Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-86040HIGHlibp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoSEPSS 0.7%CVE-2026-44488HIGHAxios: Allocation of Resources Without Limits or Throttling in axiosEPSS 0.7%CVE-2024-35231HIGHrack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameterEPSS 0.7%CVE-2023-51339MEDIUMA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Event Ticketing System v1.0 allows attackers to send an excessive amoEPSS 0.7%CVE-2026-55831HIGHNetty SPDY SETTINGS frame count materializes unbounded settings mapEPSS 0.7%CVE-2023-34389MEDIUMAllocation of resources without limits could lead to denial of serviceEPSS 0.7%CVE-2026-118487HIGHHeap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParserEPSS 0.7%CVE-2025-0315HIGHAllocation of Resources Without Limits or Throttling in ollama/ollamaEPSS 0.7%CVE-2023-22323HIGHBIG-IP SSL OCSP Authentication profile vulnerabilityEPSS 0.7%CVE-2026-78667HIGHLack of limit on size of parsed Range headers in net/httpEPSS 0.7%CVE-2023-22403HIGHJunos OS: QFX10K Series: An ICCP flap will be observed due to excessive specific trafficEPSS 0.7%CVE-2025-54121MEDIUMStarlette has possible denial-of-service vector when parsing large files in multipart formsEPSS 0.7%CVE-2026-82753HIGHUnauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_serverEPSS 0.7%CVE-2026-86696HIGHUnbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustionEPSS 0.7%CVE-2026-111751HIGHAngular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)EPSS 0.7%CVE-2023-41038HIGHServer crash when using specific form of SET BIND statementEPSS 0.7%CVE-2026-91080HIGHwebhook through 2.8.3 Memory Exhaustion via Oversized Request BodyEPSS 0.7%CVE-2026-85664HIGHChroma 1.5.9 Unbounded HNSW Index Parameters Memory ExhaustionEPSS 0.7%CVE-2024-29902MEDIUMCosign vulnerable to system-wide denial of service via malicious attachmentsEPSS 0.7%CVE-2026-35469HIGHSpdyStream: DOS on CRIEPSS 0.7%