Fallos del tipo CWE-770

1861 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2026-80212HIGHAn issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, andEPSS 0.6%CVE-2026-56859HIGHAdd recursion depth guard during decode in encoding/xmlEPSS 0.6%CVE-2026-56853HIGHApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpEPSS 0.6%CVE-2024-38808MEDIUMCVE-2024-38808: Spring Expression DoS VulnerabilityEPSS 0.6%CVE-2026-56862HIGHLimit handshake messages we are willing to accept post-handshake in crypto/tlsEPSS 0.6%CVE-2026-59848MEDIUMLibssh: libssh: denial of service via sftp responses with unknown request idsEPSS 0.6%CVE-2026-33658LOWRails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requestsEPSS 0.6%CVE-2026-39313HIGHMCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transportEPSS 0.6%CVE-2024-10051HIGHUnauthenticated Denial of Service in shaunwei/realcharEPSS 0.6%CVE-2026-28394MEDIUMOpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch ToolEPSS 0.6%CVE-2026-54277MEDIUMAIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented LinesEPSS 0.6%CVE-2025-58181MEDIUMUnbounded memory consumption in golang.org/x/crypto/sshEPSS 0.6%CVE-2026-22917MEDIUMImproper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.EPSS 0.6%CVE-2025-49007MEDIUMReDoS Vulnerability in Rack::Multipart handle_mime_headEPSS 0.6%CVE-2026-63074MEDIUMCMP Indefinite Cache Growth of ExtraCertsEPSS 0.6%CVE-2025-62672MEDIUMrplay through 3.3.2 allows attackers to cause a denial of service (SIGSEGV and daemon crash) or possibly have unspecified other impact. ThisEPSS 0.6%CVE-2024-39944HIGHA vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, caEPSS 0.6%CVE-2026-39414HIGHMinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV ParsingEPSS 0.6%CVE-2026-49209MEDIUMSymfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requestsEPSS 0.6%CVE-2025-32380HIGHApollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment ProcessingEPSS 0.6%