Falhas do tipo CWE-770

1.846 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-57173MEDIUMvLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completionsEPSS 0.7%CVE-2026-35469HIGHSpdyStream: DOS on CRIEPSS 0.7%CVE-2024-47874HIGHStarlette Denial of service (DoS) via multipart/form-dataEPSS 0.7%CVE-2023-20033HIGHA vulnerability in Cisco IOS XE Software for Cisco Catalyst 3650 and Catalyst 3850 Series Switches could allow an unauthenticated, remote atEPSS 0.7%CVE-2023-5289HIGHAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.7%CVE-2023-28107MEDIUMDiscourse vulnerable to multisite DoS by spamming backupsEPSS 0.7%CVE-2025-0315HIGHAllocation of Resources Without Limits or Throttling in ollama/ollamaEPSS 0.7%CVE-2024-52915HIGHBitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.EPSS 0.6%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.6%CVE-2026-28342HIGHOliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API EndpointEPSS 0.6%CVE-2023-22403HIGHJunos OS: QFX10K Series: An ICCP flap will be observed due to excessive specific trafficEPSS 0.6%CVE-2024-26577HIGHVSeeFace through 1.13.38.c2 allows attackers to cause a denial of service (application hang) via a spoofed UDP packet containing at least 10EPSS 0.6%CVE-2025-67221HIGHThe orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.EPSS 0.6%CVE-2026-14257HIGHbrace-expansion DoS via unbounded expansion length causing an out-of-memory process crashEPSS 0.6%CVE-2026-39803HIGHHTTP/1 chunked body reader ignores length cap in banditEPSS 0.6%CVE-2023-23603MEDIUMCalls to console.log allowed bypassing Content Security Policy via format directiveEPSS 0.6%CVE-2024-53981HIGHpython-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundaryEPSS 0.6%CVE-2024-47502HIGHJunos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoSEPSS 0.6%CVE-2025-61920HIGHAuthlib is vulnerable to Denial of Service via Oversized JOSE SegmentsEPSS 0.6%CVE-2026-21728HIGHTempo query limit results in unbounded memory allocationEPSS 0.6%