Weaknesses of type CWE-400

3,000 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2021-3733—There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as webEPSS 4.7%CVE-2023-1992MEDIUMRPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture fiEPSS 4.6%CVE-2024-34750HIGHApache Tomcat: HTTP/2 excess header handling DoSEPSS 4.6%CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2023-38149HIGHWindows TCP/IP Denial of Service VulnerabilityEPSS 4.5%CVE-2021-22880—The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulneraEPSS 4.4%CVE-2019-11287MEDIUMRabbitMQ Web Management Plugin DoS via heap overflowEPSS 4.4%CVE-2019-6535HIGHMitsubishi Electric MELSEC-Q Series PLCs Resource ExhaustionEPSS 4.3%CVE-2017-9627—An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prEPSS 4.1%CVE-2018-0410—A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, rEPSS 4.1%CVE-2025-59465HIGHA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` erEPSS 4.0%CVE-2022-38013HIGH.NET Core and Visual Studio Denial of Service VulnerabilityEPSS 4.0%CVE-2018-0418—A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software coulEPSS 4.0%CVE-2020-3304HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Denial of Service VulnerabilityEPSS 3.9%CVE-2017-7521—OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks aEPSS 3.9%CVE-2023-23396MEDIUMMicrosoft Excel Denial of Service VulnerabilityEPSS 3.8%CVE-2018-14827—Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially craftEPSS 3.8%CVE-2023-36478HIGHHTTP/2 HPACK integer overflow and buffer allocationEPSS 3.8%CVE-2020-3566HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityEPSS 3.7%KEVCVE-2021-21240HIGHRegular Expression Denial of Service in httplib2EPSS 3.6%