Falhas do tipo CWE-770

1.846 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2023-3967MEDIUMDoS Vulnerability in Hitachi Ops Center Common ServicesEPSS 0.5%CVE-2025-41693MEDIUMAuthenticated Denial-of-Service via SSHEPSS 0.5%CVE-2023-44191HIGHJunos OS: QFX5000 Series and EX4000 Series: Denial of Service (DoS) on a large scale VLAN due to PFE hoggingEPSS 0.5%CVE-2024-34046HIGHThe O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->sctpParams->e2tCounters[IN_SUEPSS 0.5%CVE-2023-51393MEDIUMPotential DoS due to BusFault and Assert in Ember ZNet legacy packet bufferEPSS 0.5%CVE-2024-21771HIGHF5 AFM Signature Matching VulnerabilityEPSS 0.5%CVE-2026-91865HIGHApache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceEPSS 0.5%CVE-2026-91864HIGHApache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionEPSS 0.5%CVE-2026-33257MEDIUMInsufficient input validation of internal webserverEPSS 0.5%CVE-2026-44248MEDIUMNetty: Resource exhaustion in MqttDecoderEPSS 0.5%CVE-2026-76716MEDIUMUnauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)EPSS 0.5%CVE-2026-54345MEDIUMGoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)EPSS 0.5%CVE-2026-54037MEDIUMLibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/forkEPSS 0.5%CVE-2024-49589MEDIUMFoundry artifacts denial of serviceEPSS 0.5%CVE-2025-32030HIGHApollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment ExpansionEPSS 0.5%CVE-2023-25822MEDIUMReportPortal DoS vulnerability on creating a Launch with too many recursively nested elementsEPSS 0.5%CVE-2025-48738MEDIUMAn e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1EPSS 0.5%CVE-2026-42788MEDIUMHTTP/2 frame size limit checked after body is buffered in banditEPSS 0.5%CVE-2026-25985HIGHMemory allocation with excessive without limits in the internal SVG decoderEPSS 0.5%CVE-2026-31984HIGHDoS through oversized audit log entries in Guardian/CMC before 26.2.0EPSS 0.5%