Fallos del tipo CWE-400

3026 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2023-38200HIGHKeylime: registrar is subject to a dos against ssl connectionsEPSS 1.4%CVE-2022-36049HIGHFlux2 Helm Controller denial of serviceEPSS 1.4%CVE-2022-3283HIGHA potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 beEPSS 1.4%CVE-2024-24575HIGHlibgit2 is vulnerable to a denial of service attack in `git_revparse_single`EPSS 1.4%CVE-2023-27334HIGHSofting edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service VulnerabilityEPSS 1.4%CVE-2023-39180MEDIUMKernel: ksmbd: read request memory leak denial-of-service vulnerabilityEPSS 1.4%CVE-2024-22201HIGHJetty connection leaking on idle timeout when TCP congestedEPSS 1.4%CVE-2020-3528HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software OSPFv2 Link-Local Signaling Denial of Service VulnerabilityEPSS 1.4%CVE-2021-34792HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Resource Exhaustion Denial of Service VulnerabilityEPSS 1.4%CVE-2022-27194—A vulnerability has been identified in SIMATIC PCS neo (Administration Console) (All versions < V3.1 SP1), SINETPLAN (All versions), TIA PorEPSS 1.4%CVE-2022-43766HIGHApache IoTDB prior to 0.13.3 allows DoSEPSS 1.4%CVE-2022-36064MEDIUMShescape Inefficient Regular Expression Complexity vulnerabilityEPSS 1.4%CVE-2021-32723HIGHRegular Expression Denial of Service (ReDoS) in PrismEPSS 1.4%CVE-2022-41404HIGHAn issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (EPSS 1.4%CVE-2023-40584MEDIUMDenial of Service to Argo CD repo-server EPSS 1.4%CVE-2020-3560HIGHCisco Aironet Access Points UDP Flooding Denial of Service VulnerabilityEPSS 1.4%CVE-2020-3563HIGHCisco Firepower Threat Defense Software TCP Flood Denial of Service VulnerabilityEPSS 1.4%CVE-2025-53645HIGHZimbra Collaboration (ZCS) before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 is vulnerable to a denial of service condiEPSS 1.4%CVE-2023-0662HIGHDoS vulnerability when parsing multipart request bodyEPSS 1.4%CVE-2021-29506MEDIUMNavigate endpoint is vulnerable to regex injection that may lead to Denial of Service.EPSS 1.4%