Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-46340HIGHNetty: SCTP reassembly nests buffers without boundEPSS 0.6%CVE-2026-33256MEDIUMUnbounded memory allocation by internal web serverEPSS 0.6%CVE-2026-113811HIGHAlgorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in searchEPSS 0.6%CVE-2024-31446HIGHOpenComputers Denial of Service using xpcallEPSS 0.6%CVE-2024-48809HIGHAn issue in Open Networking Foundations sdran-in-a-box v.1.4.3 and onos-a1t v.0.2.3 allows a remote attacker to cause a denial of service viEPSS 0.6%CVE-2025-32031HIGHApollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization BypassEPSS 0.6%CVE-2026-42440HIGHApache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReaderEPSS 0.6%CVE-2021-47137CRITICALnet: lantiq: fix memory corruption in RX ringEPSS 0.6%CVE-2026-110499HIGHClient-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in BanditEPSS 0.6%CVE-2024-50311MEDIUMGraphql: denial of service (dos) vulnerability via graphql batchingEPSS 0.6%CVE-2026-115269HIGHHTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in BanditEPSS 0.6%CVE-2025-59830HIGHRack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parametersEPSS 0.6%CVE-2026-67317MEDIUMaxios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStreamEPSS 0.6%CVE-2026-108525HIGHHTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in BanditEPSS 0.6%CVE-2026-55078MEDIUMCoder: Zip upload decompression lacks aggregate size limit, enabling denial of serviceEPSS 0.6%CVE-2025-24033HIGH@fastify/multipart vulnerable to unlimited consumption of resourcesEPSS 0.6%CVE-2026-111101HIGHHTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in BanditEPSS 0.6%CVE-2026-114213HIGHWebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in BanditEPSS 0.6%CVE-2023-32481MEDIUM Wyse Management Suite versions prior to 4.0 contain a denial-of-service vulnerability. An authenticated malicious user can flood the configEPSS 0.6%CVE-2024-31881MEDIUMIBM Db2 denial of serviceEPSS 0.6%