Fallos del tipo CWE-400

2985 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2025-21290HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.4%CVE-2023-36431HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.4%CVE-2025-21289HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.4%CVE-2023-36579HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.4%CVE-2020-26257MEDIUMDenial of service attack via incorrect parameters to federation APIsEPSS 2.4%CVE-2026-34473HIGHUnauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A, EPSS 2.4%CVE-2022-35769HIGHWindows Point-to-Point Protocol (PPP) Denial of Service VulnerabilityEPSS 2.4%CVE-2020-5236MEDIUMCatastrophic backtracking in regex allows Denial of Service in WaitressEPSS 2.4%CVE-2021-32839HIGHRegular Expression Denial of Service in sqlparseEPSS 2.3%CVE-2018-1114MEDIUMIt was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file deEPSS 2.3%CVE-2024-43541HIGHMicrosoft Simple Certificate Enrollment Protocol Denial of Service VulnerabilityEPSS 2.3%CVE-2016-8611MEDIUMA vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST EPSS 2.3%CVE-2024-43506HIGHBranchCache Denial of Service VulnerabilityEPSS 2.3%CVE-2024-43575HIGHWindows Hyper-V Denial of Service VulnerabilityEPSS 2.3%CVE-2024-7592HIGHQuadratic complexity parsing cookies with backslashesEPSS 2.3%CVE-2024-38236HIGHDHCP Server Service Denial of Service VulnerabilityEPSS 2.3%CVE-2019-1644HIGHCisco IoT Field Network Director Resource Exhaustion Denial of Service VulnerabilityEPSS 2.3%CVE-2018-0086—A vulnerability in the application server of the Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker tEPSS 2.3%CVE-2006-6017MEDIUMWordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authEPSS 2.3%CVE-2024-43515HIGHInternet Small Computer Systems Interface (iSCSI) Denial of Service VulnerabilityEPSS 2.3%