Fallos del tipo CWE-770
1861 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2026-31866HIGHAllocation of Resources Without Limits or Throttling in flagdEPSS 0.6%CVE-2026-85581HIGHSiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registrationEPSS 0.6%CVE-2026-48802HIGHpython-engineio has unbound thread allocation that can cause denial of serviceEPSS 0.6%CVE-2025-32032HIGHApollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization BypassEPSS 0.6%CVE-2026-40116HIGHPraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate LimitsEPSS 0.6%CVE-2023-4912LOWAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2025-27419CRITICALDenial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLsEPSS 0.6%CVE-2026-20216HIGHClamAV InstallShield File Format Processing Resource Exhaustion VulnerabilityEPSS 0.6%CVE-2026-62649HIGHA vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resourcEPSS 0.6%CVE-2026-59762HIGHBIG-IP HTTP/2 vulnerabilityEPSS 0.6%CVE-2024-57664HIGHAn issue in the sqlg_group_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crEPSS 0.6%CVE-2026-44545MEDIUMUnbounded WebSocket message and frame sizes can cause unauthenticated remote denial of serviceEPSS 0.6%CVE-2025-24033HIGH@fastify/multipart vulnerable to unlimited consumption of resourcesEPSS 0.6%CVE-2025-59830HIGHRack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parametersEPSS 0.6%CVE-2025-44652HIGHIn Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attEPSS 0.6%CVE-2025-68272HIGHSignal K Server Vulnerable to Denial of Service via Unrestricted Access Request FloodingEPSS 0.6%CVE-2024-28762MEDIUMIBM Db2 denial of serviceEPSS 0.6%CVE-2021-47752HIGHAWebServer GhostBuilding 18 - Denial of Service (DoS)EPSS 0.6%CVE-2026-92003MEDIUMMISP Unthrottled Authentication Failure Log Writes Enable Resource ExhaustionEPSS 0.6%CVE-2025-69223HIGHAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombEPSS 0.6%