Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-64646MEDIUMNext.js: Unbounded Server Action payload in Edge runtimeEPSS 0.5%CVE-2026-11946HIGHGetEndpoints Memory Exhaustion in open62541EPSS 0.5%CVE-2026-53653HIGHGrav: Unauthenticated denial of service via unbounded image derivative dimensionsEPSS 0.5%CVE-2026-77528MEDIUMAutobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflationEPSS 0.5%CVE-2026-33592HIGHFindServers Memory Exhaustion in open62541EPSS 0.5%CVE-2026-55619MEDIUMeml_parser: Parser DoS via deeply nested parentheses in e-mail headersEPSS 0.5%CVE-2025-53628MEDIUMcpp-httplib does not limit the length of a lineEPSS 0.5%CVE-2025-70071MEDIUMAn issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray()EPSS 0.5%CVE-2024-6826MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-47891CRITICALSpring Framework maxInMemorySize Bypassed in Jaxb2DecoderEPSS 0.5%CVE-2026-93308MEDIUMO-RAN-SC SMO OAM VES Collector allocation of resourcesEPSS 0.5%CVE-2026-67297HIGHFreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP responseEPSS 0.5%CVE-2025-57710LOWQsync CentralEPSS 0.5%CVE-2025-57711LOWQsync CentralEPSS 0.5%CVE-2024-58259HIGHRancher affected by unauthenticated Denial of ServiceEPSS 0.5%CVE-2025-10569MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-93309MEDIUMO-RAN-SC SMO OAM VES Collector allocation of resourcesEPSS 0.5%CVE-2025-58471LOWQsync CentralEPSS 0.5%CVE-2024-52918MEDIUMBitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) viaEPSS 0.5%CVE-2018-25108HIGHWAGO: Denial of service in 750-8xx controller due to uncontrolled resource consumptionEPSS 0.5%