Weaknesses of type CWE-400

3,034 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2024-42981HIGHTenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulneEPSS 0.6%CVE-2026-26477MEDIUMAn issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() functEPSS 0.6%CVE-2026-85703MEDIUMramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resourcesEPSS 0.6%CVE-2025-41676MEDIUMResource Exhaustion via POST Requests to send-sms ActionEPSS 0.6%CVE-2024-8451HIGHPLANET Technology switch devices - SSH server DoS attackEPSS 0.6%CVE-2023-42358HIGHAn issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial ofEPSS 0.6%CVE-2026-16818HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2026-16831HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2026-9171HIGHVulnerabilities in IBM WebSphere Application affects IBM PowerVM Novalink.EPSS 0.5%CVE-2026-17121HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2026-16824HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2026-23842HIGHChatterBot has Denial of Service via Database Connection Pool ExhaustionEPSS 0.5%CVE-2026-36478HIGHAn issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServeEPSS 0.5%CVE-2026-16836HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2026-16690HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2023-1206—A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind ofEPSS 0.5%CVE-2025-31118HIGHNamelessMC Has Forum Reply Submission Time Limit BypassEPSS 0.5%CVE-2026-86734HIGHSnipe-IT before 8.7.1 Denial of Service via Unbounded Note FieldEPSS 0.5%CVE-2026-73559MEDIUMvLLM: Completion prompt lists fan out into unbounded engine requestsEPSS 0.5%CVE-2025-30158HIGHNamelessMC Forum iframe width/height abuse causing UI-based Denial of ServiceEPSS 0.5%