Fallos del tipo CWE-770
2223 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2022-3480HIGHDenial-of-Service vulnerability in PHOENIX CONTACT mGuard product familyEPSS 0.9%CVE-2026-58465HIGHEclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoSEPSS 0.9%CVE-2024-52797MEDIUMSearching Opencast may cause a denial of serviceEPSS 0.9%CVE-2024-3382HIGHPAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted PacketsEPSS 0.9%CVE-2026-45416HIGHNetty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesEPSS 0.9%CVE-2026-85449HIGHMOOS-IvP through 24.8.1 pMarineViewer Unbounded Memory Consumption via NODE_REPORTEPSS 0.9%CVE-2023-37279HIGHFaktory Web Dashboard can lead to denial of service(DOS) via malicious user inputEPSS 0.9%CVE-2025-64702MEDIUMquic-go HTTP/3 QPACK Header Expansion DoSEPSS 0.9%CVE-2023-25171HIGHKiwi TCMS has denial of service vulnerability on Password reset pageEPSS 0.9%CVE-2026-39304HIGHApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOMEPSS 0.9%CVE-2024-43410HIGHRussh has an OOM Denial of Service due to allocation of untrusted amountEPSS 0.9%CVE-2023-25156HIGHKiwi TCMS has no protection against brute-force attacks on login pageEPSS 0.9%CVE-2023-6910MEDIUMUncontrolled Resource Consumption in M-Files ServerEPSS 0.9%CVE-2023-40019HIGHFreeSWITCH allows authorized users to cause a denial of service attack by sending re-INVITE with SDP containing duplicate codec namesEPSS 0.9%CVE-2026-101896HIGHAngular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)EPSS 0.9%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.9%CVE-2023-29479MEDIUMRibose RNP before 0.16.3 may hang when the input is malformed.EPSS 0.9%CVE-2023-20155HIGHA vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to causEPSS 0.9%CVE-2026-32141HIGHflatted: Unbounded recursion DoS in parse() revive phaseEPSS 0.9%CVE-2024-26308MEDIUMApache Commons Compress: OutOfMemoryError unpacking broken Pack200 fileEPSS 0.9%