Falhas do tipo CWE-770

1.846 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2024-0081HIGH NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources withouEPSS 0.6%CVE-2024-11316HIGHFilesize CheckEPSS 0.6%CVE-2026-32280HIGHUnexpected work during chain building in crypto/x509EPSS 0.6%CVE-2023-41042MEDIUMDiscourse DoS via remote theme assetsEPSS 0.6%CVE-2026-42793HIGHAtom table exhaustion via attacker-controlled GraphQL SDL names in absintheEPSS 0.6%CVE-2025-29786HIGHMemory Exhaustion in Expr Parser with Unrestricted InputEPSS 0.6%CVE-2024-30249HIGHCloudburst Network DoS in RakNet connection handlingEPSS 0.6%CVE-2026-49146HIGHApp::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrcEPSS 0.6%CVE-2026-25800HIGHquinn-proto has remote memory exhaustion from unbounded out-of-order stream reassemblyEPSS 0.6%CVE-2026-11586HIGHWS Auto-PONG memory exhaustionEPSS 0.6%CVE-2026-82399HIGHCoreDNS: Unauthenticated memory exhaustion in custom transportsEPSS 0.6%CVE-2023-33720MEDIUMmp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty.EPSS 0.6%CVE-2026-55968HIGHApache Thrift: Node.js quadratic-time DoS in server receive transportsEPSS 0.6%CVE-2026-42294HIGHArgo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook InterceptorEPSS 0.6%CVE-2026-58389HIGHApache Thrift: Rust binary protocol non-strict path missing string size limitEPSS 0.6%CVE-2026-54063HIGHExcelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)EPSS 0.6%CVE-2021-47865HIGHProFTPD 1.3.7a - Remote Denial of ServiceEPSS 0.6%CVE-2026-33256MEDIUMUnbounded memory allocation by internal web serverEPSS 0.6%CVE-2026-46340HIGHNetty: SCTP reassembly nests buffers without boundEPSS 0.6%CVE-2026-33483HIGHAVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.phpEPSS 0.6%