Fallos del tipo CWE-400

3051 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2021-47329MEDIUMscsi: megaraid_sas: Fix resource leak in case of probe failureEPSS 0.3%CVE-2026-48434MEDIUMCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.3%CVE-2026-47905MEDIUMCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.3%CVE-2026-34678MEDIUMCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.3%CVE-2026-47904MEDIUMCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.3%CVE-2022-28191MEDIUMNVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be triggerEPSS 0.3%CVE-2026-48357MEDIUMCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.3%CVE-2026-23809MEDIUMMAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic RedirectionEPSS 0.3%CVE-2026-47902MEDIUMCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.3%CVE-2026-48443MEDIUMCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.3%CVE-2025-8449MEDIUMCWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specEPSS 0.3%CVE-2026-34677MEDIUMCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.3%CVE-2021-47313HIGHcpufreq: CPPC: Fix potential memleak in cppc_cpufreq_cpu_initEPSS 0.3%CVE-2026-100542LOWOpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2EPSS 0.3%CVE-2025-54149MEDIUMQsync CentralEPSS 0.3%CVE-2025-37148MEDIUMKernel Panic triggered by Modified Ethernet Frames leads to Denial of Service VulnerabilityEPSS 0.3%CVE-2021-47010HIGHnet: Only allow init netns to set default tcp cong to a restricted algoEPSS 0.3%CVE-2024-44183MEDIUMA logic error was addressed with improved error handling. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS SequoEPSS 0.3%CVE-2025-54150MEDIUMQsync CentralEPSS 0.3%CVE-2025-54151MEDIUMQsync CentralEPSS 0.3%