Weaknesses of type CWE-770

1,861 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-56255MEDIUMCapgo - Denial of Service via Unlimited Demo App CreationEPSS 0.4%CVE-2025-9368HIGH432ES-IG3 Series A Denial-of-Service VulnerabilityEPSS 0.4%CVE-2025-3050MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2026-82309MEDIUMRobots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queriesEPSS 0.4%CVE-2025-36070MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2025-54884HIGHVision UI security-kit.js: Potential Uncontrolled Resource Allocation VulnerabilityEPSS 0.4%CVE-2025-1000MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2025-4225MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.4%CVE-2025-2403HIGHA denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and SEPSS 0.4%CVE-2026-48045MEDIUMZeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source floodEPSS 0.4%CVE-2025-48053HIGHDiscourse vulnerable to DoS via large URL payload in PM to a botEPSS 0.4%CVE-2025-36098MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2025-11832CRITICALAPIs Lack Rate LimitingEPSS 0.4%CVE-2021-22532HIGHPossible NLDAP Denial of Service attack VulnerabilityEPSS 0.4%CVE-2023-38543HIGHA vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attackerEPSS 0.4%CVE-2026-77633HIGHCloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceEPSS 0.4%CVE-2025-62426MEDIUMvLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`EPSS 0.4%CVE-2026-41078MEDIUMOpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion pathEPSS 0.4%CVE-2026-10600MEDIUMDenial of service via unbounded document content extraction in Mattermost ServerEPSS 0.4%CVE-2020-36950HIGHLaravel Nova 3.7.0 - 'range' DoSEPSS 0.4%