Falhas do tipo CWE-770

1.846 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-39414HIGHMinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV ParsingEPSS 0.5%CVE-2026-67588HIGHApache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.5%CVE-2026-45768HIGHSuricata ldap: unbounded responses per transaction can lead to resource exhaustionEPSS 0.5%CVE-2023-5963LOWAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2025-53411LOWFile Station 5EPSS 0.5%CVE-2026-25579CRITICALNavidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpointsEPSS 0.5%CVE-2026-68060HIGHApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.5%CVE-2025-68151MEDIUMCoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messagesEPSS 0.5%CVE-2026-43973HIGHgun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustionEPSS 0.5%CVE-2025-41694MEDIUMAuthenticated Denial-of-Service via WebshellEPSS 0.5%CVE-2024-7734MEDIUMPhoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors.EPSS 0.5%CVE-2026-42189HIGHRussh: Pre-auth DoS via unbounded allocation in keyboard-interactive authEPSS 0.5%CVE-2021-47713HIGHHasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL QueryEPSS 0.5%CVE-2026-22036MEDIUMUndici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionEPSS 0.5%CVE-2022-3273LOWAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.5%CVE-2026-63075HIGHQUIC ACK-only Packet Retention Can Cause Memory ExhaustionEPSS 0.5%CVE-2024-4311MEDIUMLack of login attempt rate-limiting in zenml-io/zenmlEPSS 0.5%CVE-2026-67592HIGHApache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming deliveryEPSS 0.5%CVE-2026-93491HIGHIo.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queueEPSS 0.5%CVE-2026-0531MEDIUMAllocation of Resources Without Limits or Throttling in Kibana FleetEPSS 0.5%