Falhas do tipo CWE-770

1.845 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2024-32871HIGHPimcore Vulnerable to Flooding Server with Thumbnail filesEPSS 0.8%CVE-2023-34994LOWAn improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAEPSS 0.8%CVE-2020-15213MEDIUMDenial of service in tensorflow-liteEPSS 0.8%CVE-2026-50276HIGHdd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.8%CVE-2026-56811HIGHPhoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of serviceEPSS 0.8%CVE-2026-55407MEDIUMBuffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded AllocationEPSS 0.8%CVE-2026-47067HIGHAtom table exhaustion via unrecognized URL schemes in hackneyEPSS 0.8%CVE-2022-35221MEDIUMTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2EPSS 0.8%CVE-2024-9229HIGHDenial of Service (DoS) via Multipart Boundary in stangirard/quivrEPSS 0.8%CVE-2026-16756HIGHAllocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of serviceEPSS 0.8%CVE-2024-24752MEDIUMBref Uploaded Files Not Deleted in Event-Driven FunctionsEPSS 0.8%CVE-2026-15957HIGHUncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapesEPSS 0.8%CVE-2023-43768HIGHAn issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run ouEPSS 0.7%CVE-2024-41742HIGHIBM TXSeries for Multiplatforms denial of serviceEPSS 0.7%CVE-2026-44579HIGHNext.js: Denial of Service via connection exhaustion in applications using Cache ComponentsEPSS 0.7%CVE-2022-4019MEDIUMAuthenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost serverEPSS 0.7%CVE-2026-25535HIGHjsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF DimensionsEPSS 0.7%CVE-2026-42039MEDIUMAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataEPSS 0.7%CVE-2023-21144—In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This EPSS 0.7%CVE-2025-47287HIGHTornado vulnerable to excessive logging caused by malformed multipart form dataEPSS 0.7%