Weaknesses of type CWE-400

3,034 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2025-6493MEDIUMCodeMirror Markdown Mode markdown.js redosEPSS 0.5%CVE-2026-8968HIGHDenial-of-service due to invalid pointer in the Audio/Video: Web Codecs componentEPSS 0.5%CVE-2026-37234HIGHFlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disconnect, only the firEPSS 0.5%CVE-2026-74982HIGHDenial-of-service in the Widget componentEPSS 0.5%CVE-2026-92361MEDIUMag-ui-protocol ag-ui SSE Client client.go resource consumptionEPSS 0.5%CVE-2026-85718MEDIUMAsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of serviceEPSS 0.5%CVE-2024-4557MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.5%CVE-2026-93307MEDIUMO-RAN-SC SMO OAM VES Collector memory allocationEPSS 0.5%CVE-2026-90878MEDIUMvllm-project vLLM Jinja Template Rendering completions resource consumptionEPSS 0.5%CVE-2020-9060—Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZENEPSS 0.5%CVE-2026-88932MEDIUMmulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsEPSS 0.5%CVE-2026-33235HIGHAutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating featuresEPSS 0.5%CVE-2025-56572HIGHAn issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.EPSS 0.5%CVE-2026-12523HIGHResource exhaustion in quiche HTTP/3 and QPACK layersEPSS 0.5%CVE-2023-44388HIGHMalicious requests can fill up the log files resulting in a deinal of service in DiscourseEPSS 0.5%CVE-2025-31210MEDIUMThe issue was addressed with improved UI. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. Processing web content may lead toEPSS 0.5%CVE-2025-32392HIGHAutoGPT has a DoS vulnerability in LoopVideoBlockEPSS 0.5%CVE-2025-2820MEDIUMDenial of ServiceEPSS 0.5%CVE-2017-12190—The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/OEPSS 0.5%CVE-2025-6492MEDIUMMarkText index.js getRecommendTitleFromMarkdownString redosEPSS 0.5%