Weaknesses of type CWE-770

1,851 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-35526HIGHStrawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptionsEPSS 0.5%CVE-2026-26061HIGHFleet's unbounded request body read allows remote Denial of ServiceEPSS 0.5%CVE-2021-47713HIGHHasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL QueryEPSS 0.5%CVE-2026-54283HIGHStarlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoSEPSS 0.5%CVE-2024-7734MEDIUMPhoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors.EPSS 0.5%CVE-2026-42036MEDIUMAxios: HTTP adapter streamed responses bypass maxContentLengthEPSS 0.5%CVE-2022-3273LOWAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.5%CVE-2026-42034MEDIUMAxios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0EPSS 0.5%CVE-2024-4311MEDIUMLack of login attempt rate-limiting in zenml-io/zenmlEPSS 0.5%CVE-2026-15588MEDIUMGdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line bufferingEPSS 0.5%CVE-2026-0531MEDIUMAllocation of Resources Without Limits or Throttling in Kibana FleetEPSS 0.5%CVE-2026-54894MEDIUMAtom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keysEPSS 0.5%CVE-2026-91987HIGHatomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown ModelEPSS 0.5%CVE-2026-55733MEDIUMAtom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creationEPSS 0.5%CVE-2026-56150MEDIUMAllocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of ServiceEPSS 0.5%CVE-2026-74786HIGHScriban before 7.0.0 Denial of Service via Unbounded Template OutputEPSS 0.5%CVE-2023-30443MEDIUMIBM Db2 denial of serviceEPSS 0.5%CVE-2026-55734MEDIUMguardian atom exhaustion in Guardian.Permissions.encode_permissions!/1EPSS 0.5%CVE-2022-48357—Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks tEPSS 0.5%CVE-2026-49089MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.5%