Weaknesses of type CWE-400

3,026 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2026-3505HIGHUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.EPSS 0.9%CVE-2026-48043MEDIUMnetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionEPSS 0.9%CVE-2022-31016MEDIUMArgo CD vulnerable to Uncontrolled Memory ConsumptionEPSS 0.9%CVE-2025-24260CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5.EPSS 0.9%CVE-2022-44608HIGHUncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huEPSS 0.9%CVE-2024-21171MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 aEPSS 0.9%CVE-2024-20716MEDIUMForce high-usage of resources by generating unlimited coupons: Adobe CommerceEPSS 0.9%CVE-2024-21231LOWVulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 8.0.39 andEPSS 0.9%CVE-2022-2529HIGHMultiple DoS Attack Vectors in sflow packet handlingEPSS 0.9%CVE-2020-1750—A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amounEPSS 0.9%CVE-2023-51775MEDIUMThe jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count)EPSS 0.9%CVE-2023-45621HIGHUnauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of EPSS 0.9%CVE-2026-54428HIGHApache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACKEPSS 0.9%CVE-2026-54399HIGHApache HttpComponents Core: Unbounded HTTP Header/Line Length in Default ConfigurationEPSS 0.9%CVE-2023-45622HIGHUnauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitatEPSS 0.9%CVE-2022-30792HIGHCODESYS: CmpChannelServer, CmpChannelServerEmbedded allow unauthenticated attackers to block all their available communication channelsEPSS 0.9%CVE-2026-40192HIGHPillow is vulnerable to a FITS GZIP decompression bombEPSS 0.9%CVE-2022-30791HIGHCODESYS V3: CmpBlkDrvTcp allows unauthenticated attackers to block all its available TCP connectionsEPSS 0.9%CVE-2025-4727MEDIUMMeteor livedata_server.js Object.assign redosEPSS 0.9%CVE-2023-48713MEDIUMKnative Serving vulnerable to attacker-controlled pod causing denial of service of autoscalerEPSS 0.9%