Fallos del tipo CWE-400

3026 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2017-16136—method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesEPSS 1.2%CVE-2020-15114HIGHDenial of Service in etcdEPSS 1.2%CVE-2018-1107—It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to havEPSS 1.2%CVE-2023-49295MEDIUMquic-go's path validation mechanism can cause denial of serviceEPSS 1.2%CVE-2020-14297MEDIUMA flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumEPSS 1.2%CVE-2026-72923HIGHMicrosoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansionEPSS 1.2%CVE-2024-41989HIGHAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory cEPSS 1.2%CVE-2019-15584—A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fieldsEPSS 1.2%CVE-2022-48474HIGHControl de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Sending a malicious requeEPSS 1.2%CVE-2020-1600MEDIUMJunos OS: A specific SNMP command can trigger a high CPU usage Denial of Service in the RPD daemon.EPSS 1.2%CVE-2024-41946MEDIUMREXML DoS vulnerabilityEPSS 1.2%CVE-2026-55450CRITICALLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leakEPSS 1.2%CVE-2022-39278HIGHIstio vulnerable to denial of service attack due to Golang Regex LibraryEPSS 1.2%CVE-2021-1489MEDIUMCisco Firepower Device Manager Software Filesystem Space Exhaustion Denial of Service VulnerabilityEPSS 1.2%CVE-2021-41229MEDIUMMemory leak in BlueZEPSS 1.2%CVE-2017-7935—A Resource Exhaustion issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may compromise the dEPSS 1.2%CVE-2024-1765MEDIUMUnlimited resource allocation by QUIC CRYPTO frames flooding in quicheEPSS 1.2%CVE-2021-32617MEDIUMDenial of service in Exiv2EPSS 1.2%CVE-2026-50653HIGHAzure Active Directory Denial of Service VulnerabilityEPSS 1.2%CVE-2026-49160HIGHHTTP.sys Denial of Service VulnerabilityEPSS 1.2%