Fallos del tipo CWE-770
1864 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2024-4782MEDIUMA denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to dEPSS 0.3%CVE-2025-64422MEDIUMRate-limit bypass on login via X-Forwarded-Host headerEPSS 0.3%CVE-2023-29767MEDIUMAn issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files.EPSS 0.3%CVE-2023-29573MEDIUMBento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.EPSS 0.3%CVE-2026-54247MEDIUMSkipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoSEPSS 0.3%CVE-2024-46921MEDIUMAn issue was discovered in Samsung Mobile Processor and Modem Exynos 9820, 9825, 980, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9EPSS 0.3%CVE-2024-53647MEDIUMTrend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email veEPSS 0.3%CVE-2026-25043MEDIUMBudibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email FloodingEPSS 0.3%CVE-2026-20482MEDIUMIn wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote (proximal/adjacent) denial of serEPSS 0.3%CVE-2026-65827MEDIUMDocmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of serviceEPSS 0.3%CVE-2023-30406MEDIUMJerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpeEPSS 0.3%CVE-2025-68136HIGHEVerest's inadequate session handling can lead to memory-related errors or exhaustion of the operating system’s file descriptors, resulting in a denial of serviceEPSS 0.3%CVE-2023-30408MEDIUMJerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.EPSS 0.3%CVE-2026-55254MEDIUMNCalc: Denial of Service via Unbounded and Non-Terminating Factorial EvaluationEPSS 0.3%CVE-2025-69199HIGHPterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstancesEPSS 0.3%CVE-2022-51008MEDIUMPocketMine-MP before 4.12.3 Denial of Service via Unauthenticated SessionsEPSS 0.3%CVE-2026-61465MEDIUMImageMagick before 7.1.2-26 Memory Allocation Policy BypassEPSS 0.3%CVE-2026-10740MEDIUMExcessive memory allocation in s2n-quicEPSS 0.3%CVE-2026-13069HIGHQueryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource ExhaustionEPSS 0.3%CVE-2026-92077MEDIUMDenial-of-service in the SVG componentEPSS 0.3%