Weaknesses of type CWE-400

3,026 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2023-28644MEDIUMReference fetch can saturate the server bandwidth for 10 seconds in nextcloud serverEPSS 0.6%CVE-2024-10912HIGHDenial of Service in lm-sys/fastchatEPSS 0.6%CVE-2025-3016MEDIUMOpen Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumptionEPSS 0.6%CVE-2026-9071HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource ConsumptionEPSS 0.6%CVE-2025-3985MEDIUMApereo CAS ResponseEntity redosEPSS 0.6%CVE-2023-37900LOWCrossplane vulnerable to denial of service from large imageEPSS 0.6%CVE-2025-65518HIGHPlesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_pasEPSS 0.6%CVE-2024-23814MEDIUMThe integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receivingEPSS 0.6%CVE-2024-26369HIGHAn issue in the HistoryQosPolicy component of FastDDS v2.12.x, v2.11.x, v2.10.x, and v2.6.x leads to a SIGABRT (signal abort) upon receivingEPSS 0.6%CVE-2026-61387MEDIUMIn Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an uncheckeEPSS 0.6%CVE-2026-59936HIGHpypdf: Possible infinite loop for not terminated inline imagesEPSS 0.6%CVE-2026-59937MEDIUMpypdf: Possible long runtimes for repeated malformed cross-reference entriesEPSS 0.6%CVE-2026-20652HIGHThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOSEPSS 0.6%CVE-2023-6180MEDIUMResource exhaustion via memory leak in tokio-boringEPSS 0.6%CVE-2026-55241HIGHCheckmate: Pre-auth Denial of Service via File Upload on RegistrationEPSS 0.6%CVE-2025-3112HIGHCWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user sendEPSS 0.6%CVE-2022-38734—StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successEPSS 0.6%CVE-2024-56200HIGHUncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxyEPSS 0.6%CVE-2026-59885HIGHpyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceEPSS 0.6%CVE-2025-32472MEDIUMDoS attack by conducting a slowloris-type attackEPSS 0.6%