Falhas do tipo CWE-770

1.861 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2023-3246MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2025-52568HIGHNeKernal Multiple Memory Corruption Vulnerabilities in mkfs.hefsEPSS 0.5%CVE-2021-47791MEDIUMSmartFTP Client 10.0.2909.0 - 'Multiple' Denial of ServiceEPSS 0.5%CVE-2026-75140HIGHjsoup Uncontrolled Resource Consumption in XmlTreeBuilderEPSS 0.5%CVE-2026-8469HIGHUnauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybookEPSS 0.5%CVE-2026-82728HIGHUnbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoSEPSS 0.5%CVE-2026-32689HIGHLong-poll NDJSON body splitting causes unbounded memory allocation in PhoenixEPSS 0.5%CVE-2026-77409HIGHRabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel BlockingEPSS 0.5%CVE-2026-56810HIGHmint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5EPSS 0.5%CVE-2026-55575HIGHLiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforceEPSS 0.5%CVE-2026-77528MEDIUMAutobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflationEPSS 0.5%CVE-2026-33592HIGHFindServers Memory Exhaustion in open62541EPSS 0.5%CVE-2026-48862HIGHUnbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrencyEPSS 0.5%CVE-2026-55205MEDIUMHermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow EndpointEPSS 0.5%CVE-2026-77403HIGHRabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size NegotiationEPSS 0.5%CVE-2025-24341MEDIUMA vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoEPSS 0.5%CVE-2026-57497MEDIUMwebtransport-go: Memory Exhaustion Attack due to Buffering of Unknown CapsulesEPSS 0.5%CVE-2026-53941MEDIUMInspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoSEPSS 0.5%CVE-2026-53653HIGHGrav: Unauthenticated denial of service via unbounded image derivative dimensionsEPSS 0.5%CVE-2026-27869MEDIUMWEB SERVICE (HTTP) DENIAL OF SERVICE VIA SLOW HEADERS ON REGESTA SMART HD-PLC OF TELDATEPSS 0.5%