Weaknesses of type CWE-770
2,186 resultsAlocação irrestrita de recursos
É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.
Example
Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.
How to mitigate
Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.
CVE-2024-38535HIGHSuricata http2: oom from duplicate headersEPSS 1.2%CVE-2022-3364MEDIUMNo limit in length of "Fullname" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffwebEPSS 1.2%CVE-2024-32660HIGHFreeRDP zgfx_decompress out of memory vulnerabilityEPSS 1.2%CVE-2023-45290MEDIUMMemory exhaustion in multipart form parsing in net/textproto and net/httpEPSS 1.2%CVE-2024-23836HIGHcrafted traffic can cause denial of serviceEPSS 1.2%CVE-2022-3295MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 1.2%CVE-2022-3298MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 1.2%CVE-2023-48831HIGHA lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion.EPSS 1.2%CVE-2023-42504MEDIUMApache Superset: Lack of rate limiting allows for possible denial of serviceEPSS 1.1%CVE-2026-33871HIGHNetty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassEPSS 1.1%CVE-2022-4044MEDIUMAuthenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost serverEPSS 1.1%CVE-2026-69374MEDIUMWindows SMB Server Denial of Service VulnerabilityEPSS 1.1%CVE-2024-4140HIGHAn excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipartEPSS 1.1%CVE-2021-3637—A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessiEPSS 1.1%CVE-2024-26461HIGHKerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.EPSS 1.1%CVE-2023-27653HIGHAn issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a denial of service via the SharedPreference files.EPSS 1.1%CVE-2023-27191HIGHAn issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.EPSS 1.1%CVE-2025-55163HIGHNetty MadeYouReset HTTP/2 DDoS VulnerabilityEPSS 1.1%CVE-2023-4046—In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilationEPSS 1.1%CVE-2021-46877HIGHjackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient EPSS 1.1%