Fallos del tipo CWE-400

2995 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2020-8277—A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versiEPSS 54.2%CVE-2021-28165HIGHIn Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invaEPSS 53.9%CVE-2026-49160HIGHHTTP.sys Denial of Service VulnerabilityEPSS 53.8%CVE-2022-31698MEDIUMThe vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port EPSS 47.8%CVE-2024-5011HIGHWhatsUp Gold TestController Chart denial of service vulnerabilityEPSS 47.1%CVE-2018-16843MEDIUMnginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption.EPSS 47.1%CVE-2020-2039MEDIUMPAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file uploadEPSS 46.4%CVE-2019-5645HIGHRapid7 Metasploit HTTP Handler Denial of ServiceEPSS 41.7%CVE-2018-12122—Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial EPSS 41.3%CVE-2026-28318HIGHSolarWinds Serv-U Unauthenticated Denial of Service VulnerabilityEPSS 40.0%KEVCVE-2016-8610—A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processiEPSS 39.7%CVE-2017-6019—An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid EPSS 36.9%CVE-2018-5391—The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packetsEPSS 32.4%CVE-2016-8858HIGHThe kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consEPSS 29.5%CVE-2026-0599HIGHUnbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inferenceEPSS 28.2%CVE-2019-9517HIGHSome HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of serviceEPSS 27.9%CVE-2023-23590HIGHMercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated EPSS 26.4%CVE-2019-9518HIGHSome HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of serviceEPSS 25.4%CVE-2026-34648HIGHAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 22.6%CVE-2025-53722HIGHWindows Remote Desktop Services Denial of Service VulnerabilityEPSS 22.3%