Weaknesses of type CWE-770

1,846 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2025-54121MEDIUMStarlette has possible denial-of-service vector when parsing large files in multipart formsEPSS 0.6%CVE-2025-51846HIGHCryptPad unbounded WebSocket frame floodEPSS 0.6%CVE-2024-47614HIGHasync-graphql vulnerable to Directive OverloadEPSS 0.6%CVE-2026-5680HIGHUndertow-core: undertow: denial of service via websocket permessage-deflate processingEPSS 0.6%CVE-2025-32032HIGHApollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization BypassEPSS 0.6%CVE-2025-30202HIGHData exposure via ZeroMQ on multi-node vLLM deploymentEPSS 0.6%CVE-2026-20216HIGHClamAV InstallShield File Format Processing Resource Exhaustion VulnerabilityEPSS 0.6%CVE-2026-70464HIGHrsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake StallEPSS 0.6%CVE-2026-59762HIGHBIG-IP HTTP/2 vulnerabilityEPSS 0.6%CVE-2025-59830HIGHRack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parametersEPSS 0.6%CVE-2025-24033HIGH@fastify/multipart vulnerable to unlimited consumption of resourcesEPSS 0.6%CVE-2024-57664HIGHAn issue in the sqlg_group_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crEPSS 0.6%CVE-2026-48853CRITICALRemote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcEPSS 0.6%CVE-2025-44652HIGHIn Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attEPSS 0.6%CVE-2025-68272HIGHSignal K Server Vulnerable to Denial of Service via Unrestricted Access Request FloodingEPSS 0.6%CVE-2024-28762MEDIUMIBM Db2 denial of serviceEPSS 0.6%CVE-2021-47752HIGHAWebServer GhostBuilding 18 - Denial of Service (DoS)EPSS 0.6%CVE-2026-40498HIGHFreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cronEPSS 0.6%CVE-2025-69223HIGHAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombEPSS 0.6%CVE-2026-80212HIGHAn issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, andEPSS 0.6%