Weaknesses of type CWE-770

1,850 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-73635HIGHApache Struts: Unbounded growth of localized-text caches driven by the request localeEPSS 0.5%CVE-2025-3111MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2021-47959HIGHWordPress Plugin WPGraphQL 1.3.5 Denial of ServiceEPSS 0.5%CVE-2026-26998MEDIUMTraefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)EPSS 0.5%CVE-2025-36047MEDIUMIBM WebSphere Application Server Liberty denial of serviceEPSS 0.5%CVE-2026-67447MEDIUMMailpit: SMTP DATA line reader buffers over-limit input before size enforcementEPSS 0.5%CVE-2026-62210MEDIUMOpenClaw < 2026.6.1 Denial of Service via Remote Media URLsEPSS 0.4%CVE-2025-59139MEDIUMHono has Body Limit Middleware BypassEPSS 0.4%CVE-2024-23826MEDIUMUploading an image with a specific filename causes a server-side DoS EPSS 0.4%CVE-2025-6016MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.4%CVE-2025-32386MEDIUMHelm Allows A Specially Crafted Chart Archive To Cause Out Of Memory TerminationEPSS 0.4%CVE-2026-22773MEDIUMvLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensionsEPSS 0.4%CVE-2026-15561HIGHUndertow-core: oom via missing limits in chunked trailer in eap's undertowEPSS 0.4%CVE-2023-4138MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.4%CVE-2026-49835MEDIUMSigstore Timestamp Authority: OOM due to unbounded metric label cardinalityEPSS 0.4%CVE-2026-94624HIGHvLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading SessionsEPSS 0.4%CVE-2026-23957HIGHseroval is vulnerable to Denial of Service via array serializationEPSS 0.4%CVE-2026-24006HIGHSeroval affected by Denial of Service via Deeply Nested ObjectsEPSS 0.4%CVE-2026-11972HIGHtarfile opened in streaming mode mishandles EOFEPSS 0.4%CVE-2026-54464MEDIUMwebsocket-driver: Resource limit bypass via message compressionEPSS 0.4%