Fallos del tipo CWE-400

3000 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2023-32013MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 1.6%CVE-2022-31173HIGHJuniper is vulnerable to @DOS GraphQL Nested Fragments overflowEPSS 1.6%CVE-2022-40150MEDIUMStack Buffer Overflow in JettisonEPSS 1.6%CVE-2025-13836MEDIUMExcessive read buffering DoS in http.clientEPSS 1.6%CVE-2022-35923HIGHInefficient Regular Expression Complexity in v8nEPSS 1.6%CVE-2019-19343—A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener dueEPSS 1.6%CVE-2022-31073MEDIUMKubeEdge Edge ServiceBus module DoSEPSS 1.6%CVE-2022-44570—A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range headEPSS 1.6%CVE-2022-3204HIGHNRDelegation AttackEPSS 1.6%CVE-2021-32832MEDIUMReDOS in Rocket.ChatEPSS 1.6%CVE-2022-44572—A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an aEPSS 1.6%CVE-2024-26141MEDIUMPossible DoS Vulnerability with Range Header in RackEPSS 1.6%CVE-2022-24741LOWHigh memory usage in Nextcloud serverEPSS 1.6%CVE-2023-23009MEDIUMLibreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrEPSS 1.6%CVE-2022-31110MEDIUMDenial of Service (DoS) vulnerability in RSSHubEPSS 1.6%CVE-2021-29509HIGHKeepalive Connections Causing Denial Of Service in pumaEPSS 1.6%CVE-2023-5724HIGHDrivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability afEPSS 1.6%CVE-2016-10527—The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditionsEPSS 1.6%CVE-2022-20760HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software DNS Inspection Denial of Service VulnerabilityEPSS 1.6%CVE-2022-24726HIGHUnauthenticated control plane denial of service attack in IstioEPSS 1.6%