Falhas do tipo CWE-770

1.861 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2024-55195HIGHAn allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the prograEPSS 0.5%CVE-2025-8885MEDIUMPossible DOS in processing specially formed ASN.1 Object IdentifiersEPSS 0.5%CVE-2026-48824MEDIUMMailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)EPSS 0.5%CVE-2026-82562MEDIUMqs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)EPSS 0.5%CVE-2024-6598HIGHDenial-of-service on KNIME Business Hub when certain jobs are executedEPSS 0.5%CVE-2026-54274MEDIUMAIOHTTP: Incomplete websocket frame payloads bypass memory limitsEPSS 0.5%CVE-2026-41899MEDIUMCoolify unauthenticated feedback endpoint allows Discord webhook abuseEPSS 0.5%CVE-2026-47683HIGHvm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLikeEPSS 0.5%CVE-2023-40542HIGHBIG-IP TCP Profile vulnerabilityEPSS 0.5%CVE-2025-20209HIGHCisco IOS XR Software Internet Key Exchange Version 2 Denial of Service VulnerabilityEPSS 0.5%CVE-2025-21495MEDIUMVulnerability in the MySQL Enterprise Firewall product of Oracle MySQL (component: Firewall). Supported versions that are affected are 8.0.EPSS 0.5%CVE-2019-3882MEDIUMA flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device iEPSS 0.5%CVE-2026-18401MEDIUMjackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of serviceEPSS 0.5%CVE-2025-1072MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2025-54879MEDIUMMastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emailsEPSS 0.5%CVE-2025-58446MEDIUMxgrammar vulnerable to denial of service by huge enum grammarEPSS 0.5%CVE-2025-32034HIGHApollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment ExpansionEPSS 0.5%CVE-2024-11171HIGHImproper Input Validation in danny-avila/librechatEPSS 0.5%CVE-2026-11897HIGHIBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2EPSS 0.5%CVE-2023-6386MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%