Fallos del tipo CWE-770

1861 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2023-3246MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2025-52568HIGHNeKernal Multiple Memory Corruption Vulnerabilities in mkfs.hefsEPSS 0.5%CVE-2021-47791MEDIUMSmartFTP Client 10.0.2909.0 - 'Multiple' Denial of ServiceEPSS 0.5%CVE-2026-75140HIGHjsoup Uncontrolled Resource Consumption in XmlTreeBuilderEPSS 0.5%CVE-2026-8469HIGHUnauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybookEPSS 0.5%CVE-2026-82728HIGHUnbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoSEPSS 0.5%CVE-2026-32689HIGHLong-poll NDJSON body splitting causes unbounded memory allocation in PhoenixEPSS 0.5%CVE-2026-77409HIGHRabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel BlockingEPSS 0.5%CVE-2026-56810HIGHmint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5EPSS 0.5%CVE-2026-55575HIGHLiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforceEPSS 0.5%CVE-2026-77528MEDIUMAutobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflationEPSS 0.5%CVE-2026-33592HIGHFindServers Memory Exhaustion in open62541EPSS 0.5%CVE-2026-48862HIGHUnbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrencyEPSS 0.5%CVE-2026-55205MEDIUMHermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow EndpointEPSS 0.5%CVE-2026-77403HIGHRabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size NegotiationEPSS 0.5%CVE-2025-24341MEDIUMA vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoEPSS 0.5%CVE-2026-57497MEDIUMwebtransport-go: Memory Exhaustion Attack due to Buffering of Unknown CapsulesEPSS 0.5%CVE-2026-53941MEDIUMInspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoSEPSS 0.5%CVE-2026-53653HIGHGrav: Unauthenticated denial of service via unbounded image derivative dimensionsEPSS 0.5%CVE-2026-27869MEDIUMWEB SERVICE (HTTP) DENIAL OF SERVICE VIA SLOW HEADERS ON REGESTA SMART HD-PLC OF TELDATEPSS 0.5%