Falhas do tipo CWE-770

2.228 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2024-52805HIGHSynapse allows unsupported content types to lead to memory exhaustionEPSS 0.7%CVE-2026-44577MEDIUMNext.js: Denial of Service in the Image Optimization APIEPSS 0.7%CVE-2023-47746MEDIUMIBM Db2 denial of serviceEPSS 0.7%CVE-2023-27596HIGHOpenSIPS has vulnerability in the codec_delete_XX() functionsEPSS 0.7%CVE-2026-71469HIGHAcm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dosEPSS 0.7%CVE-2022-1333LOWA specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of ServiceEPSS 0.7%CVE-2024-45797HIGHLibHTP's unbounded header handling leads to denial serviceEPSS 0.7%CVE-2025-6203HIGHVault unauthenticated denial of service through complex json payloadEPSS 0.7%CVE-2024-23820MEDIUMOpenFGA DoSEPSS 0.7%CVE-2023-4647MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.7%CVE-2026-54225HIGHApache CXF: Denial of Service attack via large attachmentsEPSS 0.7%CVE-2025-8537MEDIUMAxiomatic Bento4 mp4decrypt Mp4Decrypt.cpp SetDataSize allocation of resourcesEPSS 0.7%CVE-2025-66418HIGHurllib3 allows an unbounded number of links in the decompression chainEPSS 0.7%CVE-2023-28882HIGHTrustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs caEPSS 0.7%CVE-2026-57173MEDIUMvLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completionsEPSS 0.7%CVE-2026-14456HIGHUnbounded Memory Growth in QUIC Server Incoming Channel QueueEPSS 0.7%CVE-2026-44891HIGHNetty: Denial of Service via Unbounded Headers in StompSubframeDecoderEPSS 0.7%CVE-2024-10650HIGHDenial of Service (DoS) in gaizhenbiao/chuanhuchatgptEPSS 0.7%CVE-2024-9056HIGHDenial of Service in bentoml/bentomlEPSS 0.7%CVE-2026-90584MEDIUMTooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resourcesEPSS 0.7%