2023-4647MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.7%CVE-2023-28882HIGHTrustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs caEPSS 0.7%CVE-2026-14456HIGHUnbounded Memory Growth in QUIC Server Incoming Channel QueueEPSS 0.7%