Weaknesses of type CWE-770

1,846 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2025-32381MEDIUMDenial of Service by abusing xgrammar unbounded cache in memoryEPSS 0.5%CVE-2024-7113HIGHAllocation of Resources Without Limits or Throttling in AVEVA SuiteLink ServerEPSS 0.5%CVE-2024-7803MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2025-54500MEDIUMHTTP/2 VulnerabilityEPSS 0.5%CVE-2025-27513HIGHOpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API PackageEPSS 0.5%CVE-2026-27571MEDIUMnats-server websockets are vulnerable to pre-auth memory DoSEPSS 0.5%CVE-2026-39313HIGHMCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transportEPSS 0.5%CVE-2026-45031MEDIUMImageMagick: Policy Bypass in PSD decoderEPSS 0.5%CVE-2026-63074MEDIUMCMP Indefinite Cache Growth of ExtraCertsEPSS 0.5%CVE-2024-9367MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-54332MEDIUMGoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoSEPSS 0.5%CVE-2025-44012HIGHQsync CentralEPSS 0.5%CVE-2026-63750MEDIUMSurrealDB before 3.1.0 Memory Amplification via /sql WebSocketEPSS 0.5%CVE-2025-49140HIGHPion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS)EPSS 0.5%CVE-2026-68074HIGHApache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.5%CVE-2026-54340HIGHh2o has HTTP/2 state amplificationEPSS 0.5%CVE-2026-67465HIGHApache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.5%CVE-2026-74836HIGHHTTP/2 connection-window starvation pins Plug processes indefinitely in BanditEPSS 0.5%CVE-2024-31919MEDIUMIBM MQ denial of serviceEPSS 0.5%CVE-2025-0993HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%