Fallos del tipo CWE-770
1861 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2026-87011HIGHOpen WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutEPSS 0.6%CVE-2026-59873CRITICALnode-tar: Decompression/parse DoS via unlimited inputEPSS 0.6%CVE-2023-22403HIGHJunos OS: QFX10K Series: An ICCP flap will be observed due to excessive specific trafficEPSS 0.6%CVE-2024-26577HIGHVSeeFace through 1.13.38.c2 allows attackers to cause a denial of service (application hang) via a spoofed UDP packet containing at least 10EPSS 0.6%CVE-2026-49476HIGHSoup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieveEPSS 0.6%CVE-2026-42786HIGHWebSocket fragmented message reassembly unbounded in banditEPSS 0.6%CVE-2025-67221HIGHThe orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.EPSS 0.6%CVE-2026-14257HIGHbrace-expansion DoS via unbounded expansion length causing an out-of-memory process crashEPSS 0.6%CVE-2026-94613HIGHauthentik: Denial of Service via Document Type Declarations in SAML MessagesEPSS 0.6%CVE-2023-23603MEDIUMCalls to console.log allowed bypassing Content Security Policy via format directiveEPSS 0.6%CVE-2026-43973HIGHgun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustionEPSS 0.6%CVE-2026-43507MEDIUMAn issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustionEPSS 0.6%CVE-2024-53981HIGHpython-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundaryEPSS 0.6%CVE-2026-64868HIGHNew API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body loggingEPSS 0.6%CVE-2024-47502HIGHJunos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoSEPSS 0.6%CVE-2025-61920HIGHAuthlib is vulnerable to Denial of Service via Oversized JOSE SegmentsEPSS 0.6%CVE-2026-21728HIGHTempo query limit results in unbounded memory allocationEPSS 0.6%CVE-2024-33495HIGHA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageEPSS 0.6%CVE-2026-19830MEDIUMTRENDnet TEW-816DRM bftpd bftpd.conf allocation of resourcesEPSS 0.6%CVE-2026-15007MEDIUMDenial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configurationEPSS 0.6%