Weaknesses of type CWE-400

3,000 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2017-16138—The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted useEPSS 2.2%CVE-2022-30122—A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.EPSS 2.1%CVE-2022-24839HIGHUncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)EPSS 2.1%CVE-2021-21294HIGHUnbounded connection acceptance in http4s-blaze-serverEPSS 2.1%CVE-2018-16472—A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are EPSS 2.1%CVE-2019-14888HIGHA vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPEPSS 2.1%CVE-2022-39209HIGHUncontrolled Resource Consumption in cmark-gfmEPSS 2.1%CVE-2015-9241—Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sEPSS 2.1%CVE-2025-23184MEDIUMApache CXF: Denial of Service vulnerability with temporary filesEPSS 2.1%CVE-2020-11090HIGHUncontrolled Resource Consumption in Indy NodeEPSS 2.1%CVE-2019-1814MEDIUMCisco Small Business 300 Series Managed Switches DHCP Denial of Service VulnerabilityEPSS 2.1%CVE-2021-21293HIGHUnbounded connection acceptance leads to file handle exhaustionEPSS 2.1%CVE-2025-21207HIGHWindows Connected Devices Platform Service (Cdpsvc) Denial of Service VulnerabilityEPSS 2.1%CVE-2025-38501HIGHksmbd: limit repeated connections from clients with the same IPEPSS 2.1%CVE-2024-28176MEDIUMjose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintextEPSS 2.1%CVE-2015-9242—Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. ThEPSS 2.1%CVE-2021-21267HIGHRegular Expression Denial-of-Service in npm schema-inspectorEPSS 2.1%CVE-2025-27486HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.1%CVE-2025-21174HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.1%CVE-2025-27485HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.1%