Fallos del tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-13149HIGHbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number oEPSS 0.4%CVE-2026-31937HIGHSuricata dcerpc: quadratic complexity in dcerpc bufferingEPSS 0.4%CVE-2026-33123MEDIUMpypdf has inefficient decoding of array-based streamsEPSS 0.4%CVE-2026-13311HIGHshell-quote parse() is quadratic in token count, enabling denial of serviceEPSS 0.4%CVE-2026-6879LOWQuadratic Behavior in xml.etree.ElementPath Index PredicatesEPSS 0.4%CVE-2026-117540HIGHsvg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping LoopEPSS 0.4%CVE-2026-76271MEDIUMDenial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk EnterpriseEPSS 0.4%CVE-2025-14822LOWDoS from quadratic complexity in model.ParseHashtagsEPSS 0.3%CVE-2026-102999HIGHpypdf: Possible long runtimes with large amount of embedded filesEPSS 0.3%CVE-2026-35599MEDIUMVikunja has an Algorithmic Complexity DoS in Repeating Task HandlerEPSS 0.3%CVE-2026-107579HIGHInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-77680MEDIUMLibsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fixEPSS 0.3%CVE-2026-94658HIGHApache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)EPSS 0.3%CVE-2026-94655HIGHApache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadraticEPSS 0.3%CVE-2026-96287HIGHApache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)EPSS 0.3%CVE-2026-102994HIGHpypdf: Possible long runtimes/large memory usage when parsing indirect objectsEPSS 0.3%CVE-2026-102997HIGHpypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)EPSS 0.3%CVE-2026-42923MEDIUMDegradation of service with unbounded NSEC3 hash calculationsEPSS 0.3%CVE-2026-100700HIGHnodemailer before 10.0.6 Denial of Service via addressparserEPSS 0.3%CVE-2026-54284HIGHsqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerEPSS 0.3%