Fallos del tipo CWE-770

1861 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2026-26998MEDIUMTraefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)EPSS 0.6%CVE-2023-40710MEDIUMAn adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller hEPSS 0.6%CVE-2026-79921HIGHamqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized PayloadEPSS 0.5%CVE-2026-81636HIGHQuery-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of serviceEPSS 0.5%CVE-2026-17163HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2026-23962HIGHMastodon vulnerable to Denial of Service from a single post (client/server)EPSS 0.5%CVE-2026-17199HIGHIBM i is Affected By Multiple Vulnerabilities in Host ServersEPSS 0.5%CVE-2026-13698MEDIUMA memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valiEPSS 0.5%CVE-2025-41770HIGHUnauthenticated Denial of ServiceEPSS 0.5%CVE-2026-16308HIGHIBM Enterprise Build of Quarkus is affected by a DoS vulnerabilityEPSS 0.5%CVE-2026-17170HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2026-59279HIGHUnbounded persistent session allocation via repeated initialize requestsEPSS 0.5%CVE-2026-15972HIGHUnauthenticated denial of service via unbounded external gRPC connection acceptanceEPSS 0.5%CVE-2026-17271HIGHIBM i is Affected By Multiple Vulnerabilities in the Debug ServerEPSS 0.5%CVE-2026-12733HIGHIBM DataPower Gateway affected by denial of serviceEPSS 0.5%CVE-2026-69147MEDIUMvLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservationEPSS 0.5%CVE-2026-42420MEDIUMOpenClaw < 2026.4.8 - Improper Base64 Decoding Size ValidationEPSS 0.5%CVE-2026-22025MEDIUMCryptoLib Memory Leak on HTTP Error Response in KMC ClientEPSS 0.5%CVE-2026-72888MEDIUMNet::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_requireEPSS 0.5%CVE-2026-53585MEDIUMlibgit2: Unbounded Memory Allocation via Delta Object Result-Size HeaderEPSS 0.5%