Fallos del tipo CWE-770

1861 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2025-27513HIGHOpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API PackageEPSS 0.5%CVE-2024-9367MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-8486MEDIUMAllocation of resources without limits or throttling vulnerability in Progress Software MOVEit AutomationEPSS 0.5%CVE-2025-44012HIGHQsync CentralEPSS 0.5%CVE-2026-54340HIGHh2o has HTTP/2 state amplificationEPSS 0.5%CVE-2026-1168HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-19474HIGH@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted uploadEPSS 0.5%CVE-2026-63750MEDIUMSurrealDB before 3.1.0 Memory Amplification via /sql WebSocketEPSS 0.5%CVE-2025-49140HIGHPion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS)EPSS 0.5%CVE-2026-54273MEDIUMAIOHTTP: HTTP/1 Pipelined Requests Queue Without LimitEPSS 0.5%CVE-2026-89425HIGHjackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growthEPSS 0.5%CVE-2024-31919MEDIUMIBM MQ denial of serviceEPSS 0.5%CVE-2026-77281MEDIUMCaddy: rewrite placeholder re-expansionEPSS 0.5%CVE-2024-48989HIGHA vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial EPSS 0.5%CVE-2023-0616MEDIUMIf a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, EPSS 0.5%CVE-2026-17076MEDIUMIBM i is Affected By Multiple Vulnerabilities in DRDA / DDMEPSS 0.5%CVE-2025-43857MEDIUMnet-imap rubygem vulnerable to possible DoS by memory exhaustionEPSS 0.5%CVE-2024-52918MEDIUMBitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) viaEPSS 0.5%CVE-2026-7768HIGH@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache GrowthEPSS 0.5%CVE-2026-26445HIGHstomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, whicEPSS 0.5%