Falhas do tipo CWE-770

1.533 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2023-50387HIGHCertain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of serEPSS 100.0%CVE-2019-11478MEDIUMSACK can cause extensive memory use via fragmented resend queueEPSS 94.7%CVE-2024-27316HIGHApache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation framesEPSS 91.3%CVE-2024-28182MEDIUMReading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usageEPSS 84.8%CVE-2023-0921MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 84.4%CVE-2023-2650MEDIUMPossible DoS translating ASN.1 object identifiersEPSS 75.1%CVE-2008-5180MEDIUMMicrosoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumpEPSS 68.0%CVE-2025-48976HIGHApache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headersEPSS 67.3%CVE-2023-38039HIGHWhen curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. HoweveEPSS 62.2%CVE-2025-48988HIGHApache Tomcat: FileUpload large number of parts with headers DoSEPSS 56.3%CVE-2023-23969HIGHIn Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoEPSS 47.4%CVE-2023-24998—Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive partsEPSS 46.8%CVE-2025-26466MEDIUMOpenssh: denial-of-service in opensshEPSS 39.8%CVE-2022-22950—n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expEPSS 36.1%CVE-2024-2454MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 33.3%CVE-2022-32206MEDIUMcurl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentiallyEPSS 32.2%CVE-2022-32205MEDIUMA malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sEPSS 27.1%CVE-2026-21710HIGHA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the apEPSS 26.4%CVE-2023-31472HIGHAn issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on EPSS 19.9%CVE-2024-2878HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 19.3%