Fallos del tipo CWE-770

1852 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2025-21605HIGHRedis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated clientEPSS 0.9%CVE-2023-50247LOWh2o QUIC state exhaustion DoSEPSS 0.9%CVE-2024-43783HIGHApollo Router Coprocessors may cause Denial-of-Service when handling request bodiesEPSS 0.9%CVE-2025-32049HIGHLibsoup: denial of service attack to websocket serverEPSS 0.9%CVE-2022-2134HIGHAllocation of Resources Without Limits or Throttling in inventree/inventreeEPSS 0.9%CVE-2026-33034HIGHPotential denial-of-service vulnerability in ASGI requests via memory upload limit bypassEPSS 0.9%CVE-2022-39226MEDIUMDiscourse user profile location and website fields were not sufficiently length-limitedEPSS 0.9%CVE-2024-29903MEDIUMCosign vulnerable to machine-wide denial of service via malicious artifactsEPSS 0.9%CVE-2023-34450LOWCometBFT PeerState JSON serialization deadlockEPSS 0.9%CVE-2026-44250HIGHNetty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested ArraysEPSS 0.8%CVE-2026-44890HIGHNetty has Unbounded Direct Memory Consumption in its RedisDecoderEPSS 0.8%CVE-2026-50011HIGHNetty has unbounded pre-allocation in RedisArrayAggregator from RESP array lengthEPSS 0.8%CVE-2026-45292MEDIUMopentelemetry-java: Unbounded Memory Allocation in W3C Baggage PropagationEPSS 0.8%CVE-2026-46340HIGHNetty: SCTP reassembly nests buffers without boundEPSS 0.8%CVE-2026-42561HIGHPython-Multipart: Denial of Service via unbounded multipart part headersEPSS 0.8%CVE-2026-40983HIGHMicrometer gRPC server instrumentation DoS vulnerabilityEPSS 0.8%CVE-2026-8468HIGHUnbounded buffer accumulation in multipart header parsing causes denial of service in plugEPSS 0.8%CVE-2023-0383HIGHUncontrolled Resource Consuption in M-Files ServerEPSS 0.8%CVE-2024-57662HIGHAn issue in the sqlg_hash_source component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via cEPSS 0.8%CVE-2025-13927HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%