Fallos del tipo CWE-770
2228 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2025-47287HIGHTornado vulnerable to excessive logging caused by malformed multipart form dataEPSS 0.7%CVE-2026-49835MEDIUMSigstore Timestamp Authority: OOM due to unbounded metric label cardinalityEPSS 0.7%CVE-2020-36946HIGHSyncBreeze 10.0.28 - 'login' Denial of ServiceEPSS 0.7%CVE-2026-71321HIGHNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationEPSS 0.7%CVE-2026-112319MEDIUMKrb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocationEPSS 0.7%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.7%CVE-2023-21144—In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This EPSS 0.7%CVE-2023-36370—An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQEPSS 0.7%CVE-2026-67592HIGHApache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming deliveryEPSS 0.7%CVE-2023-36366—An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crEPSS 0.7%CVE-2026-71257HIGHApache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsedEPSS 0.7%CVE-2026-91864HIGHApache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionEPSS 0.7%CVE-2026-42561HIGHPython-Multipart: Denial of Service via unbounded multipart part headersEPSS 0.7%CVE-2026-91865HIGHApache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceEPSS 0.7%CVE-2023-36367—An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SEPSS 0.7%CVE-2023-36365—An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) viEPSS 0.7%CVE-2023-36368—An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafEPSS 0.7%CVE-2023-36371—An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SEPSS 0.7%CVE-2023-36369—An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.7%CVE-2026-91866HIGHApache Neethi: Crafted policies cause unbounded work during intersection leading to denial of serviceEPSS 0.7%