Weaknesses of type CWE-400

2,995 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2024-20976MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 aEPSS 1.1%CVE-2018-7821HIGHAn Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmwarEPSS 1.1%CVE-2024-20972MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 aEPSS 1.1%CVE-2024-49767MEDIUMWerkzeug possible resource exhaustion when parsing file data in formsEPSS 1.1%CVE-2022-22275—Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake poEPSS 1.1%CVE-2016-10521—jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress vEPSS 1.1%CVE-2020-35510—A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever iEPSS 1.1%CVE-2022-39280MEDIUMRegular expression denial of service in dparseEPSS 1.1%CVE-2018-6332MEDIUMA potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate EPSS 1.1%CVE-2023-46118MEDIUMDenial of Service by publishing large messages over the HTTP APIEPSS 1.1%CVE-2022-37050MEDIUMIn Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafEPSS 1.1%CVE-2023-29013HIGHHTTP header parsing could cause a deny of serviceEPSS 1.1%CVE-2021-31368HIGHJunos OS: EX2300 Series, EX3400 Series, and ACX710 might become unresponsive if the out-of-band management port receives a flood of trafficEPSS 1.1%CVE-2020-12524HIGHPhoenix Contact BTP Touch Panels uncontrolled resource consumptionEPSS 1.1%CVE-2019-16764MEDIUMPowAssent is susceptible to denial of service attacksEPSS 1.1%CVE-2025-15532MEDIUMOpen5GS Timer resource consumptionEPSS 1.1%CVE-2020-19850MEDIUMAn issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.EPSS 1.1%CVE-2020-8175—Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a craftedEPSS 1.1%CVE-2023-40692MEDIUMIBM Db2 denial of serviceEPSS 1.1%CVE-2023-22483LOWcmark-gfm Quadratic complexity bugs may lead to a denial of serviceEPSS 1.1%