Weaknesses of type CWE-770

1,833 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-26130HIGHASP.NET Core Denial of Service VulnerabilityEPSS 2.8%CVE-2017-15124—VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as iEPSS 2.8%CVE-2022-23913—Apache ActiveMQ Artemis DoSEPSS 2.7%CVE-2019-14834LOWA vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memoryEPSS 2.7%CVE-2021-34710HIGHCisco ATA 190 Series Analog Telephone Adapter Software VulnerabilitiesEPSS 2.6%CVE-2024-57972MEDIUMThe pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) tEPSS 2.5%CVE-2016-9578HIGHA vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server coEPSS 2.5%CVE-2026-45591HIGHASP.NET Core Denial of Service VulnerabilityEPSS 2.5%CVE-2021-40114MEDIUMMultiple Cisco Products Snort Memory Leak Denial of Service VulnerabilityEPSS 2.4%CVE-2025-9784HIGHUndertow: undertow madeyoureset http/2 ddos vulnerabilityEPSS 2.3%CVE-2024-43567HIGHWindows Hyper-V Denial of Service VulnerabilityEPSS 2.3%CVE-2024-22255HIGHInformation disclosure vulnerabilityEPSS 2.3%CVE-2019-11938—Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malEPSS 2.3%CVE-2021-36630HIGHDDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform DEPSS 2.2%CVE-2018-10908MEDIUMIt was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafEPSS 2.2%CVE-2025-61726HIGHMemory exhaustion in query parameter parsing in net/urlEPSS 2.2%CVE-2018-16846MEDIUMIt was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indEPSS 2.1%CVE-2019-3553—C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, maliEPSS 2.1%CVE-2024-1975HIGHSIG(0) can be used to exhaust CPU resourcesEPSS 2.1%CVE-2024-1737HIGHBIND's database will be slow if a very large number of RRs exist at the same nameEPSS 2.1%