Fallos del tipo CWE-770

2228 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2023-52428HIGHIn Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header valEPSS 0.8%CVE-2026-42154HIGHPrometheus: remote read endpoint allows denial of service via crafted snappy payloadEPSS 0.8%CVE-2024-8966HIGHDenial of Service in gradio-app/gradioEPSS 0.8%CVE-2022-50695HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network CommandsEPSS 0.8%CVE-2026-27858HIGHAttacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. AttackeEPSS 0.8%CVE-2024-56332MEDIUMNext.js Vulnerable to Denial of Service (DoS) with Server ActionsEPSS 0.8%CVE-2026-33034HIGHPotential denial-of-service vulnerability in ASGI requests via memory upload limit bypassEPSS 0.8%CVE-2023-36357—An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackersEPSS 0.8%CVE-2023-23846HIGHDue to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headersEPSS 0.8%CVE-2024-12778HIGHDenial of Service in aimhubio/aimEPSS 0.8%CVE-2024-52581HIGHLitestar allows unbounded resource consumption (DoS vulnerability)EPSS 0.8%CVE-2026-50273HIGHDatadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50270HIGHdd-trace-java: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50274HIGHdd-trace-go: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-54788HIGHdd-trace-rs: Unbounded W3C tracestate parsing may lead to DoSEPSS 0.8%CVE-2026-60108HIGHZeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP AnalyzerEPSS 0.8%CVE-2026-50277HIGHdd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50271HIGHdd-trace-py: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50272HIGHdd-trace: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50276HIGHdd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%