Fallos del tipo CWE-770
1864 resultadosAlocação sem limite de recursos
A aplicação aloca recursos (memória, conexões, arquivos, threads) em nome do usuário sem impor limites, permitindo que um atacante esgote os recursos do sistema. O risco é negação de serviço: a aplicação ou servidor inteiro pode travar quando os recursos acabam.
Ejemplo
Um servidor web aceita requisições sem limitar quantas conexões simultâneas um único usuário pode abrir, ou um upload sem verificar tamanho máximo. Um atacante abre milhões de conexões ou envia arquivos gigantes até a memória/disco encher.
Cómo mitigar
Implemente quotas e limites por usuário/origem (rate limiting, máximo de conexões simultâneas, tamanho máximo de upload). Monitore consumo de recursos e recuse requisições que violem os limites com erro 429 ou similar.
CVE-2022-22491MEDIUMIBM App Connect Enterprise Certified Container denial of serviceEPSS 0.2%CVE-2024-47969MEDIUMImproper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service.EPSS 0.2%CVE-2026-24271MEDIUMNVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resourcEPSS 0.2%CVE-2025-57798MEDIUMJoplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title InputEPSS 0.2%CVE-2024-41175MEDIUMBeckhoff: Local Denial-of-Service vulnerability in TwinCAT/BSD and the IPC-Diagnostics packageEPSS 0.2%CVE-2026-3686MEDIUMVulnerabilities exists in IBM Cloud Pak for Data SystemEPSS 0.2%CVE-2026-35480MEDIUMgo-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headersEPSS 0.2%CVE-2026-64847MEDIUMAnyIO process-pool workers can block indefinitely on undrained stderrEPSS 0.2%CVE-2024-29086LOWArkcompiler runtime has a stack overflow svulnerabilityEPSS 0.2%CVE-2026-40608MEDIUMNext AI Draw.io: Unbounded HTTP Body — Denial of ServiceEPSS 0.2%CVE-2024-47967MEDIUMImproper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of serEPSS 0.2%CVE-2021-26381HIGHImproper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a larEPSS 0.2%CVE-2025-36123MEDIUMIBM Db2 Denial of ServiceEPSS 0.2%CVE-2026-42546LOWOP-TEE has missing OPTEE_MSG_ATTR_TYPE_MASK in cleanup_shm_refs() leaks mobj referencesEPSS 0.2%CVE-2026-4897MEDIUMPolkit: polkit: denial of service via unbounded input processing through standard inputEPSS 0.2%CVE-2026-86892MEDIUMThis issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOSEPSS 0.1%CVE-2026-34165MEDIUMgo-git: Maliciously crafted idx file can cause asymmetric memory consumptionEPSS 0.1%CVE-2026-31890MEDIUMInspektor Gadget: Tracing Denial of Service via Event FloodingEPSS 0.1%CVE-2026-42444LOWNanaZip: Unbounded resource consumption in NanaZip littlefs parser via attacker-controlled BlockCountEPSS 0.1%CVE-2026-75808MEDIUMAllocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition througEPSS 0.1%