Weaknesses of type CWE-400

3,013 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2017-16136—method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesEPSS 1.2%CVE-2020-15114HIGHDenial of Service in etcdEPSS 1.2%CVE-2018-1107—It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to havEPSS 1.2%CVE-2023-49295MEDIUMquic-go's path validation mechanism can cause denial of serviceEPSS 1.2%CVE-2020-14297MEDIUMA flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumEPSS 1.2%CVE-2026-72923HIGHMicrosoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansionEPSS 1.2%CVE-2024-41989HIGHAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory cEPSS 1.2%CVE-2019-15584—A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fieldsEPSS 1.2%CVE-2020-1600MEDIUMJunos OS: A specific SNMP command can trigger a high CPU usage Denial of Service in the RPD daemon.EPSS 1.2%CVE-2022-48474HIGHControl de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Sending a malicious requeEPSS 1.2%CVE-2024-41946MEDIUMREXML DoS vulnerabilityEPSS 1.2%CVE-2026-55450CRITICALLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leakEPSS 1.2%CVE-2022-39278HIGHIstio vulnerable to denial of service attack due to Golang Regex LibraryEPSS 1.2%CVE-2021-41229MEDIUMMemory leak in BlueZEPSS 1.2%CVE-2021-1489MEDIUMCisco Firepower Device Manager Software Filesystem Space Exhaustion Denial of Service VulnerabilityEPSS 1.2%CVE-2017-7935—A Resource Exhaustion issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may compromise the dEPSS 1.2%CVE-2024-1765MEDIUMUnlimited resource allocation by QUIC CRYPTO frames flooding in quicheEPSS 1.2%CVE-2021-32617MEDIUMDenial of service in Exiv2EPSS 1.2%CVE-2026-50653HIGHAzure Active Directory Denial of Service VulnerabilityEPSS 1.2%CVE-2026-58627HIGHWindows DHCP Server Denial of Service VulnerabilityEPSS 1.2%