Weaknesses of type CWE-770

1,846 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2023-3967MEDIUMDoS Vulnerability in Hitachi Ops Center Common ServicesEPSS 0.5%CVE-2025-41693MEDIUMAuthenticated Denial-of-Service via SSHEPSS 0.5%CVE-2023-44191HIGHJunos OS: QFX5000 Series and EX4000 Series: Denial of Service (DoS) on a large scale VLAN due to PFE hoggingEPSS 0.5%CVE-2024-34046HIGHThe O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->sctpParams->e2tCounters[IN_SUEPSS 0.5%CVE-2023-51393MEDIUMPotential DoS due to BusFault and Assert in Ember ZNet legacy packet bufferEPSS 0.5%CVE-2024-21771HIGHF5 AFM Signature Matching VulnerabilityEPSS 0.5%CVE-2026-91865HIGHApache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceEPSS 0.5%CVE-2026-91864HIGHApache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionEPSS 0.5%CVE-2026-33257MEDIUMInsufficient input validation of internal webserverEPSS 0.5%CVE-2026-44248MEDIUMNetty: Resource exhaustion in MqttDecoderEPSS 0.5%CVE-2026-76716MEDIUMUnauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)EPSS 0.5%CVE-2026-54345MEDIUMGoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)EPSS 0.5%CVE-2026-54037MEDIUMLibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/forkEPSS 0.5%CVE-2024-49589MEDIUMFoundry artifacts denial of serviceEPSS 0.5%CVE-2025-32030HIGHApollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment ExpansionEPSS 0.5%CVE-2023-25822MEDIUMReportPortal DoS vulnerability on creating a Launch with too many recursively nested elementsEPSS 0.5%CVE-2025-48738MEDIUMAn e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1EPSS 0.5%CVE-2026-42788MEDIUMHTTP/2 frame size limit checked after body is buffered in banditEPSS 0.5%CVE-2026-25985HIGHMemory allocation with excessive without limits in the internal SVG decoderEPSS 0.5%CVE-2026-31984HIGHDoS through oversized audit log entries in Guardian/CMC before 26.2.0EPSS 0.5%