Fallos del tipo CWE-770
1851 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2022-3298MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 1.1%CVE-2022-3295MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 1.1%CVE-2024-4140HIGHAn excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipartEPSS 1.1%CVE-2021-3637—A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessiEPSS 1.1%CVE-2024-26461HIGHKerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.EPSS 1.1%CVE-2023-27653HIGHAn issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a denial of service via the SharedPreference files.EPSS 1.1%CVE-2023-27191HIGHAn issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.EPSS 1.1%CVE-2023-4046—In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilationEPSS 1.1%CVE-2021-46877HIGHjackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient EPSS 1.1%CVE-2023-26964HIGHAn issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a resuEPSS 1.1%CVE-2022-4044MEDIUMAuthenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost serverEPSS 1.1%CVE-2025-21521HIGHVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0EPSS 1.1%CVE-2021-0261HIGHJunos OS: Denial of Service vulnerability in J-Web and web based (HTTP/HTTPS) services caused by a high number of specific requestsEPSS 1.1%CVE-2024-22189HIGHQUIC's Connection ID Mechanism vulnerable to Memory Exhaustion AttackEPSS 1.1%CVE-2024-37298HIGHPotential memory exhaustion attack due to sparse slice deserializationEPSS 1.1%CVE-2022-3371HIGHNo limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffwebEPSS 1.1%CVE-2026-25673HIGHPotential denial-of-service vulnerability in URLField via Unicode normalization on WindowsEPSS 1.1%CVE-2025-55163HIGHNetty MadeYouReset HTTP/2 DDoS VulnerabilityEPSS 1.1%CVE-2026-5680HIGHUndertow-core: undertow: denial of service via websocket permessage-deflate processingEPSS 1.1%CVE-2024-41128MEDIUMAction Dispatch has possible ReDoS vulnerability in query parameter filteringEPSS 1.1%