Fallos del tipo CWE-770

1861 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2023-36521HIGHA vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (AlEPSS 0.6%CVE-2025-1451HIGHInsufficient Patch Leading to DoS in parisneo/lollms-webuiEPSS 0.6%CVE-2024-8018HIGHDenial of Service (DOS) in imartinez/privategptEPSS 0.6%CVE-2024-10225HIGHDenial of Service in haotian-liu/llavaEPSS 0.6%CVE-2024-10714HIGHDenial of Service in binary-husky/gpt_academicEPSS 0.6%CVE-2026-41408LOWOpenClaw < 2026.3.31 - Disk Exhaustion via Media Download BypassEPSS 0.6%CVE-2026-59990HIGHJawn: Uncontrolled nesting depth in JSON parserEPSS 0.6%CVE-2026-45763MEDIUMSuricata lua: sandbox allocation limit not enforced for new allocationsEPSS 0.6%CVE-2023-37900LOWCrossplane vulnerable to denial of service from large imageEPSS 0.6%CVE-2026-26313MEDIUMGo Ethereum affected by DoS via malicious p2p messageEPSS 0.6%CVE-2026-68494HIGHjackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)EPSS 0.6%CVE-2024-43709MEDIUMElasticsearch allocation of resources without limits or throttling leads to crashEPSS 0.6%CVE-2026-55241HIGHCheckmate: Pre-auth Denial of Service via File Upload on RegistrationEPSS 0.6%CVE-2023-41043MEDIUMDiscourse DoS via SvgSprite cacheEPSS 0.6%CVE-2023-40588MEDIUMDiscourse DoS via 2FA and Security Key NamesEPSS 0.6%CVE-2026-7427MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2024-5208MEDIUMUncontrolled Resource Consumption in mintplex-labs/anything-llmEPSS 0.6%CVE-2026-46405MEDIUMOpenBao's Kerberos Auth Method Accumulates Unaccessible TokensEPSS 0.6%CVE-2025-22273CRITICALLack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege ManagerEPSS 0.6%CVE-2026-45766HIGHSuricata nfs: unbounded stateful structures can lead to resource exhaustionEPSS 0.6%