Fallos del tipo CWE-400

3051 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2025-31245MEDIUMThe issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS SonoEPSS 0.2%CVE-2025-26500MEDIUMVxWorks 7 USB FailureEPSS 0.2%CVE-2023-28938LOWUncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentialEPSS 0.2%CVE-2026-42626MEDIUMHP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing).EPSS 0.2%CVE-2025-55559HIGHAn issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D.EPSS 0.2%CVE-2021-47371HIGHnexthop: Fix memory leaks in nexthop notification chain listenersEPSS 0.2%CVE-2026-12319MEDIUMDenial-of-service in the Audio/Video: Playback componentEPSS 0.2%CVE-2024-0581MEDIUMUncontrolled Resource Consumption vulnerability on Sandsprite scdbgEPSS 0.2%CVE-2021-21529LOWDell System Update (DSU) 1.9 and earlier versions contain a denial of service vulnerability. A local authenticated malicious user with low pEPSS 0.2%CVE-2022-26523MEDIUMThe socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to executeEPSS 0.2%CVE-2025-27250MEDIUMUncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow EPSS 0.2%CVE-2025-9308MEDIUMyarnpkg Yarn request-manager.js setOptions redosEPSS 0.2%CVE-2026-90441HIGHFireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant BEPSS 0.2%CVE-2025-27081MEDIUMHPE NonStop OSM Service Connection Suite, Denial of Service vulnerabilityEPSS 0.2%CVE-2025-11274MEDIUMOpen Asset Import Library Assimp Q3DLoader.cpp InternReadFile allocation of resourcesEPSS 0.2%CVE-2023-25769MEDIUMUncontrolled resource consumption in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated userEPSS 0.2%CVE-2022-3698MEDIUM A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and  Lenovo Diagnostics versEPSS 0.2%CVE-2022-0353MEDIUM A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and  Lenovo Diagnostics versEPSS 0.2%CVE-2023-25949MEDIUMUncontrolled resource consumption in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enEPSS 0.2%CVE-2025-29478MEDIUMAn issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165.EPSS 0.2%