Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-42294HIGHArgo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook InterceptorEPSS 0.6%CVE-2026-111768HIGHModel Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationEPSS 0.6%CVE-2025-58181MEDIUMUnbounded memory consumption in golang.org/x/crypto/sshEPSS 0.6%CVE-2024-57664HIGHAn issue in the sqlg_group_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crEPSS 0.6%CVE-2021-47865HIGHProFTPD 1.3.7a - Remote Denial of ServiceEPSS 0.6%CVE-2024-37302HIGHSynapse denial of service through media disk space consumptionEPSS 0.6%CVE-2025-32032HIGHApollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization BypassEPSS 0.6%CVE-2026-56387HIGHApache bRPC: Remote Memory Exhaustion in RTMP AMF ParserEPSS 0.6%CVE-2023-49559LOWAn issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the EPSS 0.6%CVE-2025-13929HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2026-112400HIGHPillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSEPSS 0.6%CVE-2023-51334MEDIUMA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cinema Booking System v1.0 allows attackers to send an excessive amouEPSS 0.6%CVE-2025-53629HIGHcpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests VulnerabilityEPSS 0.6%CVE-2026-85584HIGHSiYuan before v3.8.2 Denial of Service via Auth ThrottleEPSS 0.6%CVE-2026-111108CRITICALApache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersEPSS 0.6%CVE-2025-8885MEDIUMPossible DOS in processing specially formed ASN.1 Object IdentifiersEPSS 0.6%CVE-2026-119701MEDIUMWPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail MutationsEPSS 0.6%CVE-2026-83615HIGHxmldom: Quadratic-memory consumptionEPSS 0.6%CVE-2026-73541HIGHTempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drainEPSS 0.6%CVE-2026-63074MEDIUMCMP Indefinite Cache Growth of ExtraCertsEPSS 0.6%