Weaknesses of type CWE-770

1,851 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2025-69233MEDIUMApache CloudStack: Domain/account resources limits not honoredEPSS 0.4%CVE-2026-50589MEDIUMIn OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JEPSS 0.4%CVE-2026-59675HIGHRancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of ServiceEPSS 0.4%CVE-2026-42127HIGHPre-authentication denial of service in the public dashboard query endpointEPSS 0.4%CVE-2026-27932HIGHjoserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)EPSS 0.4%CVE-2026-45766HIGHSuricata nfs: unbounded stateful structures can lead to resource exhaustionEPSS 0.4%CVE-2026-45765HIGHSuricata dnp3: unbounded reassembly can lead to resource exhaustionEPSS 0.4%CVE-2026-67432HIGHMCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportEPSS 0.4%CVE-2026-27729MEDIUMAstro has memory exhaustion DoS due to missing request body size limit in Server ActionsEPSS 0.4%CVE-2025-48040MEDIUMMalicious Key Exchange Messages may Lead to Excessive Resource ConsumptionEPSS 0.4%CVE-2022-20494MEDIUMIn AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could lead to local denialEPSS 0.4%CVE-2025-36319MEDIUMVulnerabilities found in Watson Data IntelligenceEPSS 0.4%CVE-2026-47628HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. AEPSS 0.4%CVE-2025-46706HIGHBIG-IP iRules vulnerabilityEPSS 0.4%CVE-2026-21434MEDIUMwebtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION CapsuleEPSS 0.4%CVE-2026-9140HIGH1718-AENTR/1719-AENTR - Denial of ServiceEPSS 0.4%CVE-2026-12818CRITICALDVP-12SE Exposure of Sensitive Information VulnerabilityEPSS 0.4%CVE-2026-73997HIGHWordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerabilityEPSS 0.4%CVE-2025-27911MEDIUMAn issue was discovered in Datalust Seq before 2024.3.13545. Expansion of identifiers in message templates can be used to bypass the system EPSS 0.4%CVE-2026-32062HIGHOpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media StreamEPSS 0.4%