Fallos del tipo CWE-400

3026 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2026-34665HIGHCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.9%CVE-2026-71360HIGHCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.9%CVE-2026-34649HIGHAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 0.9%CVE-2026-34713HIGHCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.9%CVE-2023-40180HIGHDenial of service vulnerability in silverstripe-graphql via recursive queriesEPSS 0.9%CVE-2026-59942MEDIUMDompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image BitmapsEPSS 0.9%CVE-2024-21013MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 aEPSS 0.9%CVE-2024-21008MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 aEPSS 0.9%CVE-2024-34506HIGHAn issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1.EPSS 0.9%CVE-2026-49361HIGHApache Fluss Netty Frame Decoder Memory Exhaustion VulnerabilityEPSS 0.9%CVE-2021-37865MEDIUMServer-side Denial of Service while processing a specifically crafted GIF fileEPSS 0.9%CVE-2026-5497HIGHUnbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllmEPSS 0.9%CVE-2026-8187MEDIUMOpen5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumptionEPSS 0.9%CVE-2022-23023—On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ alEPSS 0.9%CVE-2024-21203MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.39 and priEPSS 0.9%CVE-2021-22956—An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attackerEPSS 0.9%CVE-2026-42154HIGHPrometheus: remote read endpoint allows denial of service via crafted snappy payloadEPSS 0.9%CVE-2019-10972—Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability can be triggered when an attacker provides the target withEPSS 0.9%CVE-2023-31006MEDIUMIBM Security Access Manager Container denial of serviceEPSS 0.9%CVE-2024-28717MEDIUMAn issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.EPSS 0.9%