Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-45768HIGHSuricata ldap: unbounded responses per transaction can lead to resource exhaustionEPSS 0.7%CVE-2025-29907HIGHjsPDF Bypass Regular Expression Denial of Service (ReDoS)EPSS 0.7%CVE-2025-32952MEDIUMio.jmix.localfs:jmix-localfs affected by DoS in the Local File StorageEPSS 0.7%CVE-2026-77337CRITICALCakePHP: Potential Authentication bypass with CookieAuthenticatorEPSS 0.7%CVE-2023-38498MEDIUMDiscourse vulnerable to DoS via defer queueEPSS 0.7%CVE-2022-31184MEDIUMEmail activation route can be abused by spammers in DiscourseEPSS 0.7%CVE-2026-55951HIGHhttpc memory exhaustion via unbounded response header accumulationEPSS 0.7%CVE-2024-25143MEDIUMThe Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service packEPSS 0.7%CVE-2024-46666MEDIUMAn allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2EPSS 0.7%CVE-2025-57810HIGHjsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)EPSS 0.7%CVE-2023-27492MEDIUMEnvoy may crash when a large request body is processed in Lua filterEPSS 0.7%CVE-2026-50275HIGHDatadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.7%CVE-2026-88084MEDIUMMicrosoft SQL Server Denial of Service VulnerabilityEPSS 0.7%CVE-2023-2666MEDIUMAllocation of Resources Without Limits or Throttling in froxlor/froxlorEPSS 0.7%CVE-2022-46159MEDIUMAny authenticated Discourse user can create an unlisted topicEPSS 0.7%CVE-2026-27857MEDIUMSending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client EPSS 0.7%CVE-2024-55563MEDIUMBitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913. For example,EPSS 0.7%CVE-2022-4723MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.7%CVE-2026-47628HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. AEPSS 0.7%CVE-2026-40192HIGHPillow is vulnerable to a FITS GZIP decompression bombEPSS 0.7%