Weaknesses of type CWE-400

2,994 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2017-16098—charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down oEPSS 1.7%CVE-2022-31018HIGHDenial of service binding form from JSON in Play FrameworkEPSS 1.7%CVE-2021-41145HIGHFreeSWITCH susceptible to Denial of Service via SIP floodingEPSS 1.7%CVE-2021-29471LOWDenial of service in Matrix SynapseEPSS 1.6%CVE-2019-1672MEDIUMCisco Web Security Appliance Decryption Policy Bypass VulnerabilityEPSS 1.6%CVE-2023-31418HIGHElasticsearch uncontrolled resource consumptionEPSS 1.6%CVE-2023-32013MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 1.6%CVE-2022-31173HIGHJuniper is vulnerable to @DOS GraphQL Nested Fragments overflowEPSS 1.6%CVE-2022-40150MEDIUMStack Buffer Overflow in JettisonEPSS 1.6%CVE-2025-13836MEDIUMExcessive read buffering DoS in http.clientEPSS 1.6%CVE-2022-35923HIGHInefficient Regular Expression Complexity in v8nEPSS 1.6%CVE-2019-19343—A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener dueEPSS 1.6%CVE-2022-31073MEDIUMKubeEdge Edge ServiceBus module DoSEPSS 1.6%CVE-2022-44570—A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range headEPSS 1.6%CVE-2021-32832MEDIUMReDOS in Rocket.ChatEPSS 1.6%CVE-2022-44572—A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an aEPSS 1.6%CVE-2024-26141MEDIUMPossible DoS Vulnerability with Range Header in RackEPSS 1.6%CVE-2023-23009MEDIUMLibreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrEPSS 1.6%CVE-2022-24741LOWHigh memory usage in Nextcloud serverEPSS 1.6%CVE-2021-29509HIGHKeepalive Connections Causing Denial Of Service in pumaEPSS 1.6%