Fallos del tipo CWE-770
2228 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2025-21543MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are affected are 8.0.40 aEPSS 0.9%CVE-2024-20968MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.34 andEPSS 0.9%CVE-2023-50247LOWh2o QUIC state exhaustion DoSEPSS 0.9%CVE-2024-8984HIGHDenial of Service (DoS) in berriai/litellmEPSS 0.9%CVE-2024-43783HIGHApollo Router Coprocessors may cause Denial-of-Service when handling request bodiesEPSS 0.9%CVE-2023-25568HIGHBoxo bitswap/server: DOS unbounded persistent memory leakEPSS 0.9%CVE-2023-34450LOWCometBFT PeerState JSON serialization deadlockEPSS 0.9%CVE-2025-21493MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected aEPSS 0.9%CVE-2024-29903MEDIUMCosign vulnerable to machine-wide denial of service via malicious artifactsEPSS 0.9%CVE-2025-27219MEDIUMIn the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerabiEPSS 0.8%CVE-2024-23184MEDIUMHaving a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is alEPSS 0.8%CVE-2026-18618HIGHMl-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listenerEPSS 0.8%CVE-2023-0383HIGHUncontrolled Resource Consuption in M-Files ServerEPSS 0.8%CVE-2026-100274MEDIUMIn JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification templateEPSS 0.8%CVE-2026-25673HIGHPotential denial-of-service vulnerability in URLField via Unicode normalization on WindowsEPSS 0.8%CVE-2024-28871HIGHExcessive CPU used on malformed trafficEPSS 0.8%CVE-2026-25800HIGHquinn-proto has remote memory exhaustion from unbounded out-of-order stream reassemblyEPSS 0.8%CVE-2026-25535HIGHjsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF DimensionsEPSS 0.8%CVE-2026-41284HIGHApache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handlingEPSS 0.8%CVE-2025-54939MEDIUMLiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.EPSS 0.8%