Fallos del tipo CWE-400

2985 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2025-21231HIGHIP Helper Denial of Service VulnerabilityEPSS 2.6%CVE-2025-21251HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.6%CVE-2023-38178HIGH.NET Core and Visual Studio Denial of Service VulnerabilityEPSS 2.6%CVE-2025-21218HIGHWindows Kerberos Denial of Service VulnerabilityEPSS 2.6%CVE-2021-27385HIGHA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 2.6%CVE-2023-5870LOWPostgresql: role pg_signal_backend can signal certain superuser processes.EPSS 2.6%CVE-2017-15130—A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI confEPSS 2.6%CVE-2024-21342HIGHWindows DNS Client Denial of Service VulnerabilityEPSS 2.5%CVE-2025-21300HIGHWindows Universal Plug and Play (UPnP) Device Host Denial of Service VulnerabilityEPSS 2.5%CVE-2021-1312MEDIUMCisco Elastic Services Controller Denial of Service VulnerabilityEPSS 2.5%CVE-2018-8854—Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not properly restrict the size or amount of resources rEPSS 2.5%CVE-2024-38067HIGHWindows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityEPSS 2.5%CVE-2024-38068HIGHWindows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityEPSS 2.5%CVE-2024-38031HIGHWindows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityEPSS 2.5%CVE-2021-21317MEDIUMDenial of Service in uap-coreEPSS 2.5%CVE-2018-14660MEDIUMA flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authEPSS 2.5%CVE-2018-0372—A vulnerability in the DHCPv6 feature of the Cisco Nexus 9000 Series Fabric Switches in Application-Centric Infrastructure (ACI) Mode could EPSS 2.5%CVE-2026-27308LOWColdFusion | Uncontrolled Resource Consumption (CWE-400)EPSS 2.5%CVE-2020-24686HIGHAC500 V2 webserver denial of service vulnerabilityEPSS 2.5%CVE-2025-21351HIGHWindows Active Directory Domain Services API Denial of Service VulnerabilityEPSS 2.5%