Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-62649HIGHA vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resourcEPSS 0.6%CVE-2026-59762HIGHBIG-IP HTTP/2 vulnerabilityEPSS 0.6%CVE-2024-28762MEDIUMIBM Db2 denial of serviceEPSS 0.6%CVE-2026-34148HIGHFedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolutionEPSS 0.6%CVE-2026-40498HIGHFreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cronEPSS 0.6%CVE-2026-92003MEDIUMMISP Unthrottled Authentication Failure Log Writes Enable Resource ExhaustionEPSS 0.6%CVE-2026-63075HIGHQUIC ACK-only Packet Retention Can Cause Memory ExhaustionEPSS 0.6%CVE-2026-80463HIGHApache bRPC: Unbounded Memory Accumulation in Stream Message ReassemblyEPSS 0.6%CVE-2026-58064HIGHApache bRPC: Denial of Service via Unbounded Redis Inline Command AllocationEPSS 0.6%CVE-2025-53032MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.EPSS 0.6%CVE-2026-56862HIGHLimit handshake messages we are willing to accept post-handshake in crypto/tlsEPSS 0.6%CVE-2024-38808MEDIUMCVE-2024-38808: Spring Expression DoS VulnerabilityEPSS 0.6%CVE-2026-56859HIGHAdd recursion depth guard during decode in encoding/xmlEPSS 0.6%CVE-2026-56853HIGHApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpEPSS 0.6%CVE-2022-3273LOWAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.6%CVE-2026-91149HIGHCockpit: cockpit: denial of service via unbounded connection thread spawningEPSS 0.6%CVE-2026-70455HIGHrsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread ExhaustionEPSS 0.6%CVE-2026-32049HIGHOpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit BypassEPSS 0.6%CVE-2025-68272HIGHSignal K Server Vulnerable to Denial of Service via Unrestricted Access Request FloodingEPSS 0.6%CVE-2024-55195HIGHAn allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the prograEPSS 0.6%