Fallos del tipo CWE-770
1861 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2026-40104MEDIUMXWiki's REST APIs can list all pages/spaces, leading to unavailabilityEPSS 0.7%CVE-2025-6203HIGHVault unauthenticated denial of service through complex json payloadEPSS 0.7%CVE-2026-77337CRITICALCakePHP: Potential Authentication bypass with CookieAuthenticatorEPSS 0.7%CVE-2023-38498MEDIUMDiscourse vulnerable to DoS via defer queueEPSS 0.7%CVE-2026-73635HIGHApache Struts: Unbounded growth of localized-text caches driven by the request localeEPSS 0.7%CVE-2026-73500HIGHetcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadlineEPSS 0.7%CVE-2025-2559MEDIUMOrg.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloakEPSS 0.7%CVE-2026-55951HIGHhttpc memory exhaustion via unbounded response header accumulationEPSS 0.7%CVE-2021-25666—A vulnerability has been identified in SCALANCE W780 and W740 (IEEE 802.11n) family (All versions < V6.3). Sending specially crafted packetsEPSS 0.7%CVE-2024-57663HIGHAn issue in the sqlg_place_dpipes component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via EPSS 0.7%CVE-2024-46666MEDIUMAn allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2EPSS 0.7%CVE-2026-33332MEDIUMNiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustionEPSS 0.7%CVE-2024-25143MEDIUMThe Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service packEPSS 0.7%CVE-2026-57173MEDIUMvLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completionsEPSS 0.7%CVE-2023-27492MEDIUMEnvoy may crash when a large request body is processed in Lua filterEPSS 0.7%CVE-2025-21508MEDIUMVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are EPSS 0.7%CVE-2025-32952MEDIUMio.jmix.localfs:jmix-localfs affected by DoS in the Local File StorageEPSS 0.7%CVE-2025-29907HIGHjsPDF Bypass Regular Expression Denial of Service (ReDoS)EPSS 0.7%CVE-2025-21509MEDIUMVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are EPSS 0.7%CVE-2026-48748HIGHNetty HTTP/3 QPACK Blocked Streams Memory ExhaustionEPSS 0.7%