Falhas do tipo CWE-770

1.861 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-42034MEDIUMAxios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0EPSS 0.5%CVE-2026-42036MEDIUMAxios: HTTP adapter streamed responses bypass maxContentLengthEPSS 0.5%CVE-2022-3273LOWAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.5%CVE-2024-4311MEDIUMLack of login attempt rate-limiting in zenml-io/zenmlEPSS 0.5%CVE-2026-15588MEDIUMGdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line bufferingEPSS 0.5%CVE-2026-0531MEDIUMAllocation of Resources Without Limits or Throttling in Kibana FleetEPSS 0.5%CVE-2026-74786HIGHScriban before 7.0.0 Denial of Service via Unbounded Template OutputEPSS 0.5%CVE-2026-54894MEDIUMAtom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keysEPSS 0.5%CVE-2026-91987HIGHatomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown ModelEPSS 0.5%CVE-2026-55733MEDIUMAtom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creationEPSS 0.5%CVE-2026-56150MEDIUMAllocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of ServiceEPSS 0.5%CVE-2026-55734MEDIUMguardian atom exhaustion in Guardian.Permissions.encode_permissions!/1EPSS 0.5%CVE-2022-48357—Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks tEPSS 0.5%CVE-2023-30443MEDIUMIBM Db2 denial of serviceEPSS 0.5%CVE-2026-49087MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-49089MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-78586MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-29612MEDIUMOpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File DecodingEPSS 0.5%CVE-2025-64508HIGHBugsink vulnerable to unauthenticated remote DoS via crafted Brotli inputEPSS 0.5%CVE-2024-31669HIGHrizin before Release v0.6.3 is vulnerable to Uncontrolled Resource Consumption via bin_pe_parse_imports, Pe_r_bin_pe_parse_var, and estimateEPSS 0.5%