Fallos del tipo CWE-770

2228 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2024-32871HIGHPimcore Vulnerable to Flooding Server with Thumbnail filesEPSS 0.8%CVE-2026-54135HIGHAirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP ServerEPSS 0.8%CVE-2026-112779CRITICALGrav API Plugin before 1.0.42 Cache Exhaustion and Page Permission BypassEPSS 0.8%CVE-2023-34994LOWAn improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAEPSS 0.8%CVE-2020-15213MEDIUMDenial of service in tensorflow-liteEPSS 0.8%CVE-2026-23490HIGHpyasn1 has a DoS vulnerability in decoderEPSS 0.8%CVE-2026-87742HIGHQuarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message bufferingEPSS 0.8%CVE-2026-39804HIGHWebSocket permessage-deflate inflate has no output-size cap in banditEPSS 0.8%CVE-2024-9229HIGHDenial of Service (DoS) via Multipart Boundary in stangirard/quivrEPSS 0.8%CVE-2026-54297HIGHFaraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parametersEPSS 0.8%CVE-2026-55407MEDIUMBuffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded AllocationEPSS 0.8%CVE-2026-47067HIGHAtom table exhaustion via unrecognized URL schemes in hackneyEPSS 0.8%CVE-2026-28342HIGHOliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API EndpointEPSS 0.8%CVE-2024-24752MEDIUMBref Uploaded Files Not Deleted in Event-Driven FunctionsEPSS 0.8%CVE-2026-16756HIGHAllocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of serviceEPSS 0.8%CVE-2026-74878CRITICALopenssl_encrypt before 1.4.0 TOTP Rate Limiter BypassEPSS 0.7%CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.7%CVE-2026-44579HIGHNext.js: Denial of Service via connection exhaustion in applications using Cache ComponentsEPSS 0.7%CVE-2022-22211HIGHJunos OS Evolved: PTX Series: Multiple FPCs become unreachable due to continuous polling of specific SNMP OIDEPSS 0.7%CVE-2026-15711HIGHLibsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violationEPSS 0.7%