Falhas do tipo CWE-770

1.861 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2025-27513HIGHOpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API PackageEPSS 0.5%CVE-2024-9367MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-8486MEDIUMAllocation of resources without limits or throttling vulnerability in Progress Software MOVEit AutomationEPSS 0.5%CVE-2025-44012HIGHQsync CentralEPSS 0.5%CVE-2026-54340HIGHh2o has HTTP/2 state amplificationEPSS 0.5%CVE-2026-1168HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2026-19474HIGH@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted uploadEPSS 0.5%CVE-2026-63750MEDIUMSurrealDB before 3.1.0 Memory Amplification via /sql WebSocketEPSS 0.5%CVE-2025-49140HIGHPion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS)EPSS 0.5%CVE-2026-54273MEDIUMAIOHTTP: HTTP/1 Pipelined Requests Queue Without LimitEPSS 0.5%CVE-2026-89425HIGHjackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growthEPSS 0.5%CVE-2024-31919MEDIUMIBM MQ denial of serviceEPSS 0.5%CVE-2026-77281MEDIUMCaddy: rewrite placeholder re-expansionEPSS 0.5%CVE-2024-48989HIGHA vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial EPSS 0.5%CVE-2023-0616MEDIUMIf a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, EPSS 0.5%CVE-2026-17076MEDIUMIBM i is Affected By Multiple Vulnerabilities in DRDA / DDMEPSS 0.5%CVE-2025-43857MEDIUMnet-imap rubygem vulnerable to possible DoS by memory exhaustionEPSS 0.5%CVE-2024-52918MEDIUMBitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) viaEPSS 0.5%CVE-2026-7768HIGH@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache GrowthEPSS 0.5%CVE-2026-26445HIGHstomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, whicEPSS 0.5%