Weaknesses of type CWE-770

1,852 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-61541MEDIUMZapros has an Unbounded Content-Encoding decompression chain that allows denial of serviceEPSS 0.4%CVE-2026-12818CRITICALDVP-12SE Exposure of Sensitive Information VulnerabilityEPSS 0.4%CVE-2026-75956HIGHJoomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3EPSS 0.4%CVE-2026-64773HIGHAn attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amountEPSS 0.4%CVE-2025-27911MEDIUMAn issue was discovered in Datalust Seq before 2024.3.13545. Expansion of identifiers in message templates can be used to bypass the system EPSS 0.4%CVE-2026-29772MEDIUMAstro: Memory exhaustion DoS due to missing request body size limit in Server IslandsEPSS 0.4%CVE-2026-73196MEDIUMIpa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encodingEPSS 0.4%CVE-2026-13260HIGHSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.4%CVE-2025-54155LOWFile Station 5EPSS 0.4%CVE-2025-11362HIGHVersions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or ThrotEPSS 0.4%CVE-2026-77801MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.4%CVE-2025-54161LOWFile Station 5EPSS 0.4%CVE-2025-30350MEDIUMDirectus's S3 assets become unavailable after a burst of HEAD requestsEPSS 0.4%CVE-2025-30225MEDIUMDirectus's S3 assets become unavailable after a burst of malformed transformationsEPSS 0.4%CVE-2024-22436MEDIUMA security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a denial of service.EPSS 0.4%CVE-2026-35457HIGHlibp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustionEPSS 0.4%CVE-2026-58063MEDIUMBCFKS keystore load honours unbounded KDF cost from untrusted fileEPSS 0.4%CVE-2025-48375MEDIUMSchule Missing Rate Limiting on OTP Email Requests – Susceptible to Abuse & DoSEPSS 0.4%CVE-2026-92077MEDIUMDenial-of-service in the SVG componentEPSS 0.4%CVE-2026-59648MEDIUMOpenPGP Argon2 S2K honours attacker-chosen memory and passesEPSS 0.4%