Weaknesses of type CWE-400

2,992 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2020-3255HIGHCisco Firepower Threat Defense Software Packet Flood Denial of Service VulnerabilityEPSS 1.8%CVE-2020-3189HIGHCisco Firepower Threat Defense Software VPN System Logging Denial of Service VulnerabilityEPSS 1.8%CVE-2021-21328MEDIUMDenial of ServiceEPSS 1.8%CVE-2018-16489—A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through itEPSS 1.8%CVE-2023-0056MEDIUMAn uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenEPSS 1.8%CVE-2021-29430HIGHDenial of service attack via memory exhaustionEPSS 1.8%CVE-2023-27530HIGHA DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could alEPSS 1.8%CVE-2022-24294—ReDoS in Apache MXNet RTC ModuleEPSS 1.8%CVE-2022-3517HIGHA vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExEPSS 1.8%CVE-2022-35922HIGHMemory allocation based on untrusted length in rust-websocketEPSS 1.8%CVE-2023-35329MEDIUMWindows Authentication Denial of Service VulnerabilityEPSS 1.8%CVE-2021-32657MEDIUMMalicious user could break user administration pageEPSS 1.8%CVE-2022-40899HIGHAn issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-CookieEPSS 1.8%CVE-2025-32724HIGHWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 1.8%CVE-2023-52425HIGHlibexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large toEPSS 1.8%CVE-2023-6277MEDIUMLibtiff: out-of-memory in tiffopen via a craft fileEPSS 1.8%CVE-2021-21419MEDIUMImproper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventletEPSS 1.8%CVE-2020-8295—A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.EPSS 1.8%CVE-2019-1696HIGHCisco Firepower Threat Defense Software SMB Protocol Preprocessor Detection Engine Denial of Service VulnerabilitiesEPSS 1.8%CVE-2021-21254MEDIUMRegular expression Denial of Service in Markdown pluginEPSS 1.8%