Weaknesses of type CWE-770

2,199 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2024-45412MEDIUMYeti affected by a Potential Denial of Service due to the One Milion Unicode characters attackEPSS 0.8%CVE-2024-41742HIGHIBM TXSeries for Multiplatforms denial of serviceEPSS 0.8%CVE-2021-46760CRITICALA malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory accesEPSS 0.8%CVE-2023-5289HIGHAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.8%CVE-2026-56811HIGHPhoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of serviceEPSS 0.8%CVE-2026-66257HIGHApache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-68074HIGHApache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-67465HIGHApache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-67588HIGHApache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-68060HIGHApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.8%CVE-2024-32874MEDIUMIn Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of ServiceEPSS 0.8%CVE-2024-4539MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-42039MEDIUMAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataEPSS 0.8%CVE-2023-38706MEDIUMDiscourse vulnerable to DoS via draftsEPSS 0.8%CVE-2022-31118MEDIUMMissing brute force protection on cloud federation sharing in Nextcloud ServerEPSS 0.8%CVE-2026-73108HIGHRustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodecEPSS 0.8%CVE-2024-3302LOWThere was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of MemoryEPSS 0.8%CVE-2024-32871HIGHPimcore Vulnerable to Flooding Server with Thumbnail filesEPSS 0.8%CVE-2026-123336LOWIn JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversionEPSS 0.8%CVE-2026-112779CRITICALGrav API Plugin before 1.0.42 Cache Exhaustion and Page Permission BypassEPSS 0.8%