Weaknesses of type CWE-770

1,846 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-14456HIGHUnbounded Memory Growth in QUIC Server Incoming Channel QueueEPSS 0.7%CVE-2018-15472HIGHAn issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff fEPSS 0.7%CVE-2023-36814HIGHzopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal moduleEPSS 0.7%CVE-2023-32187HIGHAn Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supEPSS 0.7%CVE-2026-25949HIGHTraefik: TCP readTimeout bypass via STARTTLS on PostgresEPSS 0.7%CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.7%CVE-2026-5807HIGHVault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsEPSS 0.7%CVE-2023-28356HIGHA vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enteEPSS 0.7%CVE-2024-48080HIGHAn issue in aedes v0.51.2 allows attackers to cause a Denial of Service(DoS) via a crafted request. NOTE: the Supplier indicates that exploiEPSS 0.7%CVE-2024-38528HIGHUnlimited number of NTS-KE connections can crash ntpd-rs serverEPSS 0.7%CVE-2025-11419HIGHKeycloak: keycloak tls client-initiated renegotiation denial of serviceEPSS 0.7%CVE-2026-3520HIGHMulter vulnerable to Denial of Service via uncontrolled recursionEPSS 0.7%CVE-2023-6117MEDIUMM-Files REST API allows Denial of ServiceEPSS 0.7%CVE-2024-10650HIGHDenial of Service (DoS) in gaizhenbiao/chuanhuchatgptEPSS 0.7%CVE-2018-16864HIGHAn allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journaEPSS 0.7%CVE-2024-9056HIGHDenial of Service in bentoml/bentomlEPSS 0.7%CVE-2023-26249HIGHKnot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of sEPSS 0.7%CVE-2024-26265MEDIUMThe Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.EPSS 0.7%CVE-2025-57810HIGHjsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)EPSS 0.7%CVE-2025-0182HIGHDenial of Service in danswer-ai/danswerEPSS 0.7%