Weaknesses of type CWE-770

1,861 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-85220LOWDenial-of-Service in the Thinkst Canary Redis serviceEPSS 0.4%CVE-2026-85219LOWDenial-of-Service in the OpenCanary Redis serviceEPSS 0.4%CVE-2026-58488MEDIUMHedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofingEPSS 0.4%CVE-2025-55102HIGHA denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network pEPSS 0.4%CVE-2026-48514MEDIUMMessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte lengthEPSS 0.4%CVE-2026-48510MEDIUMMessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengthsEPSS 0.4%CVE-2026-48515MEDIUMMessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensionsEPSS 0.4%CVE-2026-40395MEDIUMVarnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0EPSS 0.4%CVE-2026-23826HIGHUnauthenticated Denial of Service in AOS-8 Network Management ServiceEPSS 0.4%CVE-2024-51461MEDIUMIBM QRadar WinCollect Agent denial of serviceEPSS 0.4%CVE-2021-47875MEDIUMGeoGebra CAS Calculator 6.0.631.0 - Denial of ServiceEPSS 0.4%CVE-2025-22484HIGHFile Station 5EPSS 0.4%CVE-2025-66473HIGHXWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikisEPSS 0.4%CVE-2025-5253MEDIUMDoS in Kron Technologies' Kron PAMEPSS 0.4%CVE-2026-19015MEDIUMUncontrolled resource consumption in the Consul Connect CA roots endpointEPSS 0.4%CVE-2026-82054HIGHUncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of ServiceEPSS 0.4%CVE-2026-53596MEDIUMFreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)EPSS 0.4%CVE-2026-1660MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.4%CVE-2026-59323MEDIUMMicrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerabilityEPSS 0.4%CVE-2026-47874MEDIUMReactor Netty HTTP Server Denial of Service With Pipelined RequestsEPSS 0.4%