Fallos del tipo CWE-400

3000 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2021-29430HIGHDenial of service attack via memory exhaustionEPSS 1.8%CVE-2023-27530HIGHA DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could alEPSS 1.8%CVE-2022-24294—ReDoS in Apache MXNet RTC ModuleEPSS 1.8%CVE-2022-3517HIGHA vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExEPSS 1.8%CVE-2022-35922HIGHMemory allocation based on untrusted length in rust-websocketEPSS 1.8%CVE-2023-35329MEDIUMWindows Authentication Denial of Service VulnerabilityEPSS 1.8%CVE-2021-32657MEDIUMMalicious user could break user administration pageEPSS 1.8%CVE-2022-40899HIGHAn issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-CookieEPSS 1.8%CVE-2025-32724HIGHWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 1.8%CVE-2023-52425HIGHlibexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large toEPSS 1.8%CVE-2023-6277MEDIUMLibtiff: out-of-memory in tiffopen via a craft fileEPSS 1.8%CVE-2021-21419MEDIUMImproper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventletEPSS 1.8%CVE-2020-8295—A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.EPSS 1.8%CVE-2019-1696HIGHCisco Firepower Threat Defense Software SMB Protocol Preprocessor Detection Engine Denial of Service VulnerabilitiesEPSS 1.8%CVE-2021-21254MEDIUMRegular expression Denial of Service in Markdown pluginEPSS 1.8%CVE-2014-2342—Triangle MicroWorks SCADA Data Gateway Resource ExhaustionEPSS 1.8%CVE-2026-45769HIGHikev2: unbounded client transform storage can lead to resource exhaustionEPSS 1.8%CVE-2020-3572HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Session Denial of Service VulnerabilityEPSS 1.8%CVE-2023-35298HIGHHTTP.sys Denial of Service VulnerabilityEPSS 1.8%CVE-2019-3874MEDIUMThe SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a dEPSS 1.8%