Weaknesses of type CWE-770

1,861 results

Alocação irrestrita de recursos

É quando a aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem limites, permitindo que um atacante esgote os recursos disponíveis do servidor. O código não valida quantidade nem tamanho, criando uma porta aberta para negação de serviço.

Example

Um endpoint HTTP que processa uploads sem validar tamanho máximo: um atacante envia múltiplos arquivos gigantes ou faz requisições em loop, consumindo toda a memória/disco até o servidor ficar indisponível para usuários legítimos.

How to mitigate

Implemente cotas e limites: defina tamanho máximo de upload, máximo de conexões por cliente, timeout para operações, e use rate limiting. Monitore consumo de recursos e rejeite requisições que violem as políticas de limite.

CVE-2026-71219MEDIUMGfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversalEPSS 0.1%CVE-2025-14876MEDIUMQemu-kvm: unbounded allocation in virtio-cryptoEPSS 0.1%CVE-2025-36123MEDIUMIBM Db2 Denial of ServiceEPSS 0.1%CVE-2026-19617MEDIUMLibdm: lvm2: libdm: denial of service via uncontrolled recursion in config parserEPSS 0.1%CVE-2026-28237MEDIUMUnrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of avaEPSS 0.1%CVE-2026-6053MEDIUMIBM® Db2® is vulnerable to a denial of service when a specially crafted query is run with range partitioned tablesEPSS 0.1%CVE-2025-45526LOWA denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntaEPSS 0.1%CVE-2026-31961MEDIUMUnbounded memory allocation in Quill via unvalidated size fields in Mach-O binary parsingEPSS 0.1%CVE-2023-28899MEDIUMDenial of Service via ECU reset serviceEPSS 0.1%CVE-2026-13322LOWKubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of serviceEPSS 0.1%CVE-2026-45078MEDIUMSynapse CPU starvation (Denial of Service)EPSS 0.1%CVE-2026-39959HIGHTmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of serviceEPSS 0.1%CVE-2025-36035MEDIUMIBM PowerVM Hypervisor denial of serviceEPSS 0.1%CVE-2026-18096LOWIBM® Db2® could allow a local attacker to cause a denial of service due to a memory leakEPSS 0.1%CVE-2026-12570MEDIUMDenial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/kerasEPSS 0.1%CVE-2022-20485HIGHIn NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. EPSS 0.1%CVE-2022-20486HIGHIn NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. EPSS 0.1%CVE-2022-20487HIGHIn NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. EPSS 0.1%CVE-2026-31960MEDIUMDoS in Quill via unbounded read of HTTP response body during notarizationEPSS 0.1%CVE-2026-81885MEDIUMradare2: Infinite relocation-chain loop causes denial of service in radare2 NE parserEPSS 0.1%