Weaknesses of type CWE-770

1,834 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2019-16770MEDIUMPotential DOS attack in PumaEPSS 2.0%CVE-2022-22970—In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable tEPSS 2.0%CVE-2022-3423HIGHAllocation of Resources Without Limits or Throttling in nocodb/nocodbEPSS 2.0%CVE-2024-56374MEDIUMAn issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strinEPSS 1.9%CVE-2021-34735HIGHCisco ATA 190 Series Analog Telephone Adapter Software VulnerabilitiesEPSS 1.9%CVE-2024-12254HIGHUnbounded memory buffering in SelectorSocketTransport.writelines()EPSS 1.9%CVE-2020-28400HIGHAffected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerabilityEPSS 1.9%CVE-2023-27530HIGHA DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could alEPSS 1.8%CVE-2023-25193HIGHhb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looEPSS 1.8%CVE-2018-3711—Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" andEPSS 1.8%CVE-2021-27383HIGHA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 1.8%CVE-2023-34455HIGHsnappy-java's unchecked chunk length leads to DoSEPSS 1.8%CVE-2024-38821CRITICALAuthorization Bypass of Static Resources in WebFlux ApplicationsEPSS 1.7%CVE-2018-3737—sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.EPSS 1.7%CVE-2022-35724—Denial of service while reading data in Avro Rust SDKEPSS 1.7%CVE-2022-36324HIGHAffected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypaEPSS 1.7%CVE-2023-23916MEDIUMAn allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algoriEPSS 1.7%CVE-2020-15168LOWFile size limit bypass in node-fetchEPSS 1.7%CVE-2024-38286HIGHApache Tomcat: Denial of ServiceEPSS 1.7%CVE-2025-26682HIGHASP.NET Core and Visual Studio Denial of Service VulnerabilityEPSS 1.7%