Weaknesses of type CWE-400

3,450 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2018-14827—Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially craftEPSS 3.8%CVE-2020-3566HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityEPSS 3.7%KEVCVE-2021-21240HIGHRegular Expression Denial of Service in httplib2EPSS 3.7%CVE-2021-21252MEDIUMRegular expression denial of service in jquery-validationEPSS 3.6%CVE-2025-5115HIGHMadeYouReset HTTP/2 vulnerabilityEPSS 3.6%CVE-2019-10977—In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could send crafted TCP packetsEPSS 3.5%CVE-2019-14232HIGHAn issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's charsEPSS 3.5%CVE-2022-24836HIGHInefficient Regular Expression Complexity in NokogiriEPSS 3.5%CVE-2022-21360MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions thEPSS 3.5%CVE-2025-21181HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 3.5%CVE-2023-5685HIGHXnio: stackoverflowexception when the chain of notifier states becomes problematically bigEPSS 3.5%CVE-2019-10953HIGHABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some conEPSS 3.5%CVE-2022-21299MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that EPSS 3.5%CVE-2022-24464HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 3.4%CVE-2009-2541HIGHThe web browser on the Sony PLAYSTATION 3 (PS3) allows remote attackers to cause a denial of service (memory consumption and console hang) vEPSS 3.4%CVE-2023-26048MEDIUMOutOfMemoryError for large multipart without filename in Eclipse JettyEPSS 3.4%CVE-2021-21285MEDIUMDocker daemon crash during image pull of malicious imageEPSS 3.3%CVE-2020-3569HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilitiesEPSS 3.3%KEVCVE-2020-15166HIGHDenial of Service in ZeroMQEPSS 3.3%CVE-2017-12741HIGHSpecially crafted packets sent to port 161/udp could cause a denial of service condition. The affected devices must be restarted manually.EPSS 3.3%