Fallos del tipo CWE-1050

20 resultados

Consumo excessivo de recursos da plataforma dentro de um loop

Ocorre quando um código aloca ou consome recursos (memória, conexões, descritores de arquivo, threads) repetidamente dentro de um loop sem liberação adequada ou controle de limite. A cada iteração, mais recursos são consumidos, levando a esgotamento progressivo até indisponibilidade do serviço ou crash da aplicação.

Ejemplo

Um servidor web que abre uma nova conexão com banco de dados a cada requisição dentro de um loop de processamento em lote, sem fechar a conexão anterior. Após centenas de iterações, todas as conexões disponíveis do pool estão esgotadas e novas requisições começam a falhar.

Cómo mitigar

Garanta que recursos sejam explicitamente liberados (ou reutilizados) ao fim de cada iteração do loop, usando padrões como try-finally, context managers ou connection pooling. Implemente limites máximos de iterações ou timeouts para detectar loops anormalmente longos.

CVE-2023-1390HIGHA remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknEPSS 5.1%CVE-2019-11254MEDIUMKubernetes API Server denial of service vulnerability from malicious YAML payloadsEPSS 3.2%CVE-2024-4068HIGHMemory Exhaustion in bracesEPSS 1.5%CVE-2026-48779HIGHws: Memory exhaustion DoS from tiny fragments and data chunksEPSS 1.4%CVE-2021-41039—In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excEPSS 1.4%CVE-2025-48866HIGHModSecurity has possible DoS vulnerability in sanitiseArg actionEPSS 0.9%CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.7%CVE-2025-32907MEDIUMLibsoup: denial of service in server when client requests a large amount of overlapping ranges with range headerEPSS 0.7%CVE-2026-44390MEDIUMUnbounded name compression in certain cases causes degradation of serviceEPSS 0.6%CVE-2026-4634HIGHKeycloak: keycloak: denial of service via excessive processing of openid connect scope parametersEPSS 0.6%CVE-2026-71488HIGHleague/commonmark: Quadratic-time denial of service when parsing crafted MarkdownEPSS 0.6%CVE-2025-47947HIGHModSecurity Has Possible DoS VulnerabilityEPSS 0.6%CVE-2026-81736HIGHRemote CPU denial of service through cached SVCB/HTTPS AliasMode treesEPSS 0.6%CVE-2026-100350MEDIUMkin-openapi deepObject query decoding repeatedly compiles an invariant regular expressionEPSS 0.5%CVE-2026-22263MEDIUMSuricata http1: quadratic complexity in headers parsing over multiple packetsEPSS 0.4%CVE-2026-85977MEDIUMLibtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decodingEPSS 0.4%CVE-2026-22261LOWSuricata eve/alert: http1 xff handling can lead to denial of serviceEPSS 0.4%CVE-2025-67419HIGHA Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resEPSS 0.3%CVE-2026-52681LOWSieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedlyEPSS 0.3%CVE-2026-94287MEDIUMDenial of service via unsigned underflow in libXpm's write pathEPSS 0.1%