Weaknesses of type CWE-770

1,861 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-49249HIGHBoruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2EPSS 0.4%CVE-2026-49347MEDIUMQuest Bot: Ticket creation has no per-user open-ticket limit or cooldownEPSS 0.4%CVE-2026-5762MEDIUMReportIncident DiscussionTools integration causes slow requestsEPSS 0.4%CVE-2026-77121MEDIUMNexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata FieldsEPSS 0.4%CVE-2025-11374MEDIUMConsul's KV endpoint is vulnerable to denial of serviceEPSS 0.4%CVE-2025-35965MEDIUMDoS in Mattermost Playbooks via Excessive Task ActionsEPSS 0.4%CVE-2020-37038MEDIUMCode Blocks 20.03 - Denial Of ServiceEPSS 0.4%CVE-2025-11375MEDIUMConsul's event endpoint is vulnerable to denial of serviceEPSS 0.4%CVE-2026-15144HIGH@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotationEPSS 0.4%CVE-2025-25032HIGHIBM Cognos Analytics denial of serviceEPSS 0.4%CVE-2026-49870MEDIUMSnipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`EPSS 0.4%CVE-2024-6509MEDIUMMarinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which couEPSS 0.4%CVE-2025-69229MEDIUMAIOHTTP vulnerable to DoS through chunked messagesEPSS 0.4%CVE-2020-10717LOWA potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs EPSS 0.4%CVE-2020-37067HIGHFiletto 1.0 - 'FEAT' Denial of ServiceEPSS 0.4%CVE-2026-41685MEDIUMIncus: Unbounded binary import disk exhaustionEPSS 0.4%CVE-2026-41648MEDIUMIncus: Unbounded YAML Metadata Decode via ParsingEPSS 0.4%CVE-2026-42145LOWCoolify: File Upload Without Type or Size Validation in Database Backup RestoreEPSS 0.4%CVE-2024-10468CRITICALPotential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability aEPSS 0.4%CVE-2025-53530HIGHWeGIA allows Uncontrolled Resource Consumption via the errorstr parameterEPSS 0.4%