Fallos del tipo CWE-770

2213 resultados

Alocação sem limite de recursos

A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.

Ejemplo

Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.

Cómo mitigar

Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.

CVE-2026-83645HIGHActive Directory Federation Services (AD FS) Denial of Service VulnerabilityEPSS 1.2%CVE-2021-34568HIGHWAGO I/O-Check Service prone to Allocation of Resources Without Limits or ThrottlingEPSS 1.2%CVE-2023-43642HIGHMissing upper bound check on chunk length in snappy-java EPSS 1.2%CVE-2022-34357MEDIUMIBM Cognos Analytics Mobile Server denial of serviceEPSS 1.2%CVE-2025-58754HIGHAxios is vulnerable to DoS attack through lack of data size checkEPSS 1.2%CVE-2025-47950HIGHCoreDNS Vulnerable to DoQ Memory Exhaustion via Stream AmplificationEPSS 1.2%CVE-2024-23837HIGHLibHTP unbounded folded header handling leads to denial serviceEPSS 1.2%CVE-2025-48367HIGHRedis DoS Vulnerability due to bad connection error handlingEPSS 1.2%CVE-2018-10908MEDIUMIt was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafEPSS 1.2%CVE-2023-38492MEDIUMKirby vulnerable to denial of service from unlimited password lengthsEPSS 1.2%CVE-2026-50651HIGH.NET Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50525HIGH.NET Denial of Service VulnerabilityEPSS 1.2%CVE-2026-45646HIGHOData for ASP.NET and ASP.NET Core Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50506HIGHOData for ASP.NET and ASP.NET Core Denial of Service VulnerabilityEPSS 1.2%CVE-2026-49787HIGHHTTP.sys Denial of Service VulnerabilityEPSS 1.2%CVE-2026-56170HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.2%CVE-2026-47302HIGH.NET Denial of Service VulnerabilityEPSS 1.2%CVE-2026-57099HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50648HIGH.NET Framework Denial of Service VulnerabilityEPSS 1.2%CVE-2026-49788HIGHHTTP/2 Denial of Service VulnerabilityEPSS 1.2%