Falhas do tipo CWE-770

1.834 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2020-18899MEDIUMAn uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of serEPSS 1.7%CVE-2017-2613MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained untEPSS 1.6%CVE-2005-4650MEDIUMJoomla! 1.03 does not restrict the number of "Search" Mambots, which allows remote attackers to cause a denial of service (resource consumptEPSS 1.6%CVE-2023-27958CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.EPSS 1.6%CVE-2022-36104MEDIUMDenial of Service via Page Error Handling in TYPO3/cmsEPSS 1.6%CVE-2026-1519HIGHExcessive NSEC3 iterations cause high CPU load during insecure delegation validationEPSS 1.6%CVE-2025-41704MEDIUMPhoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function CodeEPSS 1.6%CVE-2023-47108HIGHDoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metricsEPSS 1.6%CVE-2019-11939—Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, mEPSS 1.6%CVE-2026-23869HIGHA denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-serverEPSS 1.6%CVE-2022-21952HIGHSUMA unauthenticated remote DoS via resource exhaustionEPSS 1.5%CVE-2022-26336—A carefully crafted TNEF file can cause an out of memory exceptionEPSS 1.5%CVE-2023-39533HIGHlibp2p nodes vulnerable to attack using large RSA keysEPSS 1.5%CVE-2025-50172MEDIUMDirectX Graphics Kernel Denial of Service VulnerabilityEPSS 1.5%CVE-2022-0084—A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expecEPSS 1.5%CVE-2021-33541HIGHPhoenix Contact: ILC1x Industrial controllers affected by Denial-of-Service vulnerabilityEPSS 1.5%CVE-2023-24536HIGHExcessive resource consumption in net/http, net/textproto and mime/multipartEPSS 1.5%CVE-2023-27643HIGHAn issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button EPSS 1.5%CVE-2024-31208MEDIUMSynapse's V2 state resolution weakness allows DoS from remote room membersEPSS 1.5%CVE-2023-25576HIGH@fastify/multipart vulnerable to DoS due to unlimited number of partsEPSS 1.5%