Fallos del tipo CWE-400

2982 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2026-33623MEDIUMPinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command ExecutionEPSS 2.9%CVE-2024-20672HIGH.NET Denial of Service VulnerabilityEPSS 2.9%CVE-2019-1703HIGHCisco Firepower Threat Defense Software Packet Processing Denial of Service VulnerabilityEPSS 2.9%CVE-2018-0048HIGHJunos OS: Memory exhaustion denial of service vulnerability in Routing Protocols Daemon (RPD) with Juniper Extension Toolkit (JET) support.EPSS 2.9%CVE-2024-49096HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.9%CVE-2018-1064—libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMUEPSS 2.9%CVE-2022-21680HIGHCubic catastrophic backtracking (ReDoS) in markedEPSS 2.8%CVE-2021-32640MEDIUMReDoS in Sec-Websocket-Protocol headerEPSS 2.8%CVE-2006-7229HIGHThe skge driver 1.5 in Linux kernel 2.6.15 on Ubuntu does not properly use the spin_lock and spin_unlock functions, which allows remote attaEPSS 2.8%CVE-2022-34701HIGHWindows Secure Socket Tunneling Protocol (SSTP) Denial of Service VulnerabilityEPSS 2.8%CVE-2017-16137—The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes arEPSS 2.8%CVE-2021-22902—The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible dEPSS 2.8%CVE-2023-36038HIGHASP.NET Core Denial of Service VulnerabilityEPSS 2.8%CVE-2024-7254HIGHStack overflow in Protocol Buffers Java LiteEPSS 2.8%CVE-2018-15443MEDIUMCisco Firepower Detection Engine TCP Intrusion Prevention System Rule Bypass VulnerabilityEPSS 2.8%CVE-2026-27307LOWColdFusion | Uncontrolled Resource Consumption (CWE-400)EPSS 2.7%CVE-2022-27781HIGHlibcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.DueEPSS 2.7%CVE-2022-21681HIGHExponential catastrophic backtracking (ReDoS) in markedEPSS 2.7%CVE-2018-14626MEDIUMPowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cacheEPSS 2.7%CVE-2015-1916HIGHUnspecified vulnerability in IBM Java 8 before SR1 allows remote attackers to cause a denial of service via unknown vectors related to SSL/TEPSS 2.7%