Fallos del tipo CWE-400

3000 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2023-22792HIGHA regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination EPSS 1.7%CVE-2021-20237—An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remoEPSS 1.7%CVE-2019-10162LOWA vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the serveEPSS 1.7%CVE-2017-6043—A Resource Consumption issue was discovered in Trihedral VTScada Versions prior to 11.2.26. The client does not properly validate the input EPSS 1.7%CVE-2018-16469—The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These pEPSS 1.7%CVE-2021-41167HIGHUnlimited requests in modern-asyncEPSS 1.7%CVE-2021-3690—A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attackEPSS 1.7%CVE-2019-19281—A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V2.5 and < VEPSS 1.7%CVE-2021-29469MEDIUMPotential exponential regex in monitor modeEPSS 1.7%CVE-2021-31409HIGHServer session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19EPSS 1.7%CVE-2023-46104MEDIUMApache Superset: Allows for uncontrolled resource consumption via a ZIP bombEPSS 1.7%CVE-2021-21391MEDIUMRegular expression Denial of Service in multiple packagesEPSS 1.7%CVE-2020-15783HIGHA vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC TDC EPSS 1.7%CVE-2025-26677HIGHWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 1.7%CVE-2017-16116—The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of serviceEPSS 1.7%CVE-2017-16098—charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down oEPSS 1.7%CVE-2022-31018HIGHDenial of service binding form from JSON in Play FrameworkEPSS 1.7%CVE-2021-41145HIGHFreeSWITCH susceptible to Denial of Service via SIP floodingEPSS 1.7%CVE-2021-29471LOWDenial of service in Matrix SynapseEPSS 1.6%CVE-2019-1672MEDIUMCisco Web Security Appliance Decryption Policy Bypass VulnerabilityEPSS 1.6%