Fallos del tipo CWE-770

2228 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2026-50276HIGHdd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-40984HIGHMicrometer HTTP server instrumentations DoS vulnerabilityEPSS 0.8%CVE-2024-25026MEDIUMIBM WebSphere Application Server denial of serviceEPSS 0.8%CVE-2023-6337HIGHVault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP RequestsEPSS 0.8%CVE-2026-54345MEDIUMGoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)EPSS 0.8%CVE-2026-54332MEDIUMGoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoSEPSS 0.8%CVE-2022-35221MEDIUMTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2EPSS 0.8%CVE-2026-12151HIGHundici WebSocket client vulnerable to denial of service via fragment count bypassEPSS 0.8%CVE-2023-0382MEDIUMUncontrolled Resource Consumption in M-Files ServerEPSS 0.8%CVE-2022-4019MEDIUMAuthenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost serverEPSS 0.8%CVE-2024-7768HIGHDenial of Service in h2oai/h2o-3EPSS 0.8%CVE-2026-3505HIGHUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.EPSS 0.8%CVE-2025-5996MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-27880HIGHOpenFeature evaluation API reads input data with no boundsEPSS 0.8%CVE-2023-4011MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-48853CRITICALRemote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcEPSS 0.8%CVE-2026-67432HIGHMCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportEPSS 0.8%CVE-2026-54156HIGHnode-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoSEPSS 0.8%CVE-2026-85447HIGHMOOS-IvP through 24.8.1 pRealm Unbounded REALMCAST_REQ Subscription Denial of ServiceEPSS 0.8%CVE-2026-85448HIGHMOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State RetentionEPSS 0.8%