Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-63299HIGHStorage volume cross-project move and snapshot restore bypass project disk limitsEPSS 0.6%CVE-2023-32699MEDIUMMeterSphere denial of service vulnerabilityEPSS 0.6%CVE-2023-37934MEDIUMAn allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attackeEPSS 0.6%CVE-2026-73197HIGHIpa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body readEPSS 0.6%CVE-2024-28870HIGHSuricata uses excessive resource use in malformed ssh traffic parsingEPSS 0.6%CVE-2026-49955MEDIUMHermes WebUI < 0.51.270 Resource Exhaustion via passkey/optionsEPSS 0.6%CVE-2026-1102MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2026-40006HIGHApache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiverEPSS 0.6%CVE-2024-48530HIGHAn issue in the Instructor Appointment Availability module of eSoft Planner 3.24.08271-USA allows attackers to cause a Denial of Service (DoEPSS 0.6%CVE-2025-53069MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected arEPSS 0.6%CVE-2021-47752HIGHAWebServer GhostBuilding 18 - Denial of Service (DoS)EPSS 0.6%CVE-2025-49007MEDIUMReDoS Vulnerability in Rack::Multipart handle_mime_headEPSS 0.6%CVE-2026-33258MEDIUMCrafted zones can cause increased resource usageEPSS 0.6%CVE-2024-44241CRITICALThe issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An attacker may beEPSS 0.6%CVE-2025-69223HIGHAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombEPSS 0.6%CVE-2026-69147MEDIUMvLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservationEPSS 0.6%CVE-2026-67230MEDIUMRabbitMQ: Web-STOMP unbounded pre-auth accumulationEPSS 0.6%CVE-2026-33012HIGHMicronaut Framework vulnerable to a Denial of Service in HTML error response cachingEPSS 0.6%CVE-2026-81624HIGHUndertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infiniteEPSS 0.6%CVE-2026-90668HIGHThe webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackerEPSS 0.6%