Weaknesses of type CWE-770

1,852 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-62210MEDIUMOpenClaw < 2026.6.1 Denial of Service via Remote Media URLsEPSS 0.4%CVE-2025-6016MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.4%CVE-2026-22773MEDIUMvLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensionsEPSS 0.4%CVE-2025-32386MEDIUMHelm Allows A Specially Crafted Chart Archive To Cause Out Of Memory TerminationEPSS 0.4%CVE-2026-15561HIGHUndertow-core: oom via missing limits in chunked trailer in eap's undertowEPSS 0.4%CVE-2026-28452MEDIUMOpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchiveEPSS 0.4%CVE-2023-4138MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.4%CVE-2026-44679MEDIUMTuist: Forgot password flow lacks throttling for reset email deliveryEPSS 0.4%CVE-2026-8488MEDIUMAllocation of resources without limits or throttling vulnerability in Progress Software MOVEit AutomationEPSS 0.4%CVE-2026-24006HIGHSeroval affected by Denial of Service via Deeply Nested ObjectsEPSS 0.4%CVE-2026-54490MEDIUMwebsocket-driver: Resource limit bypass via message compressionEPSS 0.4%CVE-2026-54464MEDIUMwebsocket-driver: Resource limit bypass via message compressionEPSS 0.4%CVE-2026-74784HIGHScriban before 7.2.0 Denial of Service via array.insert_atEPSS 0.4%CVE-2026-23957HIGHseroval is vulnerable to Denial of Service via array serializationEPSS 0.4%CVE-2026-32941MEDIUMSliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard TransportsEPSS 0.4%CVE-2026-13074MEDIUMAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of ServiceEPSS 0.4%CVE-2026-54024MEDIUMLibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size LimitsEPSS 0.4%CVE-2026-33743MEDIUMIncus vulnerable to denial of source through crafted bucket backup fileEPSS 0.4%CVE-2026-33438MEDIUMStirling-PDF vulnerable to DoS via add-watermarkEPSS 0.4%CVE-2026-33541MEDIUMTSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of ServiceEPSS 0.4%