Fallos del tipo CWE-400

3026 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2022-1259—A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial EPSS 1.3%CVE-2021-1460MEDIUMCisco IOx Application Framework Denial of Service VulnerabilityEPSS 1.3%CVE-2023-30798HIGHMultipartParser DOS with too many fields or files in Starlette FrameworkEPSS 1.3%CVE-2021-25909HIGHZIV AUTOMATION 4CCT Denial of Service vulnerabilityEPSS 1.3%CVE-2023-35945HIGHEnvoy vulnerable to HTTP/2 memory leak in nghttp2 codecEPSS 1.3%CVE-2021-42521—There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't cheEPSS 1.3%CVE-2014-10064—The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply neEPSS 1.3%CVE-2019-5445—DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.EPSS 1.3%CVE-2024-41123MEDIUMREXML DoS vulnerabilityEPSS 1.3%CVE-2020-36620LOWBrondahl EnumStringValues EnumExtensions.cs GetStringValuesWithPreferences_Uncache resource consumptionEPSS 1.3%CVE-2021-39295HIGHIn OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface.EPSS 1.3%CVE-2022-32508HIGHAn issue was discovered on certain Nuki Home Solutions devices. By sending a malformed HTTP verb, it is possible to force a reboot of the deEPSS 1.3%CVE-2024-32007HIGHApache CXF Denial of Service vulnerability in JOSEEPSS 1.3%CVE-2020-7507—A CWE-400: Uncontrolled Resource Consumption vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an atEPSS 1.3%CVE-2023-47633HIGHUncontrolled Resource Consumption in TraefikEPSS 1.3%CVE-2020-25242—A vulnerability has been identified in SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Lean (inclEPSS 1.3%CVE-2026-45498MEDIUMMicrosoft Defender Denial of Service VulnerabilityEPSS 1.3%KEVCVE-2022-44566HIGHA denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 6EPSS 1.3%CVE-2022-22556LOWDell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface. A remote unauthenticated attacker EPSS 1.3%CVE-2025-54472HIGHApache bRPC: Redis Parser Remote Denial of ServiceEPSS 1.3%