Fallos del tipo CWE-400

3450 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2021-33580—regex injection leading to DoSEPSS 3.3%CVE-2017-15119MEDIUMThe Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a cEPSS 3.3%CVE-2021-20609HIGHUncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EPSS 3.3%CVE-2020-27827HIGHA flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to hanEPSS 3.2%CVE-2022-21366MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions thEPSS 3.2%CVE-2021-4040—A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) conEPSS 3.2%CVE-2014-5418—GE Multilink Uncontrolled Resource ConsumptionEPSS 3.2%CVE-2026-25667HIGHASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumptEPSS 3.2%CVE-2018-6922—One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-pEPSS 3.2%CVE-2022-1708—A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSEPSS 3.2%CVE-2018-10607—Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow the creation of new connections to one or more EPSS 3.2%CVE-2017-15132—A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client usEPSS 3.1%CVE-2022-21277MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions thEPSS 3.1%CVE-2024-21392HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 3.1%CVE-2018-16853HIGHSamba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-defaultEPSS 3.1%CVE-2023-24860HIGHMicrosoft Defender Denial of Service VulnerabilityEPSS 3.1%CVE-2018-16492—A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto OEPSS 3.0%CVE-2022-31028HIGHPossible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIOEPSS 3.0%CVE-2026-33623MEDIUMPinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command ExecutionEPSS 3.0%CVE-2024-26190HIGHMicrosoft QUIC Denial of Service VulnerabilityEPSS 3.0%