Fallos del tipo CWE-770
1861 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2026-12707HIGHUnbounded path event queue growth in quiche via peer-driven source connection ID rotationEPSS 0.4%CVE-2026-14362MEDIUMDenial of service via crafted push/pull gossip message in memberlistEPSS 0.4%CVE-2026-56143MEDIUMAllocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2023-25656HIGHnotation-go has excessive memory allocation on verificationEPSS 0.4%CVE-2025-62666MEDIUMDoS vector through the cirrusbuilddoc query APIEPSS 0.4%CVE-2026-22815MEDIUMAIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headersEPSS 0.4%CVE-2025-59421LOWPress vulnerable to email flooding to users due to lack of validation and rate limitsEPSS 0.4%CVE-2026-6948MEDIUMUnbounded Memory Allocation in VQLResponse Result-Set WriterEPSS 0.4%CVE-2025-27795MEDIUMReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.EPSS 0.4%CVE-2024-31617MEDIUMOpenLiteSpeed before 1.8.1 mishandles chunked encoding.EPSS 0.4%CVE-2025-3475MEDIUMWEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030EPSS 0.4%CVE-2024-46933HIGHAn issue was discovered in Atos Eviden BullSequana XH2140 BMC before C4EM-125: OMF_C4E 101.05.0014. Some BullSequana XH products were shippeEPSS 0.4%CVE-2023-45028MEDIUMQTS, QuTS hero, QuTScloudEPSS 0.4%CVE-2026-41644HIGHmonetr is vulnerable to server-side request forgery in Lunch Flow link creation and refreshEPSS 0.4%CVE-2026-91970HIGHVikunja before 2.6.0 Resource Exhaustion via Planka MigrationEPSS 0.4%CVE-2026-39904HIGHGophish 0.12.1 Denial of Service via Office Document UploadEPSS 0.4%CVE-2026-85582HIGHSiYuan before v3.8.2 Unbounded Session Creation via Basic AuthEPSS 0.4%CVE-2026-48987MEDIUMpyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManagerEPSS 0.4%CVE-2026-61617HIGHPterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustionEPSS 0.4%CVE-2026-61652HIGHZapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)EPSS 0.4%