Fallos del tipo CWE-770
1852 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2025-13927HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-27979MEDIUMNext.js: Unbounded postponed resume buffering can lead to DoSEPSS 0.8%CVE-2024-28871HIGHExcessive CPU used on malformed trafficEPSS 0.8%CVE-2024-8984HIGHDenial of Service (DoS) in berriai/litellmEPSS 0.8%CVE-2024-23184MEDIUMHaving a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is alEPSS 0.8%CVE-2022-20950MEDIUMA vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remoEPSS 0.8%CVE-2024-34055MEDIUMCyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITEPSS 0.8%CVE-2025-27219MEDIUMIn the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerabiEPSS 0.8%CVE-2023-50730HIGHGrackle has StackOverflowError in GraphQL query processingEPSS 0.8%CVE-2026-72914HIGHMastodon: Exhausting data by an unauthenticated request to the admin retention APIEPSS 0.8%CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.8%CVE-2026-18618HIGHMl-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listenerEPSS 0.8%CVE-2024-21634HIGHIon Java StackOverflow vulnerabilityEPSS 0.8%CVE-2026-42006MEDIUMAn attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking onEPSS 0.8%CVE-2025-21493MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected aEPSS 0.8%CVE-2023-22819MEDIUMUncontrolled resource consumption vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi productsEPSS 0.8%CVE-2024-10935HIGHUnauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webuiEPSS 0.8%CVE-2024-22353MEDIUMIBM WebSphere Application Server Liberty denial of serviceEPSS 0.8%CVE-2022-50695HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network CommandsEPSS 0.8%CVE-2019-25220HIGHBitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (EPSS 0.8%