Falhas do tipo CWE-770

2.228 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-47628HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. AEPSS 0.7%CVE-2026-40192HIGHPillow is vulnerable to a FITS GZIP decompression bombEPSS 0.7%CVE-2026-86040HIGHlibp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoSEPSS 0.7%CVE-2026-44488HIGHAxios: Allocation of Resources Without Limits or Throttling in axiosEPSS 0.7%CVE-2024-35231HIGHrack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameterEPSS 0.7%CVE-2023-51339MEDIUMA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Event Ticketing System v1.0 allows attackers to send an excessive amoEPSS 0.7%CVE-2026-55831HIGHNetty SPDY SETTINGS frame count materializes unbounded settings mapEPSS 0.7%CVE-2023-34389MEDIUMAllocation of resources without limits could lead to denial of serviceEPSS 0.7%CVE-2026-118487HIGHHeap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParserEPSS 0.7%CVE-2025-0315HIGHAllocation of Resources Without Limits or Throttling in ollama/ollamaEPSS 0.7%CVE-2026-78667HIGHLack of limit on size of parsed Range headers in net/httpEPSS 0.7%CVE-2023-22323HIGHBIG-IP SSL OCSP Authentication profile vulnerabilityEPSS 0.7%CVE-2023-22403HIGHJunos OS: QFX10K Series: An ICCP flap will be observed due to excessive specific trafficEPSS 0.7%CVE-2025-54121MEDIUMStarlette has possible denial-of-service vector when parsing large files in multipart formsEPSS 0.7%CVE-2026-82753HIGHUnauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_serverEPSS 0.7%CVE-2026-86696HIGHUnbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustionEPSS 0.7%CVE-2026-111751HIGHAngular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)EPSS 0.7%CVE-2026-85664HIGHChroma 1.5.9 Unbounded HNSW Index Parameters Memory ExhaustionEPSS 0.7%CVE-2023-41038HIGHServer crash when using specific form of SET BIND statementEPSS 0.7%CVE-2024-29902MEDIUMCosign vulnerable to system-wide denial of service via malicious attachmentsEPSS 0.7%