Fallos del tipo CWE-400

3026 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2021-41119MEDIUMDoS vulnerabiliity in wire-server json parserEPSS 1.4%CVE-2019-19301HIGHA vulnerability has been identified in SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X2EPSS 1.4%CVE-2019-10942—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sEPSS 1.4%CVE-2025-29954MEDIUMWindows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityEPSS 1.4%CVE-2020-14384—A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulEPSS 1.4%CVE-2023-39321—Panic when processing post-handshake message on QUIC connections in crypto/tlsEPSS 1.4%CVE-2022-21689HIGHDenial of Service in OnionshareEPSS 1.3%CVE-2020-11645MEDIUMGateManager Denial of Service VulnerabilityEPSS 1.3%CVE-2017-16021—uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or notEPSS 1.3%CVE-2016-10544—uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is aEPSS 1.3%CVE-2021-32722MEDIUMUncontrolled Resource Consumption in GlobalNewFilesEPSS 1.3%CVE-2021-3629—A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead EPSS 1.3%CVE-2021-39171MEDIUMUnlimited transforms allowed for signed nodesEPSS 1.3%CVE-2019-0059HIGHJunos OS: The routing protocol process (rpd) may crash and generate core files upon receipt of specific valid BGP states from a peered host.EPSS 1.3%CVE-2023-34458HIGHmx-chain-go's relayed transactions always increment nonceEPSS 1.3%CVE-2020-3190MEDIUMCisco IOS XR Software IPsec Packet Processor Denial of Service VulnerabilityEPSS 1.3%CVE-2021-22882—UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi ProtecEPSS 1.3%CVE-2001-0827HIGHCerberus FTP server 1.0 - 1.5 allows remote attackers to cause a denial of service (crash) via a large number of "PASV" requests.EPSS 1.3%CVE-2024-47554MEDIUMApache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReaderEPSS 1.3%CVE-2023-3637MEDIUMOpenstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)EPSS 1.3%