Fallos del tipo CWE-770
1850 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2019-16770MEDIUMPotential DOS attack in PumaEPSS 2.0%CVE-2022-22970—In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable tEPSS 2.0%CVE-2022-3423HIGHAllocation of Resources Without Limits or Throttling in nocodb/nocodbEPSS 2.0%CVE-2024-56374MEDIUMAn issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strinEPSS 1.9%CVE-2021-34735HIGHCisco ATA 190 Series Analog Telephone Adapter Software VulnerabilitiesEPSS 1.9%CVE-2024-12254HIGHUnbounded memory buffering in SelectorSocketTransport.writelines()EPSS 1.9%CVE-2020-28400HIGHAffected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerabilityEPSS 1.9%CVE-2023-27530HIGHA DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could alEPSS 1.8%CVE-2023-25193HIGHhb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looEPSS 1.8%CVE-2018-3711—Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" andEPSS 1.8%CVE-2021-27383HIGHA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 1.8%CVE-2023-34455HIGHsnappy-java's unchecked chunk length leads to DoSEPSS 1.8%CVE-2024-38821CRITICALAuthorization Bypass of Static Resources in WebFlux ApplicationsEPSS 1.7%CVE-2018-3737—sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.EPSS 1.7%CVE-2022-35724—Denial of service while reading data in Avro Rust SDKEPSS 1.7%CVE-2022-36324HIGHAffected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypaEPSS 1.7%CVE-2023-23916MEDIUMAn allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algoriEPSS 1.7%CVE-2020-15168LOWFile size limit bypass in node-fetchEPSS 1.7%CVE-2024-38286HIGHApache Tomcat: Denial of ServiceEPSS 1.7%CVE-2025-26682HIGHASP.NET Core and Visual Studio Denial of Service VulnerabilityEPSS 1.7%