Fallos del tipo CWE-770
2228 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2024-34055MEDIUMCyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITEPSS 0.8%CVE-2024-10935HIGHUnauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webuiEPSS 0.8%CVE-2025-13927HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-49361HIGHApache Fluss Netty Frame Decoder Memory Exhaustion VulnerabilityEPSS 0.8%CVE-2025-26699MEDIUMAn issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrEPSS 0.8%CVE-2024-9437HIGHUnauthenticated Denial of Service in transformeroptimus/superagiEPSS 0.8%CVE-2023-50730HIGHGrackle has StackOverflowError in GraphQL query processingEPSS 0.8%CVE-2024-21634HIGHIon Java StackOverflow vulnerabilityEPSS 0.8%CVE-2026-72914HIGHMastodon: Exhausting data by an unauthenticated request to the admin retention APIEPSS 0.8%CVE-2022-3439MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.8%CVE-2023-22819MEDIUMUncontrolled resource consumption vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi productsEPSS 0.8%CVE-2026-29181HIGHOpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)EPSS 0.8%CVE-2025-11447HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2025-47793MEDIUMNextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text fileEPSS 0.8%CVE-2022-22212HIGHJunos OS Evolved: A high rate of specific hostbound traffic will cause unexpected hostbound traffic delays or dropsEPSS 0.8%CVE-2024-22353MEDIUMIBM WebSphere Application Server Liberty denial of serviceEPSS 0.8%CVE-2026-3520HIGHMulter vulnerable to Denial of Service via uncontrolled recursionEPSS 0.8%CVE-2019-25220HIGHBitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (EPSS 0.8%CVE-2026-9064HIGH389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)EPSS 0.8%CVE-2022-47562HIGHAllocation of Resources Without Limits or Throttling in Ormazabal productsEPSS 0.8%