Falhas do tipo CWE-770

1.861 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-43329HIGHnetfilter: flowtable: strictly check for maximum number of actionsEPSS 0.2%CVE-2026-22780MEDIUMRizin has a heap overflow on mach0_chained_fixups.cEPSS 0.2%CVE-2026-8124MEDIUMGPAC box_code_base.c sidx_box_read allocation of resourcesEPSS 0.2%CVE-2026-18170MEDIUMIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-53937MEDIUMMCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)EPSS 0.2%CVE-2026-27026MEDIUMpypdf possibly has long runtimes for malformed FlateDecode streamsEPSS 0.2%CVE-2026-48496MEDIUMopentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agentEPSS 0.2%CVE-2026-63119MEDIUMMCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)EPSS 0.2%CVE-2025-32425MEDIUMAutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoSEPSS 0.2%CVE-2026-54389MEDIUMGhidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdbEPSS 0.2%CVE-2024-38335MEDIUMIBM Security QRadar Network Threat Analytics denial of serviceEPSS 0.2%CVE-2026-48735MEDIUMpypdf: Manipulated XMP metadata streams can exhaust RAMEPSS 0.2%CVE-2025-32025MEDIUMbep/imagemeta allows a potentially large memory allocation in PNG and WebP parsingEPSS 0.2%CVE-2025-32024MEDIUMbep/imagemeta allows excessively large EXIF data structuresEPSS 0.2%CVE-2023-22397MEDIUMJunos OS Evolved: PTX10003: An attacker sending specific genuine packets will cause a memory leak in the PFE leading to a Denial of ServiceEPSS 0.2%CVE-2026-53423MEDIUMUnauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_pluginEPSS 0.2%CVE-2026-53426HIGHAtom-table exhaustion denial-of-service via JSON parse_document in MDExEPSS 0.2%CVE-2025-68138MEDIUMEVerest affected by memory exhaustion in libocppEPSS 0.2%CVE-2026-31826MEDIUMpypdf: manipulated stream length values can exhaust RAMEPSS 0.2%CVE-2023-30903—HP-UX could be exploited locally to create a Denial of Service (DoS) when any physical interface is configured with IPv6/inet6. EPSS 0.2%