Fallos del tipo CWE-400

3007 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2021-21369MEDIUMPotential DoS in Besu HTTP JSON-RPC APIEPSS 1.5%CVE-2021-1378MEDIUMCisco StarOS Denial of Service VulnerabilityEPSS 1.5%CVE-2019-13926—A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCAEPSS 1.5%CVE-2025-25293HIGHruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responsesEPSS 1.5%CVE-2020-8136—Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests bEPSS 1.5%CVE-2021-47295HIGHnet: sched: fix memory leak in tcindex_partial_destroy_workEPSS 1.5%CVE-2024-39908MEDIUMDenial of service in REXMLEPSS 1.5%CVE-2020-14522HIGHSofting Industrial Automation OPCEPSS 1.5%CVE-2020-29490HIGHDell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS expEPSS 1.5%CVE-2018-16486—A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prEPSS 1.5%CVE-2024-4068HIGHMemory Exhaustion in bracesEPSS 1.5%CVE-2018-6335HIGHA Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. TEPSS 1.5%CVE-2020-27295—The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on theEPSS 1.5%CVE-2021-21236MEDIUMRegular Expression Denial of Service in CairoSVGEPSS 1.5%CVE-2019-13946HIGHProfinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic packagEPSS 1.5%CVE-2022-39158MEDIUMA vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,EPSS 1.5%CVE-2017-16023—Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressEPSS 1.5%CVE-2023-26144MEDIUMVersions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OvEPSS 1.5%CVE-2018-3767—`memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.EPSS 1.5%CVE-2019-13925—A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCAEPSS 1.5%