Weaknesses of type CWE-770

1,851 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2024-49589MEDIUMFoundry artifacts denial of serviceEPSS 0.5%CVE-2025-48738MEDIUMAn e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1EPSS 0.5%CVE-2026-85107MEDIUMNousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resourcesEPSS 0.5%CVE-2026-31984HIGHDoS through oversized audit log entries in Guardian/CMC before 26.2.0EPSS 0.5%CVE-2026-87908HIGHmultiparty vulnerable to Denial of Service via unbounded part-header accumulationEPSS 0.5%CVE-2026-15975HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-33232HIGHAutoGPT: Unauthenticated DoS via Disk Space ExhaustionEPSS 0.5%CVE-2021-47793MEDIUMTelegram Desktop 2.9.2 - Denial of Service (PoC)EPSS 0.5%CVE-2024-12379MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-81176MEDIUMSvelte devalue: DoS via malformed inputEPSS 0.5%CVE-2026-67446MEDIUMMailpit: Thumbnail generation decodes unbounded image dimensions before scalingEPSS 0.5%CVE-2026-59248HIGHUnbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoSEPSS 0.5%CVE-2026-34062MEDIUMNimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/responseEPSS 0.5%CVE-2026-52732MEDIUMZEBRA: Mempool transaction admission denial via single-peer inbound queue saturationEPSS 0.5%CVE-2026-45557MEDIUMTechnitium DNS Server excessive DNSSEC requestsEPSS 0.5%CVE-2026-34517LOWAIOHTTP: Late size enforcement for non-file multipart fields causes memory DoSEPSS 0.5%CVE-2022-22488MEDIUMIBM OpenBMC denial of serviceEPSS 0.5%CVE-2025-12571HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-67430MEDIUMMCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize floodEPSS 0.5%CVE-2026-67447MEDIUMMailpit: SMTP DATA line reader buffers over-limit input before size enforcementEPSS 0.5%