Weaknesses of type CWE-400

3,450 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2019-11048MEDIUMTemporary files are not cleaned after OOM when parsing HTTP request dataEPSS 6.3%CVE-2018-10851MEDIUMPowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, EPSS 6.0%CVE-2021-22119—Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a DeEPSS 6.0%CVE-2022-21698HIGHUncontrolled Resource Consumption in promhttpEPSS 6.0%CVE-2017-12174—It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is createdEPSS 6.0%CVE-2021-37136—The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocatiEPSS 5.9%CVE-2022-29117HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 5.7%CVE-2023-36435HIGHMicrosoft QUIC Denial of Service VulnerabilityEPSS 5.7%CVE-2026-20139MEDIUMClient-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk EnterpriseEPSS 5.7%CVE-2022-31129HIGHInefficient Regular Expression Complexity in momentEPSS 5.6%CVE-2022-29145HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 5.5%CVE-2026-44496HIGHAxios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionEPSS 5.4%CVE-2025-66959HIGHAn issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoderEPSS 5.3%CVE-2018-14629MEDIUMA denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead toEPSS 5.2%CVE-2021-31957MEDIUMASP.NET Core Denial of Service VulnerabilityEPSS 5.1%CVE-2018-12545—In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETEPSS 5.1%CVE-2021-3622—A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cEPSS 5.0%CVE-2019-5739—Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introducEPSS 4.9%CVE-2021-22904—The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token AuthentEPSS 4.9%CVE-2004-1464MEDIUMCisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafEPSS 4.8%KEV