Fallos del tipo CWE-770
2214 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2023-27643HIGHAn issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button EPSS 1.5%CVE-2023-25576HIGH@fastify/multipart vulnerable to DoS due to unlimited number of partsEPSS 1.5%CVE-2024-31208MEDIUMSynapse's V2 state resolution weakness allows DoS from remote room membersEPSS 1.5%CVE-2026-48779HIGHws: Memory exhaustion DoS from tiny fragments and data chunksEPSS 1.4%CVE-2023-25577HIGHWerkzeug may allow high resource usage when parsing multipart form data with many fieldsEPSS 1.4%CVE-2019-10171HIGHIt was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacEPSS 1.4%CVE-2023-45129MEDIUMmatrix-synapse vulnerable to denial of service due to malicious server ACL eventsEPSS 1.4%CVE-2024-53907HIGHAn issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags templateEPSS 1.4%CVE-2022-20622HIGHCisco Embedded Wireless Controller with Catalyst Access Points IP Flood Denial of Service VulnerabilityEPSS 1.4%CVE-2025-59375HIGHlibexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsiEPSS 1.4%CVE-2024-29025MEDIUMNetty HttpPostRequestDecoder can OOMEPSS 1.4%CVE-2024-21011LOWVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: HotspotEPSS 1.4%CVE-2023-3566LOWwallabag Profile Config config allocation of resourcesEPSS 1.4%CVE-2024-44083HIGHida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the EPSS 1.4%CVE-2022-20751HIGHCisco Firepower Threat Defense Software Snort Out of Memory Denial of Service VulnerabilityEPSS 1.4%CVE-2022-3371HIGHNo limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffwebEPSS 1.3%CVE-2026-33871HIGHNetty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassEPSS 1.3%CVE-2023-36461HIGHMastodon vulnerable to Denial of Service through slow HTTP responsesEPSS 1.3%CVE-2023-27540MEDIUMIBM Watson CP4D Data Stores denial of serviceEPSS 1.3%CVE-2021-1350MEDIUMCisco Umbrella Dashboard Packet Flood VulnerabilityEPSS 1.3%