Fallos del tipo CWE-770
1861 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2026-44004HIGHvm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)EPSS 0.7%CVE-2026-34148HIGHFedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolutionEPSS 0.7%CVE-2023-34389MEDIUMAllocation of resources without limits could lead to denial of serviceEPSS 0.7%CVE-2026-68956HIGHSSH daemon allocates unbounded idle session channels, bypassing max_channelsEPSS 0.7%CVE-2023-22323HIGHBIG-IP SSL OCSP Authentication profile vulnerabilityEPSS 0.7%CVE-2026-27572MEDIUMWasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instanceEPSS 0.7%CVE-2026-41309HIGHOpen Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image ProcessingEPSS 0.7%CVE-2026-25985HIGHMemory allocation with excessive without limits in the internal SVG decoderEPSS 0.7%CVE-2022-45434MEDIUMSome Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the fiEPSS 0.7%CVE-2026-82753HIGHUnauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_serverEPSS 0.7%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.7%CVE-2026-91080HIGHwebhook through 2.8.3 Memory Exhaustion via Oversized Request BodyEPSS 0.7%CVE-2026-85664HIGHChroma 1.5.9 Unbounded HNSW Index Parameters Memory ExhaustionEPSS 0.7%CVE-2026-27204MEDIUMWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustionEPSS 0.7%CVE-2024-29902MEDIUMCosign vulnerable to system-wide denial of service via malicious attachmentsEPSS 0.7%CVE-2026-34829HIGHRack: Denial of Service via Unbounded Multipart File Upload Without Content-LengthEPSS 0.7%CVE-2026-34827HIGHRack: Algorithmic-Complexity DoS in Rack::Multipart::ParserEPSS 0.7%CVE-2026-7541MEDIUMDenial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpointEPSS 0.7%CVE-2023-41038HIGHServer crash when using specific form of SET BIND statementEPSS 0.7%CVE-2026-73089HIGHBrowserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOMEPSS 0.7%