Fallos del tipo CWE-770

2215 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2024-23185HIGHVery large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the messEPSS 1.3%CVE-2021-34741HIGHCisco Email Security Appliance Denial of Service VulnerabilityEPSS 1.3%CVE-2021-29511MEDIUMMemory over-allocation in evm crateEPSS 1.3%CVE-2026-1526HIGHundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionEPSS 1.3%CVE-2024-27268MEDIUMIBM WebSphere Application Server Liberty denial of serviceEPSS 1.3%CVE-2024-56374MEDIUMAn issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strinEPSS 1.3%CVE-2017-2587LOWA memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash.EPSS 1.3%CVE-2025-21490MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8EPSS 1.3%CVE-2026-70133HIGHWindows SMB Server Denial of Service VulnerabilityEPSS 1.3%CVE-2025-21504MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 aEPSS 1.3%CVE-2022-20757HIGHCisco Firepower Threat Defense Software Denial of Service VulnerabilityEPSS 1.3%CVE-2023-0121MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 1.2%CVE-2026-26018HIGHCoreDNS Loop Detection Denial of Service VulnerabilityEPSS 1.2%CVE-2023-6563HIGHKeycloak: offline session token dosEPSS 1.2%CVE-2026-70072MEDIUMWindows Netlogon Denial of Service VulnerabilityEPSS 1.2%CVE-2023-29779HIGHSengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messaEPSS 1.2%CVE-2026-70159HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.2%CVE-2026-70181HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.2%CVE-2025-46727HIGHUnbounded-Parameter DoS in Rack::QueryParserEPSS 1.2%CVE-2026-70163HIGHMicrosoft OpenSSH for Windows Denial of Service VulnerabilityEPSS 1.2%