Fallos del tipo CWE-770
1861 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2024-8028HIGHDenial of Service in danswer-ai/danswerEPSS 0.5%CVE-2026-42256MEDIUMnet-imap: Denial of service via high iteration count for `SCRAM-*` authenticationEPSS 0.5%CVE-2026-25224LOWFastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStreamEPSS 0.5%CVE-2026-84447HIGHlibheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoSEPSS 0.5%CVE-2026-19873HIGHHTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elementsEPSS 0.5%CVE-2026-59251HIGHDenial of service via exponential certificate policy tree growth in path validationEPSS 0.5%CVE-2026-88012MEDIUMTraefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unboundedEPSS 0.5%CVE-2024-21771HIGHF5 AFM Signature Matching VulnerabilityEPSS 0.5%CVE-2026-33241HIGHSalvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data ParsingEPSS 0.5%CVE-2025-41693MEDIUMAuthenticated Denial-of-Service via SSHEPSS 0.5%CVE-2024-34046HIGHThe O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->sctpParams->e2tCounters[IN_SUEPSS 0.5%CVE-2023-51393MEDIUMPotential DoS due to BusFault and Assert in Ember ZNet legacy packet bufferEPSS 0.5%CVE-2026-30827HIGHexpress-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting (all IPv4 clients share one bucket on dual-stack servers)EPSS 0.5%CVE-2023-3967MEDIUMDoS Vulnerability in Hitachi Ops Center Common ServicesEPSS 0.5%CVE-2023-44191HIGHJunos OS: QFX5000 Series and EX4000 Series: Denial of Service (DoS) on a large scale VLAN due to PFE hoggingEPSS 0.5%CVE-2026-20177MEDIUMCisco Industrial Ethernet 1000 Series Switches Denial of Service VulnerabilityEPSS 0.5%CVE-2026-54037MEDIUMLibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/forkEPSS 0.5%CVE-2026-76716MEDIUMUnauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)EPSS 0.5%CVE-2024-49589MEDIUMFoundry artifacts denial of serviceEPSS 0.5%CVE-2025-32030HIGHApollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment ExpansionEPSS 0.5%