Fallos del tipo CWE-770
1851 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2022-32958HIGHTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or ThrottlingEPSS 1.0%CVE-2023-26285MEDIUMIBM MQ denial of serviceEPSS 0.9%CVE-2024-36462HIGHAllocation of resources without limits or throttling (uncontrolled resource consumption)EPSS 0.9%CVE-2024-2818MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.9%CVE-2024-54538HIGHA denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPEPSS 0.9%CVE-2026-44577MEDIUMNext.js: Denial of Service in the Image Optimization APIEPSS 0.9%CVE-2021-22919—A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)EPSS 0.9%CVE-2026-3520HIGHMulter vulnerable to Denial of Service via uncontrolled recursionEPSS 0.9%CVE-2025-22869HIGHPotential denial of service in golang.org/x/cryptoEPSS 0.9%CVE-2025-4821HIGHIncorrect congestion window growth by invalid ACK rangesEPSS 0.9%CVE-2022-35220HIGHTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-1EPSS 0.9%CVE-2026-44488HIGHAxios: Allocation of Resources Without Limits or Throttling in axiosEPSS 0.9%CVE-2026-48779HIGHws: Memory exhaustion DoS from tiny fragments and data chunksEPSS 0.9%CVE-2024-3382HIGHPAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted PacketsEPSS 0.9%CVE-2020-14336—A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allowEPSS 0.9%CVE-2022-22153HIGHSRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet dropsEPSS 0.9%CVE-2024-28863MEDIUMnode-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validationEPSS 0.9%CVE-2026-70399HIGHhttpd does not enforce the documented default max_clients connection limitEPSS 0.9%CVE-2024-23835HIGHSuricata's pgsql: memory exhaustion use on record parsingEPSS 0.9%CVE-2026-58465HIGHEclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoSEPSS 0.9%