Falhas do tipo CWE-770

1.846 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-56859HIGHAdd recursion depth guard during decode in encoding/xmlEPSS 0.6%CVE-2026-56853HIGHApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpEPSS 0.6%CVE-2026-56862HIGHLimit handshake messages we are willing to accept post-handshake in crypto/tlsEPSS 0.6%CVE-2024-38808MEDIUMCVE-2024-38808: Spring Expression DoS VulnerabilityEPSS 0.6%CVE-2026-70455HIGHrsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread ExhaustionEPSS 0.6%CVE-2026-2581MEDIUMundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoSEPSS 0.6%CVE-2024-10051HIGHUnauthenticated Denial of Service in shaunwei/realcharEPSS 0.6%CVE-2025-27419CRITICALDenial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLsEPSS 0.6%CVE-2026-50270HIGHdd-trace-java: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.6%CVE-2026-50277HIGHdd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoSEPSS 0.6%CVE-2026-54788HIGHdd-trace-rs: Unbounded W3C tracestate parsing may lead to DoSEPSS 0.6%CVE-2026-30946HIGHParse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL APIEPSS 0.6%CVE-2025-58181MEDIUMUnbounded memory consumption in golang.org/x/crypto/sshEPSS 0.6%CVE-2026-22917MEDIUMImproper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.EPSS 0.6%CVE-2026-33012HIGHMicronaut Framework vulnerable to a Denial of Service in HTML error response cachingEPSS 0.6%CVE-2026-49209MEDIUMSymfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requestsEPSS 0.6%CVE-2025-49007MEDIUMReDoS Vulnerability in Rack::Multipart handle_mime_headEPSS 0.6%CVE-2024-39944HIGHA vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, caEPSS 0.6%CVE-2025-62672MEDIUMrplay through 3.3.2 allows attackers to cause a denial of service (SIGSEGV and daemon crash) or possibly have unspecified other impact. ThisEPSS 0.6%CVE-2025-32380HIGHApollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment ProcessingEPSS 0.6%