Fallos del tipo CWE-770
2215 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2026-72978MEDIUMActive Directory Federation Services (AD FS) Denial of Service VulnerabilityEPSS 1.0%CVE-2023-47120HIGHDiscourse DoS through Onebox favicon URLEPSS 1.0%CVE-2025-4821HIGHIncorrect congestion window growth by invalid ACK rangesEPSS 1.0%CVE-2022-35220HIGHTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-1EPSS 1.0%CVE-2022-32958HIGHTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or ThrottlingEPSS 1.0%CVE-2024-28102MEDIUMJWCrypto vulnerable to JWT bomb Attack in `deserialize` functionEPSS 1.0%CVE-2023-27901HIGHJenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reEPSS 1.0%CVE-2023-27900HIGHJenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reEPSS 1.0%CVE-2023-5625MEDIUMPython-eventlet: patch regression for cve-2021-21419 in some red hat buildsEPSS 1.0%CVE-2021-31369MEDIUMJunos OS: MX Series: Traffic drops will be observed if MS-MPC/MS-PIC resources are consumed by certain traffic causing a partial DoSEPSS 1.0%CVE-2025-7070MEDIUMIROAD Dashcam Q9 MFA Pairing Request allocation of resourcesEPSS 1.0%CVE-2026-96959HIGH.NET Denial of Service VulnerabilityEPSS 1.0%CVE-2026-47774HIGHEnvoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationEPSS 1.0%CVE-2023-38507HIGHStrapi Improper Rate Limiting vulnerabilityEPSS 1.0%CVE-2026-18649HIGHGstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloadersEPSS 1.0%CVE-2021-0285HIGHJunos OS: QFX5000 Series and EX4600 Series: Continuous traffic destined to a device configured with MC-LAG leading to nodes losing their control connection which can impact trafficEPSS 1.0%CVE-2025-21536MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 aEPSS 1.0%CVE-2023-28119HIGHcrewjam/saml vulnerable to Denial Of Service Via Deflate Decompression BombEPSS 1.0%CVE-2025-21534MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected areEPSS 1.0%CVE-2022-22278—A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when usEPSS 1.0%