Fallos del tipo CWE-400

3026 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2026-55407MEDIUMBuffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded AllocationEPSS 0.8%CVE-2023-45874MEDIUMAn issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (outage of reader threads).EPSS 0.8%CVE-2024-21163MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 aEPSS 0.8%CVE-2026-33538HIGHParse Server: Denial of service via unindexed database query for unconfigured auth providersEPSS 0.8%CVE-2026-39865MEDIUMAxios HTTP/2 Session Cleanup State Corruption VulnerabilityEPSS 0.8%CVE-2020-19726—An issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data allows attackers to read or write to system memory oEPSS 0.8%CVE-2023-1787MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.1EPSS 0.8%CVE-2025-30681LOWVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-EPSS 0.8%CVE-2021-3679—A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace rEPSS 0.8%CVE-2026-38728HIGHAn issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream._write, lib/smtpEPSS 0.8%CVE-2026-55108HIGHKubeVela Terraform remote loader DoS via unbounded file readEPSS 0.8%CVE-2026-51788HIGHAn issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verification function and the accEPSS 0.8%CVE-2026-67861HIGHAn issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes componenEPSS 0.8%CVE-2024-24752MEDIUMBref Uploaded Files Not Deleted in Event-Driven FunctionsEPSS 0.8%CVE-2026-37237HIGHvLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio andEPSS 0.8%CVE-2023-51316HIGHA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Bus Reservation System v1.1 allows attackers to send an excessive amoEPSS 0.7%CVE-2023-51293HIGHA lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event Booking Calendar v4.0 allows attackers to senEPSS 0.7%CVE-2023-51301HIGHA lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excEPSS 0.7%CVE-2023-51314HIGHA lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Restaurant Booking System v3.0 allows attackers to EPSS 0.7%CVE-2025-1948HIGHEclipse Jetty HTTP clients can increase memory allocationEPSS 0.7%