Weaknesses of type CWE-770

1,846 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2025-26819HIGHMonero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections.EPSS 0.6%CVE-2024-33862HIGHA buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers toEPSS 0.6%CVE-2026-59873CRITICALnode-tar: Decompression/parse DoS via unlimited inputEPSS 0.6%CVE-2026-50142HIGHlibheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)EPSS 0.6%CVE-2026-55241HIGHCheckmate: Pre-auth Denial of Service via File Upload on RegistrationEPSS 0.6%CVE-2023-46738MEDIUMAuthenticated users can crash the CubeFS servers with maliciously crafted requestsEPSS 0.6%CVE-2024-45100MEDIUMIBM Security QRadar EDR denial of serviceEPSS 0.6%CVE-2025-58582MEDIUMUncontrolled Resource Consumption via log fileEPSS 0.6%CVE-2026-65654HIGHtemporalio/ringpop-go fails to enforce configured label limits on inbound membership gossipEPSS 0.6%CVE-2026-23881HIGHKyverno Denial of Service via Context Variable Amplification in Policy EngineEPSS 0.6%CVE-2026-55434MEDIUMCoder vulnerable to denial of service via unbounded request body in AI Bridge provider endpointsEPSS 0.6%CVE-2022-45471LOWIn JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email addressEPSS 0.6%CVE-2026-29062HIGHjackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource ExhaustionEPSS 0.6%CVE-2023-40709MEDIUMUncontrolled Resource Consumption in OPTO 22 SNAP PAC S1 Built-In Web ServerEPSS 0.6%CVE-2026-34148HIGHFedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolutionEPSS 0.6%CVE-2026-54135HIGHAirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP ServerEPSS 0.6%CVE-2023-40710MEDIUMAn adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller hEPSS 0.6%CVE-2026-42786HIGHWebSocket fragmented message reassembly unbounded in banditEPSS 0.5%CVE-2026-23962HIGHMastodon vulnerable to Denial of Service from a single post (client/server)EPSS 0.5%CVE-2026-15711HIGHLibsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violationEPSS 0.5%