Fallos del tipo CWE-770
2223 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2022-22278—A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when usEPSS 1.0%CVE-2026-93488HIGHIo.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streamsEPSS 1.0%CVE-2022-43768HIGHA vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-EPSS 1.0%CVE-2023-30636HIGHTiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error, with RpcStatus UNAVAILABLE for "not leader") upon an attempt tEPSS 1.0%CVE-2024-2818MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 1.0%CVE-2023-45130HIGHFrontier opcode SUICIDE touches too many storage values on large contractsEPSS 1.0%CVE-2022-20950MEDIUMA vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remoEPSS 1.0%CVE-2026-109468HIGHASP.NET Core Denial of Service VulnerabilityEPSS 0.9%CVE-2020-14322—In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of deniEPSS 0.9%CVE-2024-36462HIGHAllocation of resources without limits or throttling (uncontrolled resource consumption)EPSS 0.9%CVE-2023-26285MEDIUMIBM MQ denial of serviceEPSS 0.9%CVE-2018-3738—protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.EPSS 0.9%CVE-2021-22919—A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)EPSS 0.9%CVE-2025-22869HIGHPotential denial of service in golang.org/x/cryptoEPSS 0.9%CVE-2022-22153HIGHSRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet dropsEPSS 0.9%CVE-2020-14336—A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allowEPSS 0.9%CVE-2024-28863MEDIUMnode-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validationEPSS 0.9%CVE-2024-23835HIGHSuricata's pgsql: memory exhaustion use on record parsingEPSS 0.9%CVE-2026-70399HIGHhttpd does not enforce the documented default max_clients connection limitEPSS 0.9%CVE-2026-96300MEDIUMRPC Endpoint Mapper Service Denial of Service VulnerabilityEPSS 0.9%