Falhas do tipo CWE-770

2.228 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-54135HIGHAirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP ServerEPSS 0.8%CVE-2023-34994LOWAn improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAEPSS 0.8%CVE-2026-23490HIGHpyasn1 has a DoS vulnerability in decoderEPSS 0.8%CVE-2020-15213MEDIUMDenial of service in tensorflow-liteEPSS 0.8%CVE-2026-87742HIGHQuarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message bufferingEPSS 0.8%CVE-2026-39804HIGHWebSocket permessage-deflate inflate has no output-size cap in banditEPSS 0.8%CVE-2024-9229HIGHDenial of Service (DoS) via Multipart Boundary in stangirard/quivrEPSS 0.8%CVE-2026-54297HIGHFaraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parametersEPSS 0.8%CVE-2026-55407MEDIUMBuffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded AllocationEPSS 0.8%CVE-2026-47067HIGHAtom table exhaustion via unrecognized URL schemes in hackneyEPSS 0.8%CVE-2026-16756HIGHAllocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of serviceEPSS 0.8%CVE-2026-28342HIGHOliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API EndpointEPSS 0.8%CVE-2024-24752MEDIUMBref Uploaded Files Not Deleted in Event-Driven FunctionsEPSS 0.8%CVE-2026-74878CRITICALopenssl_encrypt before 1.4.0 TOTP Rate Limiter BypassEPSS 0.7%CVE-2023-43768HIGHAn issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run ouEPSS 0.7%CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.7%CVE-2022-22211HIGHJunos OS Evolved: PTX Series: Multiple FPCs become unreachable due to continuous polling of specific SNMP OIDEPSS 0.7%CVE-2026-44579HIGHNext.js: Denial of Service via connection exhaustion in applications using Cache ComponentsEPSS 0.7%CVE-2026-15711HIGHLibsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violationEPSS 0.7%CVE-2025-47287HIGHTornado vulnerable to excessive logging caused by malformed multipart form dataEPSS 0.7%