Falhas do tipo CWE-770

2.228 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2022-4045LOWAuthenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost serverEPSS 0.6%CVE-2024-13054MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.6%CVE-2026-42786HIGHWebSocket fragmented message reassembly unbounded in banditEPSS 0.6%CVE-2026-69152HIGHbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationEPSS 0.6%CVE-2024-52915HIGHBitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.EPSS 0.6%CVE-2026-103042HIGHLightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_valueEPSS 0.6%CVE-2023-5573MEDIUMAllocation of Resources Without Limits or Throttling in vriteio/vriteEPSS 0.6%CVE-2024-43709MEDIUMElasticsearch allocation of resources without limits or throttling leads to crashEPSS 0.6%CVE-2025-0189HIGHDenial of Service in aimhubio/aimEPSS 0.6%CVE-2026-49476HIGHSoup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieveEPSS 0.6%CVE-2024-26577HIGHVSeeFace through 1.13.38.c2 allows attackers to cause a denial of service (application hang) via a spoofed UDP packet containing at least 10EPSS 0.6%CVE-2026-87011HIGHOpen WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutEPSS 0.6%CVE-2026-94613HIGHauthentik: Denial of Service via Document Type Declarations in SAML MessagesEPSS 0.6%CVE-2026-14257HIGHbrace-expansion DoS via unbounded expansion length causing an out-of-memory process crashEPSS 0.6%CVE-2026-39803HIGHHTTP/1 chunked body reader ignores length cap in banditEPSS 0.6%CVE-2026-70464HIGHrsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake StallEPSS 0.6%CVE-2023-23603MEDIUMCalls to console.log allowed bypassing Content Security Policy via format directiveEPSS 0.6%CVE-2026-64868HIGHNew API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body loggingEPSS 0.6%CVE-2025-1451HIGHInsufficient Patch Leading to DoS in parisneo/lollms-webuiEPSS 0.6%CVE-2024-47502HIGHJunos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoSEPSS 0.6%