Falhas do tipo CWE-770

1.864 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2024-4782MEDIUMA denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to dEPSS 0.3%CVE-2025-64422MEDIUMRate-limit bypass on login via X-Forwarded-Host headerEPSS 0.3%CVE-2023-29767MEDIUMAn issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files.EPSS 0.3%CVE-2023-29573MEDIUMBento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.EPSS 0.3%CVE-2026-54247MEDIUMSkipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoSEPSS 0.3%CVE-2024-46921MEDIUMAn issue was discovered in Samsung Mobile Processor and Modem Exynos 9820, 9825, 980, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9EPSS 0.3%CVE-2024-53647MEDIUMTrend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email veEPSS 0.3%CVE-2026-25043MEDIUMBudibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email FloodingEPSS 0.3%CVE-2026-20482MEDIUMIn wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote (proximal/adjacent) denial of serEPSS 0.3%CVE-2026-65827MEDIUMDocmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of serviceEPSS 0.3%CVE-2023-30406MEDIUMJerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpeEPSS 0.3%CVE-2025-68136HIGHEVerest's inadequate session handling can lead to memory-related errors or exhaustion of the operating system’s file descriptors, resulting in a denial of serviceEPSS 0.3%CVE-2023-30408MEDIUMJerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.EPSS 0.3%CVE-2026-55254MEDIUMNCalc: Denial of Service via Unbounded and Non-Terminating Factorial EvaluationEPSS 0.3%CVE-2025-69199HIGHPterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstancesEPSS 0.3%CVE-2022-51008MEDIUMPocketMine-MP before 4.12.3 Denial of Service via Unauthenticated SessionsEPSS 0.3%CVE-2026-61465MEDIUMImageMagick before 7.1.2-26 Memory Allocation Policy BypassEPSS 0.3%CVE-2026-10740MEDIUMExcessive memory allocation in s2n-quicEPSS 0.3%CVE-2026-13069HIGHQueryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource ExhaustionEPSS 0.3%CVE-2026-92077MEDIUMDenial-of-service in the SVG componentEPSS 0.3%