Fallos del tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-94653HIGHApache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)EPSS 0.3%CVE-2026-55206HIGHpy7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()EPSS 0.3%CVE-2026-65634HIGHSuperlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoderEPSS 0.3%CVE-2026-71491HIGHsqlparse: Quadratic O(n²) DoS in group_commentsEPSS 0.3%CVE-2026-107580MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-107582MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-107583MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-114129MEDIUMstream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of serviceEPSS 0.3%CVE-2025-55304LOWExiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadataEPSS 0.3%CVE-2026-107581MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.2%CVE-2026-6042MEDIUMmusl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexityEPSS 0.2%CVE-2026-65631MEDIUMerlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of serviceEPSS 0.2%CVE-2026-95838MEDIUMcontainerd: Unpack DoS via repeated opaque whiteoutsEPSS 0.2%CVE-2025-66382LOWIn libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.EPSS 0.2%CVE-2026-104182MEDIUMstream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunkEPSS 0.2%CVE-2026-8594MEDIUMText::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break charactersEPSS 0.2%CVE-2026-87768HIGHDateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding secondsEPSS 0.2%CVE-2026-84305MEDIUMsqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumptionEPSS 0.2%CVE-2026-77831LOWAlgorithmic-complexity denial of service in AshPaperTrail full-diff list trackingEPSS 0.2%CVE-2026-106554—jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)EPSS 0.2%