Falhas do tipo CWE-770

1.861 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-26998MEDIUMTraefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)EPSS 0.6%CVE-2023-40710MEDIUMAn adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller hEPSS 0.6%CVE-2026-79921HIGHamqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized PayloadEPSS 0.5%CVE-2026-81636HIGHQuery-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of serviceEPSS 0.5%CVE-2026-17163HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2026-23962HIGHMastodon vulnerable to Denial of Service from a single post (client/server)EPSS 0.5%CVE-2026-17199HIGHIBM i is Affected By Multiple Vulnerabilities in Host ServersEPSS 0.5%CVE-2026-13698MEDIUMA memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valiEPSS 0.5%CVE-2025-41770HIGHUnauthenticated Denial of ServiceEPSS 0.5%CVE-2026-16308HIGHIBM Enterprise Build of Quarkus is affected by a DoS vulnerabilityEPSS 0.5%CVE-2026-17170HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2026-59279HIGHUnbounded persistent session allocation via repeated initialize requestsEPSS 0.5%CVE-2026-15972HIGHUnauthenticated denial of service via unbounded external gRPC connection acceptanceEPSS 0.5%CVE-2026-17271HIGHIBM i is Affected By Multiple Vulnerabilities in the Debug ServerEPSS 0.5%CVE-2026-12733HIGHIBM DataPower Gateway affected by denial of serviceEPSS 0.5%CVE-2026-69147MEDIUMvLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservationEPSS 0.5%CVE-2026-42420MEDIUMOpenClaw < 2026.4.8 - Improper Base64 Decoding Size ValidationEPSS 0.5%CVE-2026-22025MEDIUMCryptoLib Memory Leak on HTTP Error Response in KMC ClientEPSS 0.5%CVE-2026-72888MEDIUMNet::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_requireEPSS 0.5%CVE-2026-53585MEDIUMlibgit2: Unbounded Memory Allocation via Delta Object Result-Size HeaderEPSS 0.5%