Fallos del tipo CWE-770
1861 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2025-26819HIGHMonero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections.EPSS 0.6%CVE-2026-59675HIGHRancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of ServiceEPSS 0.6%CVE-2026-73228MEDIUMDjango REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`EPSS 0.6%CVE-2024-33862HIGHA buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers toEPSS 0.6%CVE-2026-74039HIGHWazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_contextEPSS 0.6%CVE-2023-46738MEDIUMAuthenticated users can crash the CubeFS servers with maliciously crafted requestsEPSS 0.6%CVE-2026-22258HIGHSuricata DCERPC: unbounded fragment buffering leads to memory exhaustionEPSS 0.6%CVE-2026-35602MEDIUMVikunja has a File Size Limit Bypass via Vikunja ImportEPSS 0.6%CVE-2026-31283CRITICALIn Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used fEPSS 0.6%CVE-2024-45100MEDIUMIBM Security QRadar EDR denial of serviceEPSS 0.6%CVE-2025-58582MEDIUMUncontrolled Resource Consumption via log fileEPSS 0.6%CVE-2026-26477MEDIUMAn issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() functEPSS 0.6%CVE-2026-16100MEDIUMKeycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error textEPSS 0.6%CVE-2022-45471LOWIn JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email addressEPSS 0.6%CVE-2026-75516HIGHRabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcementEPSS 0.6%CVE-2026-55434MEDIUMCoder vulnerable to denial of service via unbounded request body in AI Bridge provider endpointsEPSS 0.6%CVE-2025-71396LOWSurrealDB before 2.2.2 Denial of Service via JavaScript ScriptingEPSS 0.6%CVE-2026-47483HIGHNVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled reEPSS 0.6%CVE-2023-40709MEDIUMUncontrolled Resource Consumption in OPTO 22 SNAP PAC S1 Built-In Web ServerEPSS 0.6%CVE-2026-85703MEDIUMramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resourcesEPSS 0.6%