Weaknesses of type CWE-770

2,202 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2025-53409MEDIUMFile Station 5EPSS 0.5%CVE-2025-53413MEDIUMFile Station 5EPSS 0.5%CVE-2025-54500MEDIUMHTTP/2 VulnerabilityEPSS 0.5%CVE-2024-9367MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-39313HIGHMCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transportEPSS 0.5%CVE-2026-45031MEDIUMImageMagick: Policy Bypass in PSD decoderEPSS 0.5%CVE-2026-34827HIGHRack: Algorithmic-Complexity DoS in Rack::Multipart::ParserEPSS 0.5%CVE-2025-68151MEDIUMCoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messagesEPSS 0.5%CVE-2025-43857MEDIUMnet-imap rubygem vulnerable to possible DoS by memory exhaustionEPSS 0.5%CVE-2026-118391HIGHUnbounded query cache growth from interpolated JSON paths and splice lists in EctoEPSS 0.5%CVE-2026-63750MEDIUMSurrealDB before 3.1.0 Memory Amplification via /sql WebSocketEPSS 0.5%CVE-2026-54273MEDIUMAIOHTTP: HTTP/1 Pipelined Requests Queue Without LimitEPSS 0.5%CVE-2026-107386MEDIUMamqp091-go: Pre-negotiation frame limit is not enforced to 4KBEPSS 0.5%CVE-2026-54340HIGHh2o has HTTP/2 state amplificationEPSS 0.5%CVE-2026-109228HIGHSGLang through 0.5.21 Resource Budget Bypass via GLM-V Video ParametersEPSS 0.5%CVE-2026-19474HIGH@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted uploadEPSS 0.5%CVE-2026-116078HIGHHTTP/2 request bodies made of 1-byte DATA frames amplify memory use in BanditEPSS 0.5%CVE-2024-31919MEDIUMIBM MQ denial of serviceEPSS 0.5%CVE-2026-25804HIGHAntrea has invalid enforcement order for network policy rules caused by integer overflowEPSS 0.5%CVE-2026-77281MEDIUMCaddy: rewrite placeholder re-expansionEPSS 0.5%