Fallos del tipo CWE-770
1851 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2023-28104HIGHsilverstripe/graphql Denial of Service vulnerabilityEPSS 1.1%CVE-2022-3364MEDIUMNo limit in length of "Fullname" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffwebEPSS 1.1%CVE-2026-47774HIGHEnvoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationEPSS 1.1%CVE-2026-56814MEDIUMPlug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)EPSS 1.1%CVE-2023-30551HIGHRekor's compressed archives can result in OOM conditionsEPSS 1.1%CVE-2023-30455HIGHAn issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the EPSS 1.0%CVE-2026-42587HIGHNetty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSEPSS 1.0%CVE-2024-52804HIGHTornado has HTTP cookie parsing DoS vulnerabilityEPSS 1.0%CVE-2025-21522MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.40 and EPSS 1.0%CVE-2021-32848HIGHOctobox ReDoS vulnerabilityEPSS 1.0%CVE-2025-27556MEDIUMAn issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, djangEPSS 1.0%CVE-2023-43642HIGHMissing upper bound check on chunk length in snappy-java EPSS 1.0%CVE-2026-27858HIGHAttacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.
AttackeEPSS 1.0%CVE-2021-21000MEDIUMWAGO: PFC200 Denial of Service due to the number of connections to the runtimeEPSS 1.0%CVE-2021-32036MEDIUMDenial of Service and Data Integrity vulnerability in features commandEPSS 1.0%CVE-2025-21531MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8EPSS 1.0%CVE-2025-21525MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.39 and priEPSS 1.0%CVE-2026-58389HIGHApache Thrift: Rust binary protocol non-strict path missing string size limitEPSS 1.0%CVE-2026-55968HIGHApache Thrift: Node.js quadratic-time DoS in server receive transportsEPSS 1.0%CVE-2026-45112MEDIUMApache Thrift: Unbounded Read Leading to Denial of ServiceEPSS 1.0%