Fallos del tipo CWE-770
1861 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2024-55195HIGHAn allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the prograEPSS 0.5%CVE-2025-8885MEDIUMPossible DOS in processing specially formed ASN.1 Object IdentifiersEPSS 0.5%CVE-2026-48824MEDIUMMailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)EPSS 0.5%CVE-2026-82562MEDIUMqs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)EPSS 0.5%CVE-2024-6598HIGHDenial-of-service on KNIME Business Hub when certain jobs are executedEPSS 0.5%CVE-2026-54274MEDIUMAIOHTTP: Incomplete websocket frame payloads bypass memory limitsEPSS 0.5%CVE-2026-41899MEDIUMCoolify unauthenticated feedback endpoint allows Discord webhook abuseEPSS 0.5%CVE-2026-47683HIGHvm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLikeEPSS 0.5%CVE-2023-40542HIGHBIG-IP TCP Profile vulnerabilityEPSS 0.5%CVE-2025-20209HIGHCisco IOS XR Software Internet Key Exchange Version 2 Denial of Service VulnerabilityEPSS 0.5%CVE-2025-21495MEDIUMVulnerability in the MySQL Enterprise Firewall product of Oracle MySQL (component: Firewall). Supported versions that are affected are 8.0.EPSS 0.5%CVE-2019-3882MEDIUMA flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device iEPSS 0.5%CVE-2026-18401MEDIUMjackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of serviceEPSS 0.5%CVE-2025-1072MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2025-54879MEDIUMMastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emailsEPSS 0.5%CVE-2025-58446MEDIUMxgrammar vulnerable to denial of service by huge enum grammarEPSS 0.5%CVE-2025-32034HIGHApollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment ExpansionEPSS 0.5%CVE-2024-11171HIGHImproper Input Validation in danny-avila/librechatEPSS 0.5%CVE-2026-11897HIGHIBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2EPSS 0.5%CVE-2023-6386MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%