Fallos del tipo CWE-770

1861 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2022-4045LOWAuthenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost serverEPSS 0.6%CVE-2026-15007MEDIUMDenial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configurationEPSS 0.6%CVE-2024-13054MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2026-30946HIGHParse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL APIEPSS 0.6%CVE-2023-39269HIGHA vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,EPSS 0.6%CVE-2023-38684MEDIUMDiscourse vulnerable to ossible DDoS due to unbounded limits in various controller actionsEPSS 0.6%CVE-2024-58339HIGHLlamaIndex <= 0.12.2 VannaQueryEngine SQL Execution Allows Resource ExhaustionEPSS 0.6%CVE-2026-32934HIGHCoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of serviceEPSS 0.6%CVE-2026-26076MEDIUMntpd-rs affected by excessive CPU load from malformed packetsEPSS 0.6%CVE-2022-46159MEDIUMAny authenticated Discourse user can create an unlisted topicEPSS 0.6%CVE-2024-52920HIGHBitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message.EPSS 0.6%CVE-2025-0189HIGHDenial of Service in aimhubio/aimEPSS 0.6%CVE-2024-2874MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2022-4723MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.6%CVE-2024-1066MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2026-48597HIGHAtom table exhaustion via untrusted URL scheme in Tesla.Adapter.MintEPSS 0.6%CVE-2026-69213HIGHHttp4s Ember HTTP/2: unbounded outbound frame queueEPSS 0.6%CVE-2026-49851HIGHMistune: Potential DoS via quadratic-time parsing in parse_link_textEPSS 0.6%CVE-2026-94624HIGHvLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading SessionsEPSS 0.6%