Fallos del tipo CWE-770

1852 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2022-50695HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network CommandsEPSS 0.8%CVE-2022-47562HIGHAllocation of Resources Without Limits or Throttling in Ormazabal productsEPSS 0.8%CVE-2023-52428HIGHIn Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header valEPSS 0.8%CVE-2025-26699MEDIUMAn issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrEPSS 0.8%CVE-2024-9437HIGHUnauthenticated Denial of Service in transformeroptimus/superagiEPSS 0.8%CVE-2024-56332MEDIUMNext.js Vulnerable to Denial of Service (DoS) with Server ActionsEPSS 0.8%CVE-2026-27857MEDIUMSending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client EPSS 0.8%CVE-2026-42792MEDIUMepmd permanent DoS via EMFILE on accept(2) in ertsEPSS 0.8%CVE-2023-5625MEDIUMPython-eventlet: patch regression for cve-2021-21419 in some red hat buildsEPSS 0.8%CVE-2026-33594MEDIUMOutgoing DoH excessive memory allocationEPSS 0.8%CVE-2026-33258MEDIUMCrafted zones can cause increased resource usageEPSS 0.8%CVE-2026-33254MEDIUMResource exhaustion via DoQ/DoH3 connectionsEPSS 0.8%CVE-2026-33256MEDIUMUnbounded memory allocation by internal web serverEPSS 0.8%CVE-2026-33595MEDIUMDoQ/DoH3 excessive memory allocationEPSS 0.8%CVE-2023-6337HIGHVault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP RequestsEPSS 0.8%CVE-2023-36357—An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackersEPSS 0.8%CVE-2023-23846HIGHDue to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headersEPSS 0.8%CVE-2022-22212HIGHJunos OS Evolved: A high rate of specific hostbound traffic will cause unexpected hostbound traffic delays or dropsEPSS 0.8%CVE-2024-52581HIGHLitestar allows unbounded resource consumption (DoS vulnerability)EPSS 0.8%CVE-2026-50272HIGHdd-trace: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%