Falhas do tipo CWE-770

1.840 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2024-20968MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.34 andEPSS 0.9%CVE-2023-50247LOWh2o QUIC state exhaustion DoSEPSS 0.9%CVE-2025-32049HIGHLibsoup: denial of service attack to websocket serverEPSS 0.9%CVE-2025-21605HIGHRedis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated clientEPSS 0.9%CVE-2024-43783HIGHApollo Router Coprocessors may cause Denial-of-Service when handling request bodiesEPSS 0.9%CVE-2022-2134HIGHAllocation of Resources Without Limits or Throttling in inventree/inventreeEPSS 0.9%CVE-2022-39226MEDIUMDiscourse user profile location and website fields were not sufficiently length-limitedEPSS 0.9%CVE-2024-29903MEDIUMCosign vulnerable to machine-wide denial of service via malicious artifactsEPSS 0.9%CVE-2023-34450LOWCometBFT PeerState JSON serialization deadlockEPSS 0.9%CVE-2023-0383HIGHUncontrolled Resource Consuption in M-Files ServerEPSS 0.8%CVE-2024-57662HIGHAn issue in the sqlg_hash_source component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via cEPSS 0.8%CVE-2026-33176MEDIUMRails Active Support has a possible DoS vulnerability in its number helpersEPSS 0.8%CVE-2025-13927HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.8%CVE-2024-28871HIGHExcessive CPU used on malformed trafficEPSS 0.8%CVE-2026-50648HIGH.NET Framework Denial of Service VulnerabilityEPSS 0.8%CVE-2026-50651HIGH.NET Denial of Service VulnerabilityEPSS 0.8%CVE-2024-8984HIGHDenial of Service (DoS) in berriai/litellmEPSS 0.8%CVE-2026-41284HIGHApache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handlingEPSS 0.8%CVE-2024-23184MEDIUMHaving a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is alEPSS 0.8%CVE-2022-20950MEDIUMA vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remoEPSS 0.8%