Fallos del tipo CWE-1050

17 resultados

Consumo excessivo de recursos da plataforma dentro de um loop

Ocorre quando um código aloca ou consome recursos (memória, conexões, descritores de arquivo, threads) repetidamente dentro de um loop sem liberação adequada ou controle de limite. A cada iteração, mais recursos são consumidos, levando a esgotamento progressivo até indisponibilidade do serviço ou crash da aplicação.

Ejemplo

Um servidor web que abre uma nova conexão com banco de dados a cada requisição dentro de um loop de processamento em lote, sem fechar a conexão anterior. Após centenas de iterações, todas as conexões disponíveis do pool estão esgotadas e novas requisições começam a falhar.

Cómo mitigar

Garanta que recursos sejam explicitamente liberados (ou reutilizados) ao fim de cada iteração do loop, usando padrões como try-finally, context managers ou connection pooling. Implemente limites máximos de iterações ou timeouts para detectar loops anormalmente longos.

CVE-2023-1390HIGHA remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknEPSS 5.1%CVE-2019-11254MEDIUMKubernetes API Server denial of service vulnerability from malicious YAML payloadsEPSS 3.1%CVE-2024-4068HIGHMemory Exhaustion in bracesEPSS 1.5%CVE-2021-41039In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excEPSS 1.3%CVE-2025-48866HIGHModSecurity has possible DoS vulnerability in sanitiseArg actionEPSS 0.8%CVE-2026-48779HIGHws: Memory exhaustion DoS from tiny fragments and data chunksEPSS 0.8%CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.7%CVE-2025-32907MEDIUMLibsoup: denial of service in server when client requests a large amount of overlapping ranges with range headerEPSS 0.7%CVE-2026-44390MEDIUMUnbounded name compression in certain cases causes degradation of serviceEPSS 0.6%CVE-2025-47947HIGHModSecurity Has Possible DoS VulnerabilityEPSS 0.6%CVE-2026-4634HIGHKeycloak: keycloak: denial of service via excessive processing of openid connect scope parametersEPSS 0.5%CVE-2026-81736HIGHRemote CPU denial of service through cached SVCB/HTTPS AliasMode treesEPSS 0.5%CVE-2026-22263MEDIUMSuricata http1: quadratic complexity in headers parsing over multiple packetsEPSS 0.4%CVE-2026-71488HIGHleague/commonmark: Quadratic-time denial of service when parsing crafted MarkdownEPSS 0.3%CVE-2025-67419HIGHA Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resEPSS 0.3%CVE-2026-22261LOWSuricata eve/alert: http1 xff handling can lead to denial of serviceEPSS 0.3%CVE-2026-52681LOWSieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedlyEPSS 0.3%