Weaknesses of type CWE-770

1,851 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-91990HIGHTornado before 6.5.8 Memory Amplification DoS via multipartEPSS 0.5%CVE-2026-54465MEDIUMwebsocket-driver: Memory exhaustion in HTTP header parserEPSS 0.5%CVE-2026-9675HIGHundici WebSocket client vulnerable to denial of service via cumulative fragment bypassEPSS 0.5%CVE-2026-24514MEDIUMingress-nginx Admission Controller denial of serviceEPSS 0.5%CVE-2026-40898MEDIUMquic-go: HTTP/3 QPACK Trailer Expansion Memory ExhaustionEPSS 0.5%CVE-2026-44453HIGHh2o is vulnerable to musl libc stack overflowEPSS 0.5%CVE-2026-37736HIGHAn issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a EPSS 0.5%CVE-2026-91864HIGHApache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionEPSS 0.5%CVE-2026-52880HIGHKlever-Go: REST API slow-header connection exhaustion via Gin Engine.RunEPSS 0.5%CVE-2026-54463MEDIUMwebsocket-driver: Memory exhaustion via abuse of protocol length headersEPSS 0.5%CVE-2026-52879HIGHKlever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoSEPSS 0.5%CVE-2026-48809HIGHpython-engineio has possible denial of service due to maximum payload size sometimes not being enforcedEPSS 0.5%CVE-2026-74788HIGHScriban before 7.0.0 Denial of Service via string.pad_left/pad_rightEPSS 0.5%CVE-2026-48804HIGHpython-socketio: Binary attachment accumulation can cause denial of serviceEPSS 0.5%CVE-2024-44459HIGHA memory allocation issue in vernemq v2.0.1 allows attackers to cause a Denial of Service (DoS) via excessive memory consumption.EPSS 0.5%CVE-2026-91865HIGHApache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceEPSS 0.5%CVE-2026-91866HIGHApache Neethi: Crafted policies cause unbounded work during intersection leading to denial of serviceEPSS 0.5%CVE-2026-7768HIGH@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache GrowthEPSS 0.5%CVE-2026-44433MEDIUMQuicly is vulnerable to memory exhaustionEPSS 0.5%CVE-2026-73062HIGHScriban 3.0.0 through 7.2.0 Denial of Service via Array MultiplicationEPSS 0.5%