Weaknesses of type CWE-400

2,621 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2021-44228CRITICALApache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsEPSS 100.0%KEVCVE-2023-44487HIGHThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, asEPSS 100.0%KEVCVE-2024-25617MEDIUMDenial of Service in HTTP Header parser in squid proxyEPSS 88.9%CVE-2019-9515HIGHSome HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceEPSS 87.4%CVE-2019-9512HIGHSome HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of serviceEPSS 83.4%CVE-2019-9514HIGHSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceEPSS 82.8%CVE-2023-50868HIGHThe Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denEPSS 81.7%CVE-2019-9513HIGHSome HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of serviceEPSS 81.6%CVE-2023-28342HIGHZoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.EPSS 78.3%CVE-2021-21341HIGHXStream can cause a Denial of ServiceEPSS 77.8%CVE-2021-22883—Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an EPSS 74.4%CVE-2018-5390—Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of serviceEPSS 73.7%CVE-2022-29885—EncryptInterceptor does not provide complete protection on insecure networksEPSS 73.5%CVE-2023-43622—Apache HTTP Server: DoS in HTTP/2 with initial windows size 0EPSS 70.6%CVE-2023-36606HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 67.2%CVE-2026-45498MEDIUMMicrosoft Defender Denial of Service VulnerabilityEPSS 63.1%KEVCVE-2024-26212HIGHDHCP Server Service Denial of Service VulnerabilityEPSS 62.6%CVE-2023-24580HIGHAn issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certaiEPSS 62.6%CVE-2019-9511HIGHSome HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serviceEPSS 59.5%CVE-2019-9516HIGHSome HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of serviceEPSS 56.3%