Fallos del tipo CWE-770
2214 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2020-15168LOWFile size limit bypass in node-fetchEPSS 1.7%CVE-2024-38286HIGHApache Tomcat: Denial of ServiceEPSS 1.7%CVE-2026-1519HIGHExcessive NSEC3 iterations cause high CPU load during insecure delegation validationEPSS 1.7%CVE-2020-18899MEDIUMAn uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of serEPSS 1.7%CVE-2022-36104MEDIUMDenial of Service via Page Error Handling in TYPO3/cmsEPSS 1.6%CVE-2005-4650MEDIUMJoomla! 1.03 does not restrict the number of "Search" Mambots, which allows remote attackers to cause a denial of service (resource consumptEPSS 1.6%CVE-2023-27958CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.EPSS 1.6%CVE-2023-45142HIGHOpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metricsEPSS 1.6%CVE-2017-2613MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained untEPSS 1.6%CVE-2025-41704MEDIUMPhoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function CodeEPSS 1.6%CVE-2022-0084—A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expecEPSS 1.6%CVE-2026-23869HIGHA denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-serverEPSS 1.6%CVE-2019-11939—Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, mEPSS 1.6%CVE-2022-36124HIGHMemory overconsumption in Avro Rust SDKEPSS 1.6%CVE-2025-50172MEDIUMDirectX Graphics Kernel Denial of Service VulnerabilityEPSS 1.6%CVE-2022-21952HIGHSUMA unauthenticated remote DoS via resource exhaustionEPSS 1.5%CVE-2022-26336—A carefully crafted TNEF file can cause an out of memory exceptionEPSS 1.5%CVE-2023-39533HIGHlibp2p nodes vulnerable to attack using large RSA keysEPSS 1.5%CVE-2021-33541HIGHPhoenix Contact: ILC1x Industrial controllers affected by Denial-of-Service vulnerabilityEPSS 1.5%CVE-2023-24536HIGHExcessive resource consumption in net/http, net/textproto and mime/multipartEPSS 1.5%