Weaknesses of type CWE-770

1,852 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-88878MEDIUMTraefik v2.8.2 through v3.6 HTTP/3 Timeout BypassEPSS 0.4%CVE-2026-59648MEDIUMOpenPGP Argon2 S2K honours attacker-chosen memory and passesEPSS 0.4%CVE-2026-59647MEDIUMCRMF/CMP password-MAC honours unbounded iteration countEPSS 0.4%CVE-2026-58063MEDIUMBCFKS keystore load honours unbounded KDF cost from untrusted fileEPSS 0.4%CVE-2025-68156HIGHExpr has Denial of Service via Unbounded Recursion in Builtin FunctionsEPSS 0.4%CVE-2025-31496HIGHapollo-compiler Named Fragment Processing VulnerabilityEPSS 0.4%CVE-2026-28376MEDIUMGrafana Live push endpoint allows unbounded memory allocation leading to OOMEPSS 0.4%CVE-2026-42397MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.4%CVE-2026-72653MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.4%CVE-2026-33465MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.4%CVE-2026-92915MEDIUMWWBN AVideo userVerifyEmail.php Unauthenticated Access ControlEPSS 0.4%CVE-2026-13075HIGH$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion GenerationEPSS 0.4%CVE-2024-54178MEDIUMMultiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.EPSS 0.4%CVE-2026-72659MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.4%CVE-2026-72667MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.4%CVE-2026-72674MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.4%CVE-2026-28383MEDIUMGrafana plugin resources can lead to unbounded memory allocationEPSS 0.4%CVE-2026-13076HIGHAggregation Framework Memory Exhaustion Leading to Process TerminationEPSS 0.4%CVE-2026-78588MEDIUMAllocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of ServiceEPSS 0.4%CVE-2026-41726MEDIUMIn Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector headerEPSS 0.4%