Fallos del tipo CWE-770
1851 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2023-5072HIGHDoS Vulnerability in JSON-JavaEPSS 1.4%CVE-2022-36124HIGHMemory overconsumption in Avro Rust SDKEPSS 1.4%CVE-2023-25577HIGHWerkzeug may allow high resource usage when parsing multipart form data with many fieldsEPSS 1.4%CVE-2024-53907HIGHAn issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags templateEPSS 1.4%CVE-2022-20622HIGHCisco Embedded Wireless Controller with Catalyst Access Points IP Flood Denial of Service VulnerabilityEPSS 1.4%CVE-2024-29025MEDIUMNetty HttpPostRequestDecoder can OOMEPSS 1.4%CVE-2024-21011LOWVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: HotspotEPSS 1.4%CVE-2019-10171HIGHIt was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacEPSS 1.4%CVE-2023-3566LOWwallabag Profile Config config allocation of resourcesEPSS 1.4%CVE-2024-44083HIGHida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the EPSS 1.4%CVE-2023-45142HIGHOpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metricsEPSS 1.4%CVE-2022-20751HIGHCisco Firepower Threat Defense Software Snort Out of Memory Denial of Service VulnerabilityEPSS 1.3%CVE-2025-59375HIGHlibexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsiEPSS 1.3%CVE-2023-36461HIGHMastodon vulnerable to Denial of Service through slow HTTP responsesEPSS 1.3%CVE-2023-27540MEDIUMIBM Watson CP4D Data Stores denial of serviceEPSS 1.3%CVE-2017-2587LOWA memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash.EPSS 1.3%CVE-2021-34741HIGHCisco Email Security Appliance Denial of Service VulnerabilityEPSS 1.3%CVE-2024-23185HIGHVery large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the messEPSS 1.3%CVE-2025-21490MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8EPSS 1.3%CVE-2021-1350MEDIUMCisco Umbrella Dashboard Packet Flood VulnerabilityEPSS 1.3%