Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-42786HIGHWebSocket fragmented message reassembly unbounded in banditEPSS 0.6%CVE-2026-69152HIGHbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationEPSS 0.6%CVE-2024-52915HIGHBitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.EPSS 0.6%CVE-2026-103042HIGHLightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_valueEPSS 0.6%CVE-2024-43709MEDIUMElasticsearch allocation of resources without limits or throttling leads to crashEPSS 0.6%CVE-2023-5573MEDIUMAllocation of Resources Without Limits or Throttling in vriteio/vriteEPSS 0.6%CVE-2024-26577HIGHVSeeFace through 1.13.38.c2 allows attackers to cause a denial of service (application hang) via a spoofed UDP packet containing at least 10EPSS 0.6%CVE-2026-49476HIGHSoup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieveEPSS 0.6%CVE-2026-87011HIGHOpen WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutEPSS 0.6%CVE-2025-0189HIGHDenial of Service in aimhubio/aimEPSS 0.6%CVE-2026-94613HIGHauthentik: Denial of Service via Document Type Declarations in SAML MessagesEPSS 0.6%CVE-2026-14257HIGHbrace-expansion DoS via unbounded expansion length causing an out-of-memory process crashEPSS 0.6%CVE-2026-39803HIGHHTTP/1 chunked body reader ignores length cap in banditEPSS 0.6%CVE-2023-23603MEDIUMCalls to console.log allowed bypassing Content Security Policy via format directiveEPSS 0.6%CVE-2026-70464HIGHrsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake StallEPSS 0.6%CVE-2026-64868HIGHNew API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body loggingEPSS 0.6%CVE-2025-1451HIGHInsufficient Patch Leading to DoS in parisneo/lollms-webuiEPSS 0.6%CVE-2024-47502HIGHJunos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoSEPSS 0.6%CVE-2025-61920HIGHAuthlib is vulnerable to Denial of Service via Oversized JOSE SegmentsEPSS 0.6%CVE-2026-21728HIGHTempo query limit results in unbounded memory allocationEPSS 0.6%