Weaknesses of type CWE-770

1,846 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-56859HIGHAdd recursion depth guard during decode in encoding/xmlEPSS 0.6%CVE-2026-56853HIGHApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpEPSS 0.6%CVE-2026-56862HIGHLimit handshake messages we are willing to accept post-handshake in crypto/tlsEPSS 0.6%CVE-2024-38808MEDIUMCVE-2024-38808: Spring Expression DoS VulnerabilityEPSS 0.6%CVE-2026-70455HIGHrsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread ExhaustionEPSS 0.6%CVE-2026-2581MEDIUMundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoSEPSS 0.6%CVE-2024-10051HIGHUnauthenticated Denial of Service in shaunwei/realcharEPSS 0.6%CVE-2025-27419CRITICALDenial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLsEPSS 0.6%CVE-2026-50270HIGHdd-trace-java: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.6%CVE-2026-50277HIGHdd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.6%CVE-2026-54788HIGHdd-trace-rs: Unbounded W3C tracestate parsing may lead to DoSEPSS 0.6%CVE-2026-30946HIGHParse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL APIEPSS 0.6%CVE-2025-58181MEDIUMUnbounded memory consumption in golang.org/x/crypto/sshEPSS 0.6%CVE-2026-22917MEDIUMImproper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.EPSS 0.6%CVE-2026-33012HIGHMicronaut Framework vulnerable to a Denial of Service in HTML error response cachingEPSS 0.6%CVE-2026-49209MEDIUMSymfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requestsEPSS 0.6%CVE-2025-49007MEDIUMReDoS Vulnerability in Rack::Multipart handle_mime_headEPSS 0.6%CVE-2024-39944HIGHA vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, caEPSS 0.6%CVE-2025-62672MEDIUMrplay through 3.3.2 allows attackers to cause a denial of service (SIGSEGV and daemon crash) or possibly have unspecified other impact. ThisEPSS 0.6%CVE-2025-32380HIGHApollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment ProcessingEPSS 0.6%