Fallos del tipo CWE-770
1851 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2020-18899MEDIUMAn uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of serEPSS 1.7%CVE-2017-2613MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained untEPSS 1.6%CVE-2005-4650MEDIUMJoomla! 1.03 does not restrict the number of "Search" Mambots, which allows remote attackers to cause a denial of service (resource consumptEPSS 1.6%CVE-2023-27958CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.EPSS 1.6%CVE-2022-36104MEDIUMDenial of Service via Page Error Handling in TYPO3/cmsEPSS 1.6%CVE-2026-1519HIGHExcessive NSEC3 iterations cause high CPU load during insecure delegation validationEPSS 1.6%CVE-2025-41704MEDIUMPhoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function CodeEPSS 1.6%CVE-2023-47108HIGHDoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metricsEPSS 1.6%CVE-2019-11939—Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, mEPSS 1.6%CVE-2026-23869HIGHA denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-serverEPSS 1.6%CVE-2022-21952HIGHSUMA unauthenticated remote DoS via resource exhaustionEPSS 1.5%CVE-2022-26336—A carefully crafted TNEF file can cause an out of memory exceptionEPSS 1.5%CVE-2023-39533HIGHlibp2p nodes vulnerable to attack using large RSA keysEPSS 1.5%CVE-2025-50172MEDIUMDirectX Graphics Kernel Denial of Service VulnerabilityEPSS 1.5%CVE-2021-33541HIGHPhoenix Contact: ILC1x Industrial controllers affected by Denial-of-Service vulnerabilityEPSS 1.5%CVE-2022-0084—A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expecEPSS 1.5%CVE-2023-24536HIGHExcessive resource consumption in net/http, net/textproto and mime/multipartEPSS 1.5%CVE-2023-27643HIGHAn issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button EPSS 1.5%CVE-2023-25576HIGH@fastify/multipart vulnerable to DoS due to unlimited number of partsEPSS 1.5%CVE-2024-31208MEDIUMSynapse's V2 state resolution weakness allows DoS from remote room membersEPSS 1.5%