Falhas do tipo CWE-770

1.846 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2025-66418HIGHurllib3 allows an unbounded number of links in the decompression chainEPSS 0.7%CVE-2025-61028HIGHAn issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.7%CVE-2023-2666MEDIUMAllocation of Resources Without Limits or Throttling in froxlor/froxlorEPSS 0.7%CVE-2022-3439MEDIUMAllocation of Resources Without Limits or Throttling in ikus060/rdiffwebEPSS 0.7%CVE-2024-55563MEDIUMBitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913. For example,EPSS 0.7%CVE-2026-40192HIGHPillow is vulnerable to a FITS GZIP decompression bombEPSS 0.7%CVE-2022-22211HIGHJunos OS Evolved: PTX Series: Multiple FPCs become unreachable due to continuous polling of specific SNMP OIDEPSS 0.7%CVE-2026-44488HIGHAxios: Allocation of Resources Without Limits or Throttling in axiosEPSS 0.7%CVE-2023-20155HIGHA vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to causEPSS 0.7%CVE-2024-35231HIGHrack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameterEPSS 0.7%CVE-2023-51339MEDIUMA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Event Ticketing System v1.0 allows attackers to send an excessive amoEPSS 0.7%CVE-2026-27979MEDIUMNext.js: Unbounded postponed resume buffering can lead to DoSEPSS 0.7%CVE-2026-27857MEDIUMSending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client EPSS 0.7%CVE-2020-36946HIGHSyncBreeze 10.0.28 - 'login' Denial of ServiceEPSS 0.7%CVE-2023-34389MEDIUMAllocation of resources without limits could lead to denial of serviceEPSS 0.7%CVE-2023-22323HIGHBIG-IP SSL OCSP Authentication profile vulnerabilityEPSS 0.7%CVE-2022-45434MEDIUMSome Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the fiEPSS 0.7%CVE-2022-31184MEDIUMEmail activation route can be abused by spammers in DiscourseEPSS 0.7%CVE-2024-29902MEDIUMCosign vulnerable to system-wide denial of service via malicious attachmentsEPSS 0.7%CVE-2023-41038HIGHServer crash when using specific form of SET BIND statementEPSS 0.7%