Weaknesses of type CWE-400

3,026 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2021-33609MEDIUMDenial of service in DataCommunicator class in Vaadin 8EPSS 0.9%CVE-2024-25978HIGHMsa-24-0001: denial of service risk in file picker unzip functionalityEPSS 0.9%CVE-2022-3639MEDIUMA potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2EPSS 0.9%CVE-2024-6762LOWJetty PushSessionCacheFilter can cause remote DoS attacksEPSS 0.9%CVE-2022-39374MEDIUMSynapse Denial of service due to incorrect application of event authorization rules during state resolutionEPSS 0.9%CVE-2025-24247CRITICALA type confusion issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.EPSS 0.9%CVE-2023-52340HIGHThe IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading EPSS 0.9%CVE-2024-9823MEDIUMJetty DOS vulnerability on DosFilterEPSS 0.9%CVE-2023-26141HIGHVersions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.jsEPSS 0.9%CVE-2024-21230MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 aEPSS 0.9%CVE-2021-3821CRITICALA potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Denial ofEPSS 0.9%CVE-2021-23042—On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when aEPSS 0.9%CVE-2020-3372MEDIUMCisco SD-WAN vManage Software Denial of Service VulnerabilityEPSS 0.9%CVE-2026-48779HIGHws: Memory exhaustion DoS from tiny fragments and data chunksEPSS 0.9%CVE-2022-2794HIGHCertain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack.EPSS 0.9%CVE-2025-61772HIGHRack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)EPSS 0.9%CVE-2025-61770HIGHRack's unbounded multipart preamble buffering enables DoS (memory exhaustion)EPSS 0.9%CVE-2022-28701HIGHOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause anEPSS 0.9%CVE-2022-28691HIGHOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prioEPSS 0.9%CVE-2022-22724—A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), EPSS 0.9%