Fallos del tipo CWE-770

2228 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2024-45412MEDIUMYeti affected by a Potential Denial of Service due to the One Milion Unicode characters attackEPSS 0.8%CVE-2024-41742HIGHIBM TXSeries for Multiplatforms denial of serviceEPSS 0.8%CVE-2026-112322HIGHKrb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanupEPSS 0.8%CVE-2021-46760CRITICALA malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory accesEPSS 0.8%CVE-2026-56811HIGHPhoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of serviceEPSS 0.8%CVE-2023-5289HIGHAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.8%CVE-2026-68060HIGHApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.8%CVE-2026-66257HIGHApache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-68074HIGHApache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2024-4539MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-67465HIGHApache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2024-32874MEDIUMIn Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of ServiceEPSS 0.8%CVE-2026-67588HIGHApache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-42039MEDIUMAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataEPSS 0.8%CVE-2026-25949HIGHTraefik: TCP readTimeout bypass via STARTTLS on PostgresEPSS 0.8%CVE-2023-38706MEDIUMDiscourse vulnerable to DoS via draftsEPSS 0.8%CVE-2022-31118MEDIUMMissing brute force protection on cloud federation sharing in Nextcloud ServerEPSS 0.8%CVE-2026-73108HIGHRustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodecEPSS 0.8%CVE-2024-3302LOWThere was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of MemoryEPSS 0.8%CVE-2024-32871HIGHPimcore Vulnerable to Flooding Server with Thumbnail filesEPSS 0.8%