Fallos del tipo CWE-770

1851 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2026-50525HIGH.NET Denial of Service VulnerabilityEPSS 1.2%CVE-2026-45646HIGHOData for ASP.NET and ASP.NET Core Denial of Service VulnerabilityEPSS 1.2%CVE-2026-49787HIGHHTTP.sys Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50506HIGHOData for ASP.NET and ASP.NET Core Denial of Service VulnerabilityEPSS 1.2%CVE-2026-54113HIGHRemote Procedure Call Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50648HIGH.NET Framework Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50651HIGH.NET Denial of Service VulnerabilityEPSS 1.2%CVE-2026-56170HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.2%CVE-2024-38535HIGHSuricata http2: oom from duplicate headersEPSS 1.2%CVE-2024-32660HIGHFreeRDP zgfx_decompress out of memory vulnerabilityEPSS 1.2%CVE-2023-45129MEDIUMmatrix-synapse vulnerable to denial of service due to malicious server ACL eventsEPSS 1.2%CVE-2023-45290MEDIUMMemory exhaustion in multipart form parsing in net/textproto and net/httpEPSS 1.2%CVE-2024-23836HIGHcrafted traffic can cause denial of serviceEPSS 1.2%CVE-2023-48831HIGHA lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion.EPSS 1.2%CVE-2025-46727HIGHUnbounded-Parameter DoS in Rack::QueryParserEPSS 1.2%CVE-2026-60000LOWsshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attemptEPSS 1.2%CVE-2026-1526HIGHundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionEPSS 1.1%CVE-2023-42504MEDIUMApache Superset: Lack of rate limiting allows for possible denial of serviceEPSS 1.1%CVE-2025-58754HIGHAxios is vulnerable to DoS attack through lack of data size checkEPSS 1.1%CVE-2026-69374MEDIUMWindows SMB Server Denial of Service VulnerabilityEPSS 1.1%