Falhas do tipo CWE-770

1.833 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2026-26130HIGHASP.NET Core Denial of Service VulnerabilityEPSS 2.8%CVE-2017-15124—VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as iEPSS 2.8%CVE-2022-23913—Apache ActiveMQ Artemis DoSEPSS 2.7%CVE-2019-14834LOWA vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memoryEPSS 2.7%CVE-2021-34710HIGHCisco ATA 190 Series Analog Telephone Adapter Software VulnerabilitiesEPSS 2.6%CVE-2024-57972MEDIUMThe pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) tEPSS 2.5%CVE-2016-9578HIGHA vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server coEPSS 2.5%CVE-2026-45591HIGHASP.NET Core Denial of Service VulnerabilityEPSS 2.5%CVE-2021-40114MEDIUMMultiple Cisco Products Snort Memory Leak Denial of Service VulnerabilityEPSS 2.4%CVE-2025-9784HIGHUndertow: undertow madeyoureset http/2 ddos vulnerabilityEPSS 2.3%CVE-2024-43567HIGHWindows Hyper-V Denial of Service VulnerabilityEPSS 2.3%CVE-2024-22255HIGHInformation disclosure vulnerabilityEPSS 2.3%CVE-2019-11938—Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malEPSS 2.3%CVE-2021-36630HIGHDDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform DEPSS 2.2%CVE-2018-10908MEDIUMIt was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafEPSS 2.2%CVE-2025-61726HIGHMemory exhaustion in query parameter parsing in net/urlEPSS 2.2%CVE-2018-16846MEDIUMIt was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indEPSS 2.1%CVE-2019-3553—C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, maliEPSS 2.1%CVE-2024-1975HIGHSIG(0) can be used to exhaust CPU resourcesEPSS 2.1%CVE-2024-1737HIGHBIND's database will be slow if a very large number of RRs exist at the same nameEPSS 2.1%