Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-42793HIGHAtom table exhaustion via attacker-controlled GraphQL SDL names in absintheEPSS 0.6%CVE-2026-71310MEDIUMrclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone MemoryEPSS 0.6%CVE-2024-30249HIGHCloudburst Network DoS in RakNet connection handlingEPSS 0.6%CVE-2026-44253MEDIUMWazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulationEPSS 0.6%CVE-2024-0081HIGH NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources withouEPSS 0.6%CVE-2026-115448HIGHApache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverableEPSS 0.6%CVE-2026-63495HIGHLibevent: Unbounded memory accumulation in WebSocket server via fragmented framesEPSS 0.6%CVE-2023-25822MEDIUMReportPortal DoS vulnerability on creating a Launch with too many recursively nested elementsEPSS 0.6%CVE-2025-30202HIGHData exposure via ZeroMQ on multi-node vLLM deploymentEPSS 0.6%CVE-2026-82399HIGHCoreDNS: Unauthenticated memory exhaustion in custom transportsEPSS 0.6%CVE-2026-86075HIGHn8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration EndpointEPSS 0.6%CVE-2026-49146HIGHApp::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrcEPSS 0.6%CVE-2026-59899MEDIUMNetty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of ServiceEPSS 0.6%CVE-2023-33720MEDIUMmp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty.EPSS 0.6%CVE-2026-115824HIGHStarman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodiesEPSS 0.6%CVE-2026-108395HIGHModel Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodiesEPSS 0.6%CVE-2025-10858HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2026-54063HIGHExcelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)EPSS 0.6%CVE-2026-45713HIGHMailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizesEPSS 0.6%CVE-2026-84784HIGHQUIC: Unbounded RETIRE_CONNECTION_ID BacklogEPSS 0.6%