Falhas do tipo CWE-770

1.845 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2023-36371—An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SEPSS 0.7%CVE-2023-36368—An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafEPSS 0.7%CVE-2023-36366—An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crEPSS 0.7%CVE-2023-36369—An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.7%CVE-2023-36370—An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQEPSS 0.7%CVE-2023-36367—An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SEPSS 0.7%CVE-2026-42561HIGHPython-Multipart: Denial of Service via unbounded multipart part headersEPSS 0.7%CVE-2023-36365—An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) viEPSS 0.7%CVE-2026-44577MEDIUMNext.js: Denial of Service in the Image Optimization APIEPSS 0.7%CVE-2024-52805HIGHSynapse allows unsupported content types to lead to memory exhaustionEPSS 0.7%CVE-2023-47746MEDIUMIBM Db2 denial of serviceEPSS 0.7%CVE-2023-27596HIGHOpenSIPS has vulnerability in the codec_delete_XX() functionsEPSS 0.7%CVE-2024-45797HIGHLibHTP's unbounded header handling leads to denial serviceEPSS 0.7%CVE-2022-1333LOWA specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of ServiceEPSS 0.7%CVE-2026-57212HIGHRabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_sizeEPSS 0.7%CVE-2026-25673HIGHPotential denial-of-service vulnerability in URLField via Unicode normalization on WindowsEPSS 0.7%CVE-2024-23820MEDIUMOpenFGA DoSEPSS 0.7%CVE-2023-4647MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.7%CVE-2023-28882HIGHTrustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs caEPSS 0.7%CVE-2026-14456HIGHUnbounded Memory Growth in QUIC Server Incoming Channel QueueEPSS 0.7%