Falhas do tipo CWE-770

2.223 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2022-3480HIGHDenial-of-Service vulnerability in PHOENIX CONTACT mGuard product familyEPSS 0.9%CVE-2026-58465HIGHEclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoSEPSS 0.9%CVE-2024-52797MEDIUMSearching Opencast may cause a denial of serviceEPSS 0.9%CVE-2024-3382HIGHPAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted PacketsEPSS 0.9%CVE-2026-45416HIGHNetty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesEPSS 0.9%CVE-2026-85449HIGHMOOS-IvP through 24.8.1 pMarineViewer Unbounded Memory Consumption via NODE_REPORTEPSS 0.9%CVE-2023-37279HIGHFaktory Web Dashboard can lead to denial of service(DOS) via malicious user inputEPSS 0.9%CVE-2025-64702MEDIUMquic-go HTTP/3 QPACK Header Expansion DoSEPSS 0.9%CVE-2023-25171HIGHKiwi TCMS has denial of service vulnerability on Password reset pageEPSS 0.9%CVE-2026-39304HIGHApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOMEPSS 0.9%CVE-2024-43410HIGHRussh has an OOM Denial of Service due to allocation of untrusted amountEPSS 0.9%CVE-2023-25156HIGHKiwi TCMS has no protection against brute-force attacks on login pageEPSS 0.9%CVE-2023-6910MEDIUMUncontrolled Resource Consumption in M-Files ServerEPSS 0.9%CVE-2023-40019HIGHFreeSWITCH allows authorized users to cause a denial of service attack by sending re-INVITE with SDP containing duplicate codec namesEPSS 0.9%CVE-2026-101896HIGHAngular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)EPSS 0.9%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.9%CVE-2023-29479MEDIUMRibose RNP before 0.16.3 may hang when the input is malformed.EPSS 0.9%CVE-2023-20155HIGHA vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to causEPSS 0.9%CVE-2026-32141HIGHflatted: Unbounded recursion DoS in parse() revive phaseEPSS 0.9%CVE-2024-26308MEDIUMApache Commons Compress: OutOfMemoryError unpacking broken Pack200 fileEPSS 0.9%