Fallos del tipo CWE-400

3039 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2026-27852HIGHAn attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parametersEPSS 0.4%CVE-2024-14033HIGHHirschmann EagleSDV Denial of Service via TLSEPSS 0.4%CVE-2026-86347HIGHMISP Missing Authorization on Template File Upload Allows Authenticated Disk ExhaustionEPSS 0.4%CVE-2020-3508HIGHCisco IOS XE Software for Cisco ASR 1000 Series 20-Gbps Embedded Services Processor IP ARP Denial of Service VulnerabilityEPSS 0.4%CVE-2026-21435MEDIUMwebtransport-go CloseWithError can block indefinitelyEPSS 0.4%CVE-2026-10650MEDIUMwarmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumptionEPSS 0.4%CVE-2025-53050HIGHVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions thEPSS 0.4%CVE-2025-32437HIGHAutoGPT has a DoS vulnerability in MediaDurationBlockEPSS 0.4%CVE-2026-19507HIGHRDK WebUI uncontrolled resource consumptionEPSS 0.4%CVE-2026-2891HIGHPoly Voice Devices (CCX, Trio, Edge E) – Potential Denial of ServiceEPSS 0.4%CVE-2026-66920HIGHPivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph DataEPSS 0.4%CVE-2026-84235HIGHRockwell Automation 1756-ENBT Denial of Service VulnerabilityEPSS 0.4%CVE-2026-53530HIGHratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)EPSS 0.4%CVE-2025-32424HIGHAutoGPT has a DoS vulnerability in ScreenshotWebPageBlockEPSS 0.4%CVE-2025-32422HIGHAutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlockEPSS 0.4%CVE-2026-66913MEDIUMZip Bomb in Lookyloo Capture Upload Allows Denial of ServiceEPSS 0.4%CVE-2025-5031LOWAckites KillWxapkg wxapkg File Decompression resource consumptionEPSS 0.4%CVE-2026-40016MEDIUMAttacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 EPSS 0.4%CVE-2025-58369MEDIUMfs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite sideEPSS 0.4%CVE-2026-53531MEDIUMratex-parser has unbounded parser recursion that leads to stack overflow (process abort)EPSS 0.4%