Fallos del tipo CWE-407

266 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2024-21909HIGHDenial of service in CBOR libraryEPSS 1.1%CVE-2023-24824MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2026-55968HIGHApache Thrift: Node.js quadratic-time DoS in server receive transportsEPSS 1.0%CVE-2023-26485MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2026-84008HIGH.NET Denial of Service VulnerabilityEPSS 1.0%CVE-2023-22484LOWInefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of serviceEPSS 1.0%CVE-2022-22153HIGHSRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet dropsEPSS 0.9%CVE-2023-2473MEDIUMDreamer CMS Password Hash Calculation UserController.java updatePwd algorithmic complexityEPSS 0.9%CVE-2024-23684HIGHupokecenter CBOR Denial of ServiceEPSS 0.9%CVE-2026-70196MEDIUMASP.NET Core Denial of Service VulnerabilityEPSS 0.9%CVE-2026-54892HIGHPlug: quadratic-time decoding of nested query/body parameters enables denial of serviceEPSS 0.9%CVE-2026-33033MEDIUMPotential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploadEPSS 0.9%CVE-2025-12084MEDIUMQuadratic complexity in node ID cache clearingEPSS 0.9%CVE-2020-3548MEDIUMCisco Email Security Appliance Denial Of Service VulnerabilityEPSS 0.8%CVE-2026-68750HIGHQuadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of serviceEPSS 0.8%CVE-2025-62727HIGHStarlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponseEPSS 0.8%CVE-2026-59094HIGHPathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document StoreEPSS 0.8%CVE-2026-85446HIGHMOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of ServiceEPSS 0.8%CVE-2024-8233HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.8%CVE-2026-61814HIGHJawn: Quadratic parsing effort in AsyncParserEPSS 0.8%