Fallos del tipo CWE-405

74 resultados

Consumo assimétrico de recursos (amplificação)

Fraqueza em que uma operação barata para o atacante consome muitos recursos do servidor ou do sistema-alvo, criando um desequilíbrio entre esforço investido e dano causado. O atacante aproveita essa desproporcionalidade para sobrecarregar a aplicação ou infraestrutura com pouco investimento, levando a negação de serviço.

Ejemplo

Um servidor web que processa requisições de busca complexas sem limite: um atacante envia 1.000 buscas full-text em paralelo, cada uma consumindo CPU por minutos, enquanto ele gasta apenas segundos enviando HTTP requests. O servidor fica indisponível para usuários legítimos.

Cómo mitigar

Implemente rate limiting, timeout de operações, validação de entrada para rejeitar queries complexas, cache de resultados, e monitore proporção entre requisições recebidas e recursos consumidos. Escale horizontalmente se necessário e considere usar filas assíncronas para operações pesadas.

CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2026-22775HIGHdevalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parseEPSS 0.6%CVE-2026-22774HIGHdevalue vulnerable to denial of service due to memory exhaustion in devalue.parseEPSS 0.6%CVE-2026-54874HIGHExcessive Memory Use Buffering DTLS Records for a Future EpochEPSS 0.6%CVE-2024-40705MEDIUMIBM InfoSphere Information Server denial of serviceEPSS 0.6%CVE-2023-2992HIGHAn unauthenticated  denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered underEPSS 0.6%CVE-2024-56200HIGHUncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxyEPSS 0.6%CVE-2026-78669HIGHExcessive CPU consumption from repeated initial window changes in net/httpEPSS 0.6%CVE-2024-28214LOWnGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.EPSS 0.6%CVE-2024-39743MEDIUMIBM MQ Container denial of serviceEPSS 0.6%CVE-2026-85783HIGHCrypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_keyEPSS 0.6%CVE-2026-23934MEDIUMFrontend DoS via the validate.api.exists actionEPSS 0.6%CVE-2025-53633HIGHChall-Manager's scenario decoding process does not check for zip bombsEPSS 0.5%CVE-2026-97031HIGHReject malformed ECH outer extension references in crypto/tlsEPSS 0.5%CVE-2026-35626MEDIUMOpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call WebhookEPSS 0.5%CVE-2024-34703HIGHBotan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve ParametersEPSS 0.5%CVE-2025-22166HIGHThis High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of SerEPSS 0.5%CVE-2025-43857MEDIUMnet-imap rubygem vulnerable to possible DoS by memory exhaustionEPSS 0.5%CVE-2026-110676HIGHCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignumEPSS 0.5%CVE-2026-84897MEDIUMwolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusionEPSS 0.5%