Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-55497MEDIUMCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)EPSS 0.5%CVE-2026-42931MEDIUMDenial of Service via Unbounded io.ReadAll in NPM Package Tag EndpointEPSS 0.5%CVE-2025-12571HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2024-8028HIGHDenial of Service in danswer-ai/danswerEPSS 0.5%CVE-2026-75804MEDIUMQUIC Connection-Level Flow Control is Not Enforced for StreamsEPSS 0.5%CVE-2024-10713HIGHDenial of Service (DoS) via Multipart Request in szad670401/hyperlprEPSS 0.5%CVE-2026-73565MEDIUM@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshakeEPSS 0.5%CVE-2025-52568HIGHNeKernal Multiple Memory Corruption Vulnerabilities in mkfs.hefsEPSS 0.5%CVE-2026-100302HIGHApache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handlingEPSS 0.5%CVE-2022-22488MEDIUMIBM OpenBMC denial of serviceEPSS 0.5%CVE-2026-75140HIGHjsoup Uncontrolled Resource Consumption in XmlTreeBuilderEPSS 0.5%CVE-2026-107379MEDIUMenshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration CrashEPSS 0.5%CVE-2026-41400MEDIUMOpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-callEPSS 0.5%CVE-2026-64646MEDIUMNext.js: Unbounded Server Action payload in Edge runtimeEPSS 0.5%CVE-2026-82728HIGHUnbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoSEPSS 0.5%CVE-2026-53941MEDIUMInspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoSEPSS 0.5%CVE-2026-53653HIGHGrav: Unauthenticated denial of service via unbounded image derivative dimensionsEPSS 0.5%CVE-2026-77403HIGHRabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size NegotiationEPSS 0.5%CVE-2026-55205MEDIUMHermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow EndpointEPSS 0.5%CVE-2026-57497MEDIUMwebtransport-go: Memory Exhaustion Attack due to Buffering of Unknown CapsulesEPSS 0.5%