Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2023-26249HIGHKnot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of sEPSS 0.7%CVE-2026-27979MEDIUMNext.js: Unbounded postponed resume buffering can lead to DoSEPSS 0.7%CVE-2026-67585HIGHAtom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federationEPSS 0.7%CVE-2024-26265MEDIUMThe Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.EPSS 0.7%CVE-2026-94440HIGHMemory limit bypass when parsing MIME headers in net/textproto, mime/multipartEPSS 0.7%CVE-2025-2813HIGHHTTP Service DoS VulnerabilityEPSS 0.7%CVE-2022-45434MEDIUMSome Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the fiEPSS 0.7%CVE-2023-25414MEDIUMAten PE8108 2.4.232 is vulnerable to denial of service (DOS).EPSS 0.7%CVE-2024-37309MEDIUMClient initialized Session-Renegotiation DoSEPSS 0.7%CVE-2025-2559MEDIUMOrg.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloakEPSS 0.7%CVE-2021-25666—A vulnerability has been identified in SCALANCE W780 and W740 (IEEE 802.11n) family (All versions < V6.3). Sending specially crafted packetsEPSS 0.7%CVE-2023-46130MEDIUMBypassing height value allowed in some theme componentsEPSS 0.7%CVE-2026-93310MEDIUMO-RAN-SC SMO OAM VES Collector allocation of resourcesEPSS 0.7%CVE-2023-32186HIGHA Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supEPSS 0.7%CVE-2026-86513MEDIUMjava-json-tools jackson-coreutils JSON Pointer parser TreePointer.java TreePointer.tokensFromInput allocation of resourcesEPSS 0.7%CVE-2026-109527HIGHModel Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodiesEPSS 0.7%CVE-2020-11862HIGHInsecure renegotiation in SSL protocol caused Denial of service attack in Privileged Account ManagerEPSS 0.7%CVE-2026-57227HIGHSuricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messagesEPSS 0.7%CVE-2026-40211MEDIUMDenial of service via crafted DoH3 queriesEPSS 0.7%CVE-2024-0563MEDIUMDenial of service condition in M-Files ServerEPSS 0.7%