Falhas do tipo CWE-770

1.834 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2019-16770MEDIUMPotential DOS attack in PumaEPSS 2.0%CVE-2022-22970—In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable tEPSS 2.0%CVE-2022-3423HIGHAllocation of Resources Without Limits or Throttling in nocodb/nocodbEPSS 2.0%CVE-2024-56374MEDIUMAn issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strinEPSS 1.9%CVE-2021-34735HIGHCisco ATA 190 Series Analog Telephone Adapter Software VulnerabilitiesEPSS 1.9%CVE-2024-12254HIGHUnbounded memory buffering in SelectorSocketTransport.writelines()EPSS 1.9%CVE-2020-28400HIGHAffected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerabilityEPSS 1.9%CVE-2023-27530HIGHA DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could alEPSS 1.8%CVE-2023-25193HIGHhb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looEPSS 1.8%CVE-2018-3711—Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" andEPSS 1.8%CVE-2021-27383HIGHA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 1.8%CVE-2023-34455HIGHsnappy-java's unchecked chunk length leads to DoSEPSS 1.8%CVE-2024-38821CRITICALAuthorization Bypass of Static Resources in WebFlux ApplicationsEPSS 1.7%CVE-2018-3737—sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.EPSS 1.7%CVE-2022-35724—Denial of service while reading data in Avro Rust SDKEPSS 1.7%CVE-2022-36324HIGHAffected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypaEPSS 1.7%CVE-2023-23916MEDIUMAn allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algoriEPSS 1.7%CVE-2020-15168LOWFile size limit bypass in node-fetchEPSS 1.7%CVE-2024-38286HIGHApache Tomcat: Denial of ServiceEPSS 1.7%CVE-2025-26682HIGHASP.NET Core and Visual Studio Denial of Service VulnerabilityEPSS 1.7%