Falhas do tipo CWE-770

2.228 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2024-25026MEDIUMIBM WebSphere Application Server denial of serviceEPSS 0.8%CVE-2026-40984HIGHMicrometer HTTP server instrumentations DoS vulnerabilityEPSS 0.8%CVE-2023-6337HIGHVault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP RequestsEPSS 0.8%CVE-2026-54332MEDIUMGoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoSEPSS 0.8%CVE-2022-35221MEDIUMTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2EPSS 0.8%CVE-2026-54345MEDIUMGoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)EPSS 0.8%CVE-2022-4019MEDIUMAuthenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost serverEPSS 0.8%CVE-2023-0382MEDIUMUncontrolled Resource Consumption in M-Files ServerEPSS 0.8%CVE-2026-12151HIGHundici WebSocket client vulnerable to denial of service via fragment count bypassEPSS 0.8%CVE-2024-7768HIGHDenial of Service in h2oai/h2o-3EPSS 0.8%CVE-2026-3505HIGHUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.EPSS 0.8%CVE-2025-5996MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-27880HIGHOpenFeature evaluation API reads input data with no boundsEPSS 0.8%CVE-2026-48853CRITICALRemote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcEPSS 0.8%CVE-2023-4011MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2026-67432HIGHMCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportEPSS 0.8%CVE-2026-54156HIGHnode-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoSEPSS 0.8%CVE-2026-85447HIGHMOOS-IvP through 24.8.1 pRealm Unbounded REALMCAST_REQ Subscription Denial of ServiceEPSS 0.8%CVE-2026-85448HIGHMOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State RetentionEPSS 0.8%CVE-2024-45412MEDIUMYeti affected by a Potential Denial of Service due to the One Milion Unicode characters attackEPSS 0.8%