Falhas do tipo CWE-770

2.228 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-49835MEDIUMSigstore Timestamp Authority: OOM due to unbounded metric label cardinalityEPSS 0.7%CVE-2020-36946HIGHSyncBreeze 10.0.28 - 'login' Denial of ServiceEPSS 0.7%CVE-2026-71321HIGHNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationEPSS 0.7%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.7%CVE-2023-21144—In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This EPSS 0.7%CVE-2023-36369—An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.7%CVE-2023-36368—An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafEPSS 0.7%CVE-2023-36366—An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crEPSS 0.7%CVE-2023-36370—An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQEPSS 0.7%CVE-2026-91866HIGHApache Neethi: Crafted policies cause unbounded work during intersection leading to denial of serviceEPSS 0.7%CVE-2026-91865HIGHApache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceEPSS 0.7%CVE-2023-36365—An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) viEPSS 0.7%CVE-2026-71257HIGHApache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsedEPSS 0.7%CVE-2023-36367—An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SEPSS 0.7%CVE-2026-91864HIGHApache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionEPSS 0.7%CVE-2023-36371—An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SEPSS 0.7%CVE-2026-67592HIGHApache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming deliveryEPSS 0.7%CVE-2026-42561HIGHPython-Multipart: Denial of Service via unbounded multipart part headersEPSS 0.7%CVE-2026-44577MEDIUMNext.js: Denial of Service in the Image Optimization APIEPSS 0.7%CVE-2024-52805HIGHSynapse allows unsupported content types to lead to memory exhaustionEPSS 0.7%