Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2025-41693MEDIUMAuthenticated Denial-of-Service via SSHEPSS 0.5%CVE-2025-49140HIGHPion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS)EPSS 0.5%CVE-2026-115817HIGHStarman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headersEPSS 0.5%CVE-2026-33257MEDIUMInsufficient input validation of internal webserverEPSS 0.5%CVE-2026-44240HIGHbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingEPSS 0.5%CVE-2024-7803MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-20177MEDIUMCisco Industrial Ethernet 1000 Series Switches Denial of Service VulnerabilityEPSS 0.5%CVE-2026-54037MEDIUMLibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/forkEPSS 0.5%CVE-2026-76716MEDIUMUnauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)EPSS 0.5%CVE-2026-110595MEDIUMBottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV ImportEPSS 0.5%CVE-2024-49589MEDIUMFoundry artifacts denial of serviceEPSS 0.5%CVE-2026-78066HIGHApache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared SizesEPSS 0.5%CVE-2026-42788MEDIUMHTTP/2 frame size limit checked after body is buffered in banditEPSS 0.5%CVE-2026-63501HIGHag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)EPSS 0.5%CVE-2026-85107MEDIUMNousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resourcesEPSS 0.5%CVE-2026-19472HIGHRockwell Automation ArmorStart® LT Denial Of ServiceEPSS 0.5%CVE-2026-15975HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-87908HIGHmultiparty vulnerable to Denial of Service via unbounded part-header accumulationEPSS 0.5%CVE-2026-118689HIGHOvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_lengthEPSS 0.5%CVE-2020-36949MEDIUMTapinRadio 2.13.7 - Denial of ServiceEPSS 0.5%