Falhas do tipo CWE-770

2.228 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2024-41742HIGHIBM TXSeries for Multiplatforms denial of serviceEPSS 0.8%CVE-2021-46760CRITICALA malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory accesEPSS 0.8%CVE-2026-56811HIGHPhoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of serviceEPSS 0.8%CVE-2023-5289HIGHAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.8%CVE-2026-66257HIGHApache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-67588HIGHApache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-68074HIGHApache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-67465HIGHApache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2024-4539MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2024-32874MEDIUMIn Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of ServiceEPSS 0.8%CVE-2026-68060HIGHApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.8%CVE-2026-42039MEDIUMAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataEPSS 0.8%CVE-2026-25949HIGHTraefik: TCP readTimeout bypass via STARTTLS on PostgresEPSS 0.8%CVE-2023-38706MEDIUMDiscourse vulnerable to DoS via draftsEPSS 0.8%CVE-2022-31118MEDIUMMissing brute force protection on cloud federation sharing in Nextcloud ServerEPSS 0.8%CVE-2026-73108HIGHRustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodecEPSS 0.8%CVE-2024-3302LOWThere was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of MemoryEPSS 0.8%CVE-2024-32871HIGHPimcore Vulnerable to Flooding Server with Thumbnail filesEPSS 0.8%CVE-2026-123336LOWIn JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversionEPSS 0.8%CVE-2026-112779CRITICALGrav API Plugin before 1.0.42 Cache Exhaustion and Page Permission BypassEPSS 0.8%