Falhas do tipo CWE-770

1.861 resultados

Alocação de recursos sem limite (negação de serviço por esgotamento)

A aplicação aloca recursos (memória, conexões, arquivos, threads) a pedido de um usuário sem impor limites, permitindo que um atacante esgote todos os recursos disponíveis e derrube o serviço. É basicamente deixar a porta aberta para qualquer um encher a caixa d'água até transbordar.

Exemplo

Um servidor web que cria uma nova thread para cada requisição HTTP recebida, sem limite. Um atacante envia milhares de requisições simultâneas e esgota o pool de threads, tornando o servidor inresponsivo para usuários legítimos — é negação de serviço puro.

Como mitigar

Implemente limites rigorosos: rate limiting (requisições por IP/usuário), quotas de recursos, pool de threads/conexões com tamanho máximo, timeout em operações, e monitoramento de consumo. Valide tamanhos de entrada e rejeite alocações que excedam os limites configurados.

CVE-2025-57798MEDIUMJoplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title InputEPSS 0.2%CVE-2024-41175MEDIUMBeckhoff: Local Denial-of-Service vulnerability in TwinCAT/BSD and the IPC-Diagnostics packageEPSS 0.2%CVE-2026-35480MEDIUMgo-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headersEPSS 0.2%CVE-2026-3686MEDIUMVulnerabilities exists in IBM Cloud Pak for Data SystemEPSS 0.2%CVE-2026-64847MEDIUMAnyIO process-pool workers can block indefinitely on undrained stderrEPSS 0.2%CVE-2024-29086LOWArkcompiler runtime has a stack overflow svulnerabilityEPSS 0.2%CVE-2026-40608MEDIUMNext AI Draw.io: Unbounded HTTP Body — Denial of ServiceEPSS 0.2%CVE-2024-47967MEDIUMImproper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of serEPSS 0.2%CVE-2021-26381HIGHImproper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a larEPSS 0.2%CVE-2026-42546LOWOP-TEE has missing OPTEE_MSG_ATTR_TYPE_MASK in cleanup_shm_refs() leaks mobj referencesEPSS 0.2%CVE-2026-4897MEDIUMPolkit: polkit: denial of service via unbounded input processing through standard inputEPSS 0.2%CVE-2026-86892MEDIUMThis issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOSEPSS 0.1%CVE-2026-42444LOWNanaZip: Unbounded resource consumption in NanaZip littlefs parser via attacker-controlled BlockCountEPSS 0.1%CVE-2026-31890MEDIUMInspektor Gadget: Tracing Denial of Service via Event FloodingEPSS 0.1%CVE-2026-34165MEDIUMgo-git: Maliciously crafted idx file can cause asymmetric memory consumptionEPSS 0.1%CVE-2026-75808MEDIUMAllocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition througEPSS 0.1%CVE-2025-58343MEDIUMAn issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480EPSS 0.1%CVE-2025-58348MEDIUMAn issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480EPSS 0.1%CVE-2025-58347MEDIUMAn issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480EPSS 0.1%CVE-2026-71224MEDIUMGfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walkEPSS 0.1%