Falhas do tipo CWE-770

2.223 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-72978MEDIUMActive Directory Federation Services (AD FS) Denial of Service VulnerabilityEPSS 1.0%CVE-2023-47120HIGHDiscourse DoS through Onebox favicon URLEPSS 1.0%CVE-2025-4821HIGHIncorrect congestion window growth by invalid ACK rangesEPSS 1.0%CVE-2022-35220HIGHTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-1EPSS 1.0%CVE-2022-32958HIGHTEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or ThrottlingEPSS 1.0%CVE-2023-27901HIGHJenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reEPSS 1.0%CVE-2024-28102MEDIUMJWCrypto vulnerable to JWT bomb Attack in `deserialize` functionEPSS 1.0%CVE-2023-27900HIGHJenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reEPSS 1.0%CVE-2023-5625MEDIUMPython-eventlet: patch regression for cve-2021-21419 in some red hat buildsEPSS 1.0%CVE-2021-31369MEDIUMJunos OS: MX Series: Traffic drops will be observed if MS-MPC/MS-PIC resources are consumed by certain traffic causing a partial DoSEPSS 1.0%CVE-2025-7070MEDIUMIROAD Dashcam Q9 MFA Pairing Request allocation of resourcesEPSS 1.0%CVE-2026-96959HIGH.NET Denial of Service VulnerabilityEPSS 1.0%CVE-2026-47774HIGHEnvoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationEPSS 1.0%CVE-2023-38507HIGHStrapi Improper Rate Limiting vulnerabilityEPSS 1.0%CVE-2026-18649HIGHGstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloadersEPSS 1.0%CVE-2021-0285HIGHJunos OS: QFX5000 Series and EX4600 Series: Continuous traffic destined to a device configured with MC-LAG leading to nodes losing their control connection which can impact trafficEPSS 1.0%CVE-2023-28119HIGHcrewjam/saml vulnerable to Denial Of Service Via Deflate Decompression BombEPSS 1.0%CVE-2025-21534MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected areEPSS 1.0%CVE-2025-21536MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 aEPSS 1.0%CVE-2022-22278—A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when usEPSS 1.0%