Weaknesses of type CWE-770

1,850 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-54024MEDIUMLibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size LimitsEPSS 0.4%CVE-2026-54448MEDIUMTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parserEPSS 0.4%CVE-2026-92003MEDIUMMISP Unthrottled Authentication Failure Log Writes Enable Resource ExhaustionEPSS 0.4%CVE-2025-3221HIGHIBM InfoSphere Information Server denial of serviceEPSS 0.4%CVE-2026-69202HIGHHttp4s Ember HTTP/2: unbounded inbound body bufferingEPSS 0.4%CVE-2026-30067HIGHAn issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of SEPSS 0.4%CVE-2026-53752HIGHdocx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of ServiceEPSS 0.4%CVE-2026-30073HIGHAn issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crEPSS 0.4%CVE-2026-12707HIGHUnbounded path event queue growth in quiche via peer-driven source connection ID rotationEPSS 0.4%CVE-2026-60000LOWsshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attemptEPSS 0.4%CVE-2026-45664MEDIUMImageMagick: Policy Bypass in MNG coder couldEPSS 0.4%CVE-2023-25656HIGHnotation-go has excessive memory allocation on verificationEPSS 0.4%CVE-2025-59421LOWPress vulnerable to email flooding to users due to lack of validation and rate limitsEPSS 0.4%CVE-2026-34513LOWAIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnectorEPSS 0.4%CVE-2026-14362MEDIUMDenial of service via crafted push/pull gossip message in memberlistEPSS 0.4%CVE-2025-62666MEDIUMDoS vector through the cirrusbuilddoc query APIEPSS 0.4%CVE-2026-34516MEDIUMAIOHTTP: Multipart Header Size BypassEPSS 0.4%CVE-2026-22815MEDIUMAIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headersEPSS 0.4%CVE-2026-55831HIGHNetty SPDY SETTINGS frame count materializes unbounded settings mapEPSS 0.4%CVE-2026-5316MEDIUMNothings stb stb_vorbis.c setup_free allocation of resourcesEPSS 0.4%