Fallos del tipo CWE-770

2215 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2025-50334HIGHAn issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting componentEPSS 1.1%CVE-2022-21822HIGHNVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without LimiEPSS 1.1%CVE-2025-21518MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 aEPSS 1.1%CVE-2026-75050HIGHIn JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parametersEPSS 1.1%CVE-2026-27601HIGHUnderscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackEPSS 1.1%CVE-2025-21505MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected arEPSS 1.1%CVE-2025-21503MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8EPSS 1.1%CVE-2023-28104HIGHsilverstripe/graphql Denial of Service vulnerabilityEPSS 1.1%CVE-2023-30551HIGHRekor's compressed archives can result in OOM conditionsEPSS 1.1%CVE-2025-4432MEDIUMRing: some aes functions may panic when overflow checking is enabled in ringEPSS 1.0%CVE-2023-30455HIGHAn issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the EPSS 1.0%CVE-2024-52804HIGHTornado has HTTP cookie parsing DoS vulnerabilityEPSS 1.0%CVE-2021-32036MEDIUMDenial of Service and Data Integrity vulnerability in features commandEPSS 1.0%CVE-2021-32848HIGHOctobox ReDoS vulnerabilityEPSS 1.0%CVE-2021-21000MEDIUMWAGO: PFC200 Denial of Service due to the number of connections to the runtimeEPSS 1.0%CVE-2026-85321HIGHActive Directory Federation Services (AD FS) Denial of Service VulnerabilityEPSS 1.0%CVE-2022-39226MEDIUMDiscourse user profile location and website fields were not sufficiently length-limitedEPSS 1.0%CVE-2026-58389HIGHApache Thrift: Rust binary protocol non-strict path missing string size limitEPSS 1.0%CVE-2026-45112MEDIUMApache Thrift: Unbounded Read Leading to Denial of ServiceEPSS 1.0%CVE-2026-55968HIGHApache Thrift: Node.js quadratic-time DoS in server receive transportsEPSS 1.0%