Weaknesses of type CWE-770

1,835 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2023-45129MEDIUMmatrix-synapse vulnerable to denial of service due to malicious server ACL eventsEPSS 1.2%CVE-2023-45290MEDIUMMemory exhaustion in multipart form parsing in net/textproto and net/httpEPSS 1.2%CVE-2024-23836HIGHcrafted traffic can cause denial of serviceEPSS 1.2%CVE-2023-48831HIGHA lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion.EPSS 1.2%CVE-2025-46727HIGHUnbounded-Parameter DoS in Rack::QueryParserEPSS 1.2%CVE-2026-1526HIGHundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionEPSS 1.1%CVE-2023-42504MEDIUMApache Superset: Lack of rate limiting allows for possible denial of serviceEPSS 1.1%CVE-2025-58754HIGHAxios is vulnerable to DoS attack through lack of data size checkEPSS 1.1%CVE-2024-4140HIGHAn excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipartEPSS 1.1%CVE-2021-3637—A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessiEPSS 1.1%CVE-2024-26461HIGHKerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.EPSS 1.1%CVE-2023-27191HIGHAn issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.EPSS 1.1%CVE-2023-27653HIGHAn issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a denial of service via the SharedPreference files.EPSS 1.1%CVE-2026-54113HIGHRemote Procedure Call Denial of Service VulnerabilityEPSS 1.1%CVE-2023-4046—In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilationEPSS 1.1%CVE-2026-33871HIGHNetty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassEPSS 1.1%CVE-2021-46877HIGHjackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient EPSS 1.1%CVE-2023-26964HIGHAn issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a resuEPSS 1.1%CVE-2025-21521HIGHVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0EPSS 1.1%CVE-2026-26018HIGHCoreDNS Loop Detection Denial of Service VulnerabilityEPSS 1.1%