Weaknesses of type CWE-400

3,026 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2026-49160HIGHHTTP.sys Denial of Service VulnerabilityEPSS 1.2%CVE-2023-26104HIGHAll versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes coEPSS 1.2%CVE-2023-5915—A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerabEPSS 1.2%CVE-2017-16030—Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headeEPSS 1.2%CVE-2021-41118MEDIUMReDoS in DynamicPageList3EPSS 1.2%CVE-2025-46727HIGHUnbounded-Parameter DoS in Rack::QueryParserEPSS 1.2%CVE-2020-8192—A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (wheEPSS 1.2%CVE-2023-29449MEDIUMLimited control of resource utilization in JS preprocessingEPSS 1.2%CVE-2021-0229MEDIUMJunos OS: Receipt of specific packets could lead to Denial of Service in MQTT ServerEPSS 1.2%CVE-2015-9239—ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.EPSS 1.2%CVE-2016-10520—jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.EPSS 1.2%CVE-2022-21700MEDIUMMemory leak in micronaut-coreEPSS 1.1%CVE-2022-20692HIGHCisco IOS XE Software NETCONF Over SSH Denial of Service VulnerabilityEPSS 1.1%CVE-2017-2680HIGHSpecially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment EPSS 1.1%CVE-2023-26433MEDIUMWhen adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access tEPSS 1.1%CVE-2021-23215—An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could EPSS 1.1%CVE-2023-26434MEDIUMWhen adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access tEPSS 1.1%CVE-2023-26432MEDIUMWhen adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access tEPSS 1.1%CVE-2020-5423HIGHCloud Controller is vulnerable to denial of service via YAML parsingEPSS 1.1%CVE-2020-8123—A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbEPSS 1.1%