Fallos del tipo CWE-770

1861 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2023-6386MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2025-10004HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2024-51428HIGHAn issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet.EPSS 0.5%CVE-2025-12044HIGHVault Vulnerable to Denial of Service Due to Rate Limit RegressionEPSS 0.5%CVE-2024-21604HIGHJunos OS Evolved: A high rate of specific traffic will cause a complete system outageEPSS 0.5%CVE-2024-52916HIGHBitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers.EPSS 0.5%CVE-2024-52914HIGHIn Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction.EPSS 0.5%CVE-2025-0635MEDIUMDenial of Service condition in M-Files ServerEPSS 0.5%CVE-2026-72838HIGHFileBrowser before 2.63.19 Disk Exhaustion via TUS UploadEPSS 0.5%CVE-2025-2934MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-8280MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2024-35238MEDIUMDenial of service of Minder Server from maliciously crafted GitHub attestationsEPSS 0.5%CVE-2026-55497MEDIUMCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)EPSS 0.5%CVE-2026-42931MEDIUMDenial of Service via Unbounded io.ReadAll in NPM Package Tag EndpointEPSS 0.5%CVE-2025-32959MEDIUMCUBA Vulnerable to Denial of Service (DoS) in the File StorageEPSS 0.5%CVE-2026-8466HIGHUnbounded buffer accumulation in multipart header parsing causes denial of service in cowboyEPSS 0.5%CVE-2026-73565MEDIUM@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshakeEPSS 0.5%CVE-2025-10569MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2024-56316HIGHIn AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to cEPSS 0.5%CVE-2026-61712LOWBuildKit: Possible runtime DoS via unbounded group parsingEPSS 0.5%