Weaknesses of type CWE-770

1,846 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2024-48989HIGHA vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial EPSS 0.5%CVE-2025-12767MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.5%CVE-2023-0616MEDIUMIf a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, EPSS 0.5%CVE-2024-52918MEDIUMBitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) viaEPSS 0.5%CVE-2025-52568HIGHNeKernal Multiple Memory Corruption Vulnerabilities in mkfs.hefsEPSS 0.5%CVE-2026-57080HIGHNet::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefixEPSS 0.5%CVE-2026-24514MEDIUMingress-nginx Admission Controller denial of serviceEPSS 0.5%CVE-2024-44459HIGHA memory allocation issue in vernemq v2.0.1 allows attackers to cause a Denial of Service (DoS) via excessive memory consumption.EPSS 0.5%CVE-2026-44453HIGHh2o is vulnerable to musl libc stack overflowEPSS 0.5%CVE-2026-82728HIGHUnbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoSEPSS 0.5%CVE-2026-42236HIGHn8n: Unauthenticated Denial of Service via MCP Client RegistrationEPSS 0.5%CVE-2025-57710LOWQsync CentralEPSS 0.5%CVE-2025-1477MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2025-57711LOWQsync CentralEPSS 0.5%CVE-2026-54297HIGHFaraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parametersEPSS 0.5%CVE-2025-58471LOWQsync CentralEPSS 0.5%CVE-2026-68956HIGHSSH daemon allocates unbounded idle session channels, bypassing max_channelsEPSS 0.5%CVE-2025-53032MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.EPSS 0.5%CVE-2026-50275HIGHDatadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.5%CVE-2026-81176MEDIUMSvelte devalue: DoS via malformed inputEPSS 0.5%