Fallos del tipo CWE-770
1861 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2026-50142HIGHlibheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)EPSS 0.7%CVE-2026-59200HIGHPillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()EPSS 0.7%CVE-2026-73089HIGHBrowserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOMEPSS 0.7%CVE-2026-25762HIGHAdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type DetectionEPSS 0.7%CVE-2026-66275MEDIUMApache Qpid Proton-J: Incoming session flow control window can be exceededEPSS 0.7%CVE-2026-67555MEDIUMApache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming deliveryEPSS 0.7%CVE-2023-20033HIGHA vulnerability in Cisco IOS XE Software for Cisco Catalyst 3650 and Catalyst 3850 Series Switches could allow an unauthenticated, remote atEPSS 0.7%CVE-2026-67553MEDIUMApache Qpid Proton Dotnet: Incoming session flow control window can be exceededEPSS 0.7%CVE-2026-68075MEDIUMApache Qpid Broker-J: Incoming session flow control window can be exceededEPSS 0.7%CVE-2024-47874HIGHStarlette Denial of service (DoS) via multipart/form-dataEPSS 0.7%CVE-2026-67591MEDIUMApache Qpid ProtonJ2: Incoming session flow control window can be exceededEPSS 0.7%CVE-2026-66277MEDIUMApache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming deliveryEPSS 0.7%CVE-2026-68078MEDIUMApache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming deliveryEPSS 0.7%CVE-2026-93838HIGHSGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idxEPSS 0.7%CVE-2023-5289HIGHAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.7%CVE-2023-28107MEDIUMDiscourse vulnerable to multisite DoS by spamming backupsEPSS 0.7%CVE-2026-42236HIGHn8n: Unauthenticated Denial of Service via MCP Client RegistrationEPSS 0.7%CVE-2025-0315HIGHAllocation of Resources Without Limits or Throttling in ollama/ollamaEPSS 0.7%CVE-2026-69152HIGHbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationEPSS 0.6%CVE-2024-52915HIGHBitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.EPSS 0.6%