Weaknesses of type CWE-770

1,861 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-43329HIGHnetfilter: flowtable: strictly check for maximum number of actionsEPSS 0.2%CVE-2026-22780MEDIUMRizin has a heap overflow on mach0_chained_fixups.cEPSS 0.2%CVE-2026-8124MEDIUMGPAC box_code_base.c sidx_box_read allocation of resourcesEPSS 0.2%CVE-2026-18170MEDIUMIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-53937MEDIUMMCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)EPSS 0.2%CVE-2026-27026MEDIUMpypdf possibly has long runtimes for malformed FlateDecode streamsEPSS 0.2%CVE-2026-48496MEDIUMopentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agentEPSS 0.2%CVE-2026-63119MEDIUMMCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)EPSS 0.2%CVE-2025-32425MEDIUMAutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoSEPSS 0.2%CVE-2026-54389MEDIUMGhidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdbEPSS 0.2%CVE-2024-38335MEDIUMIBM Security QRadar Network Threat Analytics denial of serviceEPSS 0.2%CVE-2026-48735MEDIUMpypdf: Manipulated XMP metadata streams can exhaust RAMEPSS 0.2%CVE-2025-32025MEDIUMbep/imagemeta allows a potentially large memory allocation in PNG and WebP parsingEPSS 0.2%CVE-2025-32024MEDIUMbep/imagemeta allows excessively large EXIF data structuresEPSS 0.2%CVE-2023-22397MEDIUMJunos OS Evolved: PTX10003: An attacker sending specific genuine packets will cause a memory leak in the PFE leading to a Denial of ServiceEPSS 0.2%CVE-2026-53423MEDIUMUnauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_pluginEPSS 0.2%CVE-2026-53426HIGHAtom-table exhaustion denial-of-service via JSON parse_document in MDExEPSS 0.2%CVE-2025-68138MEDIUMEVerest affected by memory exhaustion in libocppEPSS 0.2%CVE-2026-31826MEDIUMpypdf: manipulated stream length values can exhaust RAMEPSS 0.2%CVE-2023-30903—HP-UX could be exploited locally to create a Denial of Service (DoS) when any physical interface is configured with IPv6/inet6. EPSS 0.2%