Fallos del tipo CWE-770
1861 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2026-77856HIGHUnbounded atom creation from typed struct field names in AshTypescript field selectorEPSS 0.5%CVE-2026-42788MEDIUMHTTP/2 frame size limit checked after body is buffered in banditEPSS 0.5%CVE-2023-51297MEDIUMA lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amountEPSS 0.5%CVE-2025-68456HIGHUnauthenticated Craft CMS users can trigger a database backupEPSS 0.5%CVE-2026-74837HIGHUnbounded atom creation from client-supplied RPC field names in AshTypescript field formatterEPSS 0.5%CVE-2026-57220HIGHRabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoSEPSS 0.5%CVE-2020-36907HIGHExtreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of ServiceEPSS 0.5%CVE-2024-56319HIGHIn Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before e3277eb, unlimited user label appends in a userlabel cluster can leadEPSS 0.5%CVE-2025-15682HIGHUnauthenticated Resource ExhaustionEPSS 0.5%CVE-2023-5573MEDIUMAllocation of Resources Without Limits or Throttling in vriteio/vriteEPSS 0.5%CVE-2026-44499HIGHZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer PoisoningEPSS 0.5%CVE-2024-52796MEDIUMPassword Pusher's rate limiter can be bypassed by forging proxy headersEPSS 0.5%CVE-2026-69079HIGHUnauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-TransmuteEPSS 0.5%CVE-2023-37906MEDIUMDiscourse vulnerable to DoS via post edit reasonEPSS 0.5%CVE-2026-50018MEDIUMHoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve ActionsEPSS 0.5%CVE-2026-86452HIGHMISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request FloodingEPSS 0.5%CVE-2026-44240HIGHbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingEPSS 0.5%CVE-2026-46629MEDIUMTwig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled argumentsEPSS 0.5%CVE-2026-11622HIGHPotential memory usage beyond configured limitsEPSS 0.5%CVE-2023-3242HIGHImproper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated netwEPSS 0.5%