Weaknesses of type CWE-770

2,203 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2024-35185MEDIUMDenial of service of Minder Server with attacker-controlled REST endpointEPSS 0.5%CVE-2025-56223HIGHA lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS)EPSS 0.5%CVE-2026-103761HIGHMooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify QueueEPSS 0.5%CVE-2024-21875MEDIUMDoS attack when broadcasting billboard messagesEPSS 0.5%CVE-2026-68494HIGHjackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)EPSS 0.5%CVE-2026-28394MEDIUMOpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch ToolEPSS 0.5%CVE-2026-27932HIGHjoserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)EPSS 0.5%CVE-2026-113656MEDIUMApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSEPSS 0.5%CVE-2026-50011HIGHNetty has unbounded pre-allocation in RedisArrayAggregator from RESP array lengthEPSS 0.5%CVE-2025-1257MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-44250HIGHNetty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested ArraysEPSS 0.5%CVE-2026-42583HIGHNetty: Lz4FrameDecoder resource exhaustionEPSS 0.5%CVE-2026-44890HIGHNetty has Unbounded Direct Memory Consumption in its RedisDecoderEPSS 0.5%CVE-2026-30071HIGHAn issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.EPSS 0.5%CVE-2026-81285HIGHWordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerabilityEPSS 0.5%CVE-2026-21729HIGHLoki detected_fields query limits results in unbounded memory allocationEPSS 0.5%CVE-2025-53530HIGHWeGIA allows Uncontrolled Resource Consumption via the errorstr parameterEPSS 0.5%CVE-2025-29898MEDIUMQsync CentralEPSS 0.5%CVE-2026-30073HIGHAn issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crEPSS 0.5%CVE-2025-29890HIGHFile Station 5EPSS 0.5%