Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-81636HIGHQuery-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of serviceEPSS 0.5%CVE-2024-56316HIGHIn AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to cEPSS 0.5%CVE-2026-79921HIGHamqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized PayloadEPSS 0.5%CVE-2026-17163HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2026-13260HIGHSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.5%CVE-2026-13698MEDIUMA memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valiEPSS 0.5%CVE-2026-59279HIGHUnbounded persistent session allocation via repeated initialize requestsEPSS 0.5%CVE-2026-17170HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2025-20209HIGHCisco IOS XR Software Internet Key Exchange Version 2 Denial of Service VulnerabilityEPSS 0.5%CVE-2026-15972HIGHUnauthenticated denial of service via unbounded external gRPC connection acceptanceEPSS 0.5%CVE-2026-17271HIGHIBM i is Affected By Multiple Vulnerabilities in the Debug ServerEPSS 0.5%CVE-2026-12733HIGHIBM DataPower Gateway affected by denial of serviceEPSS 0.5%CVE-2026-16308HIGHIBM Enterprise Build of Quarkus is affected by a DoS vulnerabilityEPSS 0.5%CVE-2025-41770HIGHUnauthenticated Denial of ServiceEPSS 0.5%CVE-2026-17199HIGHIBM i is Affected By Multiple Vulnerabilities in Host ServersEPSS 0.5%CVE-2026-72888MEDIUMNet::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_requireEPSS 0.5%CVE-2026-63133HIGHMalcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)EPSS 0.5%CVE-2023-51297MEDIUMA lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amountEPSS 0.5%CVE-2026-57220HIGHRabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoSEPSS 0.5%CVE-2026-74837HIGHUnbounded atom creation from client-supplied RPC field names in AshTypescript field formatterEPSS 0.5%