Fallos del tipo CWE-770

1861 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2026-94624HIGHvLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading SessionsEPSS 0.6%CVE-2026-69218HIGHHttp4s Ember HTTP/2: unbounded continuation frame accumulationEPSS 0.6%CVE-2026-85448HIGHMOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State RetentionEPSS 0.6%CVE-2026-45664MEDIUMImageMagick: Policy Bypass in MNG coder couldEPSS 0.6%CVE-2026-9563HIGHIn Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number oEPSS 0.6%CVE-2026-46599HIGHExcessive resource consumption in PackBits decompression in golang.org/x/image/tiffEPSS 0.6%CVE-2026-69213HIGHHttp4s Ember HTTP/2: unbounded outbound frame queueEPSS 0.6%CVE-2026-69203HIGHHttp4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMSEPSS 0.6%CVE-2026-73493HIGHhttp4s-blaze-server: Unbounded WebSocket message aggregationEPSS 0.6%CVE-2026-85447HIGHMOOS-IvP through 24.8.1 pRealm Unbounded REALMCAST_REQ Subscription Denial of ServiceEPSS 0.6%CVE-2026-27880HIGHOpenFeature evaluation API reads input data with no boundsEPSS 0.6%CVE-2026-69202HIGHHttp4s Ember HTTP/2: unbounded inbound body bufferingEPSS 0.6%CVE-2026-49866HIGHlibp2p: CPU DoS via oversized IHAVE and IWANT control message arraysEPSS 0.6%CVE-2026-85450HIGHMOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource ExhaustionEPSS 0.6%CVE-2026-53752HIGHdocx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of ServiceEPSS 0.6%CVE-2026-54638HIGHtd has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.DecodeEPSS 0.6%CVE-2026-69209HIGHHttp4s: WebSocket decoder accepts unbounded message sizesEPSS 0.6%CVE-2024-7807HIGHDenial of Service (DOS) in gaizhenbiao/chuanhuchatgptEPSS 0.6%CVE-2026-60081HIGHDBI::ProfileData versions before 1.651 for Perl do not limit the path indexEPSS 0.6%CVE-2024-41743HIGHIBM TXSeries for Multiplatforms denial of serviceEPSS 0.6%