Fallos del tipo CWE-770
2226 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2024-26308MEDIUMApache Commons Compress: OutOfMemoryError unpacking broken Pack200 fileEPSS 0.9%CVE-2026-23538HIGHFeast: resource exhaustion via websocket endpointEPSS 0.9%CVE-2024-35202HIGHBitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by includiEPSS 0.9%CVE-2024-37358HIGHApache James: denial of service through the use of IMAP literalsEPSS 0.9%CVE-2026-112671HIGHA resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and EPSS 0.9%CVE-2026-93491HIGHIo.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queueEPSS 0.9%CVE-2024-57662HIGHAn issue in the sqlg_hash_source component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via cEPSS 0.9%CVE-2024-7983HIGHDenial of Service in open-webui/open-webuiEPSS 0.9%CVE-2026-33176MEDIUMRails Active Support has a possible DoS vulnerability in its number helpersEPSS 0.9%CVE-2025-21605HIGHRedis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated clientEPSS 0.9%CVE-2024-21060MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Data Dictionary). Supported versions that are affected are 8.EPSS 0.9%CVE-2026-54428HIGHApache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACKEPSS 0.9%CVE-2024-38534HIGHSuricata modbus: txs without responses are never freedEPSS 0.9%CVE-2024-48844HIGHDenial of Service, DoSEPSS 0.9%CVE-2023-20033HIGHA vulnerability in Cisco IOS XE Software for Cisco Catalyst 3650 and Catalyst 3850 Series Switches could allow an unauthenticated, remote atEPSS 0.9%CVE-2022-2134HIGHAllocation of Resources Without Limits or Throttling in inventree/inventreeEPSS 0.9%CVE-2025-4820MEDIUMIncorrect congestion window growth by optimistic ACKEPSS 0.9%CVE-2025-12562HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.9%CVE-2026-11586HIGHWS Auto-PONG memory exhaustionEPSS 0.9%CVE-2023-6476MEDIUMCri-o: pods are able to break out of resource confinement on cgroupv2EPSS 0.9%