Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-25985HIGHMemory allocation with excessive without limits in the internal SVG decoderEPSS 0.6%CVE-2026-73228MEDIUMDjango REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`EPSS 0.6%CVE-2026-59675HIGHRancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of ServiceEPSS 0.6%CVE-2024-33862HIGHA buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers toEPSS 0.6%CVE-2026-107937HIGHApache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.EPSS 0.6%CVE-2023-46738MEDIUMAuthenticated users can crash the CubeFS servers with maliciously crafted requestsEPSS 0.6%CVE-2026-74039HIGHWazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_contextEPSS 0.6%CVE-2026-22917MEDIUMImproper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.EPSS 0.6%CVE-2025-58582MEDIUMUncontrolled Resource Consumption via log fileEPSS 0.6%CVE-2026-59171MEDIUMJSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoSEPSS 0.6%CVE-2026-75516HIGHRabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcementEPSS 0.6%CVE-2026-55434MEDIUMCoder vulnerable to denial of service via unbounded request body in AI Bridge provider endpointsEPSS 0.6%CVE-2026-16100MEDIUMKeycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error textEPSS 0.6%CVE-2025-0635MEDIUMDenial of Service condition in M-Files ServerEPSS 0.6%CVE-2026-107166MEDIUMOpen5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resourcesEPSS 0.6%CVE-2026-103471HIGHrestbed through 5.0.0 Denial of Service via Unbounded Header BufferingEPSS 0.6%CVE-2026-85703MEDIUMramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resourcesEPSS 0.6%CVE-2025-71396LOWSurrealDB before 2.2.2 Denial of Service via JavaScript ScriptingEPSS 0.6%CVE-2023-40710MEDIUMAn adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller hEPSS 0.6%CVE-2023-40709MEDIUMUncontrolled Resource Consumption in OPTO 22 SNAP PAC S1 Built-In Web ServerEPSS 0.6%