Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-90668HIGHThe webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackerEPSS 0.6%CVE-2024-8391MEDIUMEclipse Vert.x gRPC server does not limit the maximum message sizeEPSS 0.6%CVE-2023-5963LOWAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2025-32380HIGHApollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment ProcessingEPSS 0.6%CVE-2026-108147MEDIUMPotential memory exhaustion in MultiPartParser via base64-encoded file uploadEPSS 0.6%CVE-2026-15588MEDIUMGdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line bufferingEPSS 0.6%CVE-2025-51846HIGHCryptPad unbounded WebSocket frame floodEPSS 0.6%CVE-2025-61028HIGHAn issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.6%CVE-2026-65654HIGHtemporalio/ringpop-go fails to enforce configured label limits on inbound membership gossipEPSS 0.6%CVE-2024-10051HIGHUnauthenticated Denial of Service in shaunwei/realcharEPSS 0.6%CVE-2026-74835HIGHinets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body ReceptionEPSS 0.6%CVE-2026-73214HIGHcoturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoSEPSS 0.6%CVE-2024-47614HIGHasync-graphql vulnerable to Directive OverloadEPSS 0.6%CVE-2024-45100MEDIUMIBM Security QRadar EDR denial of serviceEPSS 0.6%CVE-2026-85581HIGHSiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registrationEPSS 0.6%CVE-2026-48802HIGHpython-engineio has unbound thread allocation that can cause denial of serviceEPSS 0.6%CVE-2023-4912LOWAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2025-27419CRITICALDenial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLsEPSS 0.6%CVE-2026-20216HIGHClamAV InstallShield File Format Processing Resource Exhaustion VulnerabilityEPSS 0.6%CVE-2026-75508HIGHGraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitEPSS 0.6%