Falhas do tipo CWE-770

1.861 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2024-8028HIGHDenial of Service in danswer-ai/danswerEPSS 0.5%CVE-2026-42256MEDIUMnet-imap: Denial of service via high iteration count for `SCRAM-*` authenticationEPSS 0.5%CVE-2026-25224LOWFastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStreamEPSS 0.5%CVE-2026-84447HIGHlibheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoSEPSS 0.5%CVE-2026-19873HIGHHTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elementsEPSS 0.5%CVE-2026-59251HIGHDenial of service via exponential certificate policy tree growth in path validationEPSS 0.5%CVE-2026-88012MEDIUMTraefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unboundedEPSS 0.5%CVE-2024-21771HIGHF5 AFM Signature Matching VulnerabilityEPSS 0.5%CVE-2026-33241HIGHSalvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data ParsingEPSS 0.5%CVE-2025-41693MEDIUMAuthenticated Denial-of-Service via SSHEPSS 0.5%CVE-2024-34046HIGHThe O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->sctpParams->e2tCounters[IN_SUEPSS 0.5%CVE-2023-51393MEDIUMPotential DoS due to BusFault and Assert in Ember ZNet legacy packet bufferEPSS 0.5%CVE-2026-30827HIGHexpress-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting (all IPv4 clients share one bucket on dual-stack servers)EPSS 0.5%CVE-2023-3967MEDIUMDoS Vulnerability in Hitachi Ops Center Common ServicesEPSS 0.5%CVE-2023-44191HIGHJunos OS: QFX5000 Series and EX4000 Series: Denial of Service (DoS) on a large scale VLAN due to PFE hoggingEPSS 0.5%CVE-2026-20177MEDIUMCisco Industrial Ethernet 1000 Series Switches Denial of Service VulnerabilityEPSS 0.5%CVE-2026-54037MEDIUMLibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/forkEPSS 0.5%CVE-2026-76716MEDIUMUnauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)EPSS 0.5%CVE-2024-49589MEDIUMFoundry artifacts denial of serviceEPSS 0.5%CVE-2025-32030HIGHApollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment ExpansionEPSS 0.5%