Fallos del tipo CWE-770

1863 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2025-36070MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2026-49347MEDIUMQuest Bot: Ticket creation has no per-user open-ticket limit or cooldownEPSS 0.4%CVE-2026-27887MEDIUMSpin has memory leaks in various WIT interfacesEPSS 0.4%CVE-2026-49249HIGHBoruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2EPSS 0.4%CVE-2026-5762MEDIUMReportIncident DiscussionTools integration causes slow requestsEPSS 0.4%CVE-2025-11243HIGHAllocation of Resources Without Limits or Throttling in Shelly Pro 4PMEPSS 0.4%CVE-2026-77121MEDIUMNexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata FieldsEPSS 0.4%CVE-2024-6600MEDIUMMemory corruption in WebGL APIEPSS 0.4%CVE-2025-11374MEDIUMConsul's KV endpoint is vulnerable to denial of serviceEPSS 0.4%CVE-2025-35965MEDIUMDoS in Mattermost Playbooks via Excessive Task ActionsEPSS 0.4%CVE-2025-11375MEDIUMConsul's event endpoint is vulnerable to denial of serviceEPSS 0.4%CVE-2025-25032HIGHIBM Cognos Analytics denial of serviceEPSS 0.4%CVE-2020-37067HIGHFiletto 1.0 - 'FEAT' Denial of ServiceEPSS 0.4%CVE-2026-15144HIGH@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotationEPSS 0.4%CVE-2026-49870MEDIUMSnipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`EPSS 0.4%CVE-2020-10717LOWA potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs EPSS 0.4%CVE-2025-69229MEDIUMAIOHTTP vulnerable to DoS through chunked messagesEPSS 0.4%CVE-2024-6509MEDIUMMarinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which couEPSS 0.4%CVE-2026-41648MEDIUMIncus: Unbounded YAML Metadata Decode via ParsingEPSS 0.4%CVE-2025-36098MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%