Fallos del tipo CWE-770

1852 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2026-66257HIGHApache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2023-54365HIGHTraefik - Denial of Service via HTTP/2 Request HandlingEPSS 0.8%CVE-2025-54939MEDIUMLiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.EPSS 0.8%CVE-2024-7768HIGHDenial of Service in h2oai/h2o-3EPSS 0.8%CVE-2026-23490HIGHpyasn1 has a DoS vulnerability in decoderEPSS 0.8%CVE-2023-38706MEDIUMDiscourse vulnerable to DoS via draftsEPSS 0.8%CVE-2024-4539MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2024-3302LOWThere was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of MemoryEPSS 0.8%CVE-2026-34756MEDIUMvLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API ServerEPSS 0.8%CVE-2026-73108HIGHRustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodecEPSS 0.8%CVE-2026-44579HIGHNext.js: Denial of Service via connection exhaustion in applications using Cache ComponentsEPSS 0.8%CVE-2025-5996MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2024-32871HIGHPimcore Vulnerable to Flooding Server with Thumbnail filesEPSS 0.8%CVE-2026-54135HIGHAirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP ServerEPSS 0.8%CVE-2023-34994LOWAn improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAEPSS 0.8%CVE-2020-15213MEDIUMDenial of service in tensorflow-liteEPSS 0.8%CVE-2026-29609HIGHOpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media FetchEPSS 0.8%CVE-2026-41400MEDIUMOpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-callEPSS 0.8%CVE-2026-32062HIGHOpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media StreamEPSS 0.8%CVE-2026-87742HIGHQuarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message bufferingEPSS 0.8%