Falhas do tipo CWE-770

2.228 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2023-52428HIGHIn Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header valEPSS 0.8%CVE-2026-42154HIGHPrometheus: remote read endpoint allows denial of service via crafted snappy payloadEPSS 0.8%CVE-2024-8966HIGHDenial of Service in gradio-app/gradioEPSS 0.8%CVE-2022-50695HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network CommandsEPSS 0.8%CVE-2026-27858HIGHAttacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. AttackeEPSS 0.8%CVE-2024-56332MEDIUMNext.js Vulnerable to Denial of Service (DoS) with Server ActionsEPSS 0.8%CVE-2026-33034HIGHPotential denial-of-service vulnerability in ASGI requests via memory upload limit bypassEPSS 0.8%CVE-2023-36357—An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackersEPSS 0.8%CVE-2023-23846HIGHDue to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headersEPSS 0.8%CVE-2024-12778HIGHDenial of Service in aimhubio/aimEPSS 0.8%CVE-2024-52581HIGHLitestar allows unbounded resource consumption (DoS vulnerability)EPSS 0.8%CVE-2026-50274HIGHdd-trace-go: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50273HIGHDatadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50270HIGHdd-trace-java: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-54788HIGHdd-trace-rs: Unbounded W3C tracestate parsing may lead to DoSEPSS 0.8%CVE-2026-60108HIGHZeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP AnalyzerEPSS 0.8%CVE-2026-50271HIGHdd-trace-py: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50272HIGHdd-trace: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50277HIGHdd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-50276HIGHdd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%