Fallos del tipo CWE-770

1852 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2026-50276HIGHdd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50273HIGHDatadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-54788HIGHdd-trace-rs: Unbounded W3C tracestate parsing may lead to DoSEPSS 0.8%CVE-2026-50271HIGHdd-trace-py: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-28478HIGHOpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body BufferingEPSS 0.8%CVE-2026-50270HIGHdd-trace-java: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50272HIGHdd-trace: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-60108HIGHZeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP AnalyzerEPSS 0.8%CVE-2026-50277HIGHdd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2024-25026MEDIUMIBM WebSphere Application Server denial of serviceEPSS 0.8%CVE-2025-11447HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-33756HIGHSaleor Affected by Denial of Service via Unbounded GraphQL Query BatchingEPSS 0.8%CVE-2026-54332MEDIUMGoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoSEPSS 0.8%CVE-2026-54345MEDIUMGoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)EPSS 0.8%CVE-2024-8966HIGHDenial of Service in gradio-app/gradioEPSS 0.8%CVE-2026-40036HIGHUnfurl < 2026.04 - Denial of Service via Unbounded zlib DecompressionEPSS 0.8%CVE-2026-12151HIGHundici WebSocket client vulnerable to denial of service via fragment count bypassEPSS 0.8%CVE-2023-0382MEDIUMUncontrolled Resource Consumption in M-Files ServerEPSS 0.8%CVE-2026-35469HIGHSpdyStream: DOS on CRIEPSS 0.8%CVE-2025-47793MEDIUMNextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text fileEPSS 0.8%