Weaknesses of type CWE-770
1,834 resultsAlocação irrestrita de recursos
É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.
Example
Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.
How to mitigate
Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.
CVE-2020-18899MEDIUMAn uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of serEPSS 1.7%CVE-2017-2613MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained untEPSS 1.6%CVE-2005-4650MEDIUMJoomla! 1.03 does not restrict the number of "Search" Mambots, which allows remote attackers to cause a denial of service (resource consumptEPSS 1.6%CVE-2023-27958CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.EPSS 1.6%CVE-2022-36104MEDIUMDenial of Service via Page Error Handling in TYPO3/cmsEPSS 1.6%CVE-2026-1519HIGHExcessive NSEC3 iterations cause high CPU load during insecure delegation validationEPSS 1.6%CVE-2025-41704MEDIUMPhoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function CodeEPSS 1.6%CVE-2023-47108HIGHDoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metricsEPSS 1.6%CVE-2019-11939—Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, mEPSS 1.6%CVE-2026-23869HIGHA denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-serverEPSS 1.6%CVE-2022-21952HIGHSUMA unauthenticated remote DoS via resource exhaustionEPSS 1.5%CVE-2022-26336—A carefully crafted TNEF file can cause an out of memory exceptionEPSS 1.5%CVE-2023-39533HIGHlibp2p nodes vulnerable to attack using large RSA keysEPSS 1.5%CVE-2025-50172MEDIUMDirectX Graphics Kernel Denial of Service VulnerabilityEPSS 1.5%CVE-2022-0084—A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expecEPSS 1.5%CVE-2021-33541HIGHPhoenix Contact: ILC1x Industrial controllers affected by Denial-of-Service vulnerabilityEPSS 1.5%CVE-2023-24536HIGHExcessive resource consumption in net/http, net/textproto and mime/multipartEPSS 1.5%CVE-2023-27643HIGHAn issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button EPSS 1.5%CVE-2024-31208MEDIUMSynapse's V2 state resolution weakness allows DoS from remote room membersEPSS 1.5%CVE-2023-25576HIGH@fastify/multipart vulnerable to DoS due to unlimited number of partsEPSS 1.5%