Falhas do tipo CWE-770

1.855 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-44004HIGHvm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)EPSS 0.7%CVE-2026-34148HIGHFedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolutionEPSS 0.7%CVE-2023-34389MEDIUMAllocation of resources without limits could lead to denial of serviceEPSS 0.7%CVE-2026-68956HIGHSSH daemon allocates unbounded idle session channels, bypassing max_channelsEPSS 0.7%CVE-2023-22323HIGHBIG-IP SSL OCSP Authentication profile vulnerabilityEPSS 0.7%CVE-2026-27572MEDIUMWasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instanceEPSS 0.7%CVE-2026-41309HIGHOpen Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image ProcessingEPSS 0.7%CVE-2026-25985HIGHMemory allocation with excessive without limits in the internal SVG decoderEPSS 0.7%CVE-2022-45434MEDIUMSome Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the fiEPSS 0.7%CVE-2026-82753HIGHUnauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_serverEPSS 0.7%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.7%CVE-2024-29902MEDIUMCosign vulnerable to system-wide denial of service via malicious attachmentsEPSS 0.7%CVE-2026-85664HIGHChroma 1.5.9 Unbounded HNSW Index Parameters Memory ExhaustionEPSS 0.7%CVE-2023-41038HIGHServer crash when using specific form of SET BIND statementEPSS 0.7%CVE-2026-91080HIGHwebhook through 2.8.3 Memory Exhaustion via Oversized Request BodyEPSS 0.7%CVE-2026-34827HIGHRack: Algorithmic-Complexity DoS in Rack::Multipart::ParserEPSS 0.7%CVE-2026-27204MEDIUMWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustionEPSS 0.7%CVE-2026-34829HIGHRack: Denial of Service via Unbounded Multipart File Upload Without Content-LengthEPSS 0.7%CVE-2026-7541MEDIUMDenial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpointEPSS 0.7%CVE-2026-59161HIGHExcelize: Streaming GetRows row-bound bypass causes attacker-controlled allocationEPSS 0.7%