Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-86452HIGHMISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request FloodingEPSS 0.5%CVE-2026-32980HIGHOpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook RequestEPSS 0.5%CVE-2026-48824MEDIUMMailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)EPSS 0.5%CVE-2026-22025MEDIUMCryptoLib Memory Leak on HTTP Error Response in KMC ClientEPSS 0.5%CVE-2026-1376HIGHIBM i Denial of ServiceEPSS 0.5%CVE-2026-115778HIGHTwisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation BufferEPSS 0.5%CVE-2024-6598HIGHDenial-of-service on KNIME Business Hub when certain jobs are executedEPSS 0.5%CVE-2026-73198HIGHIpa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body readEPSS 0.5%CVE-2026-82562MEDIUMqs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)EPSS 0.5%CVE-2025-32959MEDIUMCUBA Vulnerable to Denial of Service (DoS) in the File StorageEPSS 0.5%CVE-2026-115701HIGHCowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory ExhaustionEPSS 0.5%CVE-2026-54274MEDIUMAIOHTTP: Incomplete websocket frame payloads bypass memory limitsEPSS 0.5%CVE-2025-62426MEDIUMvLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`EPSS 0.5%CVE-2026-112899MEDIUMPillow: EPS load(scale) lets Ghostscript render past the decompression bomb limitEPSS 0.5%CVE-2026-47683HIGHvm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLikeEPSS 0.5%CVE-2019-3882MEDIUMA flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device iEPSS 0.5%CVE-2026-5497HIGHUnbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllmEPSS 0.5%CVE-2025-24341MEDIUMA vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoEPSS 0.5%CVE-2025-1072MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-8469HIGHUnauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybookEPSS 0.5%