Fallos del tipo CWE-770
1864 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2025-48462MEDIUMLogin Session ExhaustionEPSS 0.2%CVE-2025-37805MEDIUMsound/virtio: Fix cancel_sync warnings on uninitialized work_structsEPSS 0.2%CVE-2020-37139MEDIUMOdin Secure FTP Expert 7.6.3 - 'Site Info' Denial of ServiceEPSS 0.2%CVE-2026-43329HIGHnetfilter: flowtable: strictly check for maximum number of actionsEPSS 0.2%CVE-2026-22780MEDIUMRizin has a heap overflow on mach0_chained_fixups.cEPSS 0.2%CVE-2026-8124MEDIUMGPAC box_code_base.c sidx_box_read allocation of resourcesEPSS 0.2%CVE-2026-18170MEDIUMIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-53937MEDIUMMCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)EPSS 0.2%CVE-2026-48496MEDIUMopentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agentEPSS 0.2%CVE-2026-63119MEDIUMMCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)EPSS 0.2%CVE-2026-27026MEDIUMpypdf possibly has long runtimes for malformed FlateDecode streamsEPSS 0.2%CVE-2025-32425MEDIUMAutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoSEPSS 0.2%CVE-2026-48735MEDIUMpypdf: Manipulated XMP metadata streams can exhaust RAMEPSS 0.2%CVE-2023-22397MEDIUMJunos OS Evolved: PTX10003: An attacker sending specific genuine packets will cause a memory leak in the PFE leading to a Denial of ServiceEPSS 0.2%CVE-2025-32024MEDIUMbep/imagemeta allows excessively large EXIF data structuresEPSS 0.2%CVE-2026-54389MEDIUMGhidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdbEPSS 0.2%CVE-2025-32025MEDIUMbep/imagemeta allows a potentially large memory allocation in PNG and WebP parsingEPSS 0.2%CVE-2024-38335MEDIUMIBM Security QRadar Network Threat Analytics denial of serviceEPSS 0.2%CVE-2026-53426HIGHAtom-table exhaustion denial-of-service via JSON parse_document in MDExEPSS 0.2%CVE-2026-53423MEDIUMUnauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_pluginEPSS 0.2%