Fallos del tipo CWE-400

3003 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2018-16487—A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into EPSS 1.6%CVE-2026-23869HIGHA denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-serverEPSS 1.6%CVE-2023-23552HIGHBIG-IP Advanced WAF and ASM vulnerabilityEPSS 1.5%CVE-2024-20965MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 aEPSS 1.5%CVE-2023-39477HIGHInductive Automation Ignition ConditionRefresh Resource Exhaustion Denial-of-Service VulnerabilityEPSS 1.5%CVE-2020-26256MEDIUMDenial of service in fast-csvEPSS 1.5%CVE-2022-36083MEDIUMJOSE vulnerable to resource exhaustion via specifically crafted JWEEPSS 1.5%CVE-2021-20298—A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhauEPSS 1.5%CVE-2021-40406HIGHA denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102. A specEPSS 1.5%CVE-2019-1965HIGHCisco NX-OS Software Remote Management Memory Leak Denial of Service VulnerabilityEPSS 1.5%CVE-2019-15593—GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attEPSS 1.5%CVE-2021-21235MEDIUMInfinite loop in parsing PNG files inEPSS 1.5%CVE-2019-12714MEDIUMCisco IC3000 Industrial Compute Gateway Denial of Service VulnerabilityEPSS 1.5%CVE-2024-53299MEDIUMApache Wicket: An attacker can intentionally trigger a memory leakEPSS 1.5%CVE-2024-24762HIGHpython-multipart vulnerable to content-type header Regular expression Denial of ServiceEPSS 1.5%CVE-2017-16113—The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.EPSS 1.5%CVE-2020-3132MEDIUMCisco Email Security Appliance Shortened URL Denial of Service VulnerabilityEPSS 1.5%CVE-2022-29243MEDIUMImproper input-size validation on the user new session name in Nextcloud ServerEPSS 1.5%CVE-2022-44571—There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. EPSS 1.5%CVE-2021-21369MEDIUMPotential DoS in Besu HTTP JSON-RPC APIEPSS 1.5%