Fallos del tipo CWE-400

2982 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2021-3733—There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as webEPSS 4.7%CVE-2023-1992MEDIUMRPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture fiEPSS 4.6%CVE-2024-34750HIGHApache Tomcat: HTTP/2 excess header handling DoSEPSS 4.6%CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2023-38149HIGHWindows TCP/IP Denial of Service VulnerabilityEPSS 4.5%CVE-2021-22880—The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulneraEPSS 4.4%CVE-2019-11287MEDIUMRabbitMQ Web Management Plugin DoS via heap overflowEPSS 4.4%CVE-2019-6535HIGHMitsubishi Electric MELSEC-Q Series PLCs Resource ExhaustionEPSS 4.3%CVE-2017-9627—An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prEPSS 4.1%CVE-2018-0410—A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, rEPSS 4.1%CVE-2025-59465HIGHA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` erEPSS 4.0%CVE-2022-38013HIGH.NET Core and Visual Studio Denial of Service VulnerabilityEPSS 4.0%CVE-2018-0418—A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software coulEPSS 4.0%CVE-2020-3304HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Denial of Service VulnerabilityEPSS 3.9%CVE-2017-7521—OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks aEPSS 3.9%CVE-2023-23396MEDIUMMicrosoft Excel Denial of Service VulnerabilityEPSS 3.8%CVE-2018-14827—Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially craftEPSS 3.8%CVE-2023-36478HIGHHTTP/2 HPACK integer overflow and buffer allocationEPSS 3.8%CVE-2020-3566HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityEPSS 3.7%KEVCVE-2021-21240HIGHRegular Expression Denial of Service in httplib2EPSS 3.6%