Fallos del tipo CWE-407

115 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2020-27223MEDIUMIn Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple AcceptEPSS 78.0%CVE-2022-36021MEDIUMRedis string pattern matching can be abused to achieve Denial of ServiceEPSS 59.7%CVE-2024-43485HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 3.1%CVE-2024-43484HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.9%CVE-2024-43483HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.9%CVE-2022-45061HIGHAn issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDEPSS 2.4%CVE-2019-19331HIGHknot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource recoEPSS 2.2%CVE-2025-64460HIGHPotential denial-of-service vulnerability in XML serializer text extractionEPSS 2.1%CVE-2025-64458HIGHPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsEPSS 1.9%CVE-2022-40188HIGHKnot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During EPSS 1.6%CVE-2023-4408HIGHParsing large DNS messages may cause excessive CPU loadEPSS 1.3%CVE-2024-12243MEDIUMGnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dosEPSS 1.2%CVE-2023-22486LOWcmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of serviceEPSS 1.1%CVE-2026-55968HIGHApache Thrift: Node.js quadratic-time DoS in server receive transportsEPSS 1.1%CVE-2023-46136HIGHWerkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginningEPSS 1.1%CVE-2024-12133MEDIUMLibtasn1: inefficient der decoding in libtasn1 leading to potential remote dosEPSS 1.1%CVE-2024-21909HIGHDenial of service in CBOR libraryEPSS 1.1%CVE-2023-26485MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2023-24824MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2025-14550HIGHPotential denial-of-service vulnerability via repeated headers when using ASGIEPSS 1.0%