Fallos del tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.7%CVE-2026-71321HIGHNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationEPSS 0.7%CVE-2026-66046HIGHExpat Denial of Service via storeAtts() Quadratic ComplexityEPSS 0.7%CVE-2026-75005HIGHApache APISIX: Unauthenticated CPU-exhaustion DoSEPSS 0.7%CVE-2025-11230HIGHDenial of service vulnerability in HAProxy mjson libraryEPSS 0.7%CVE-2026-59870HIGHjs-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsingEPSS 0.7%CVE-2026-82760HIGHSuperlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-inEPSS 0.7%CVE-2024-9631HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.7%CVE-2026-49329HIGHOpenshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpointsEPSS 0.7%CVE-2024-6324MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.7%CVE-2026-55685HIGHReact Router: Unauthenticated Denial of Service via Inefficient Route MatchingEPSS 0.7%CVE-2026-90776HIGHNodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address ParsingEPSS 0.7%CVE-2026-63446HIGHSuricata app-layer: passed flows can retain transactions, causing resource exhaustionEPSS 0.7%CVE-2025-24947MEDIUMA hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attaEPSS 0.7%CVE-2026-87822HIGHt-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytesEPSS 0.7%CVE-2026-64644MEDIUMNext.js: Denial of Service in the Image Optimization API using SVGsEPSS 0.7%CVE-2026-59880HIGHImmutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/SetEPSS 0.7%CVE-2025-14831MEDIUMGnutls: gnutls: denial of service via excessive resource consumption during certificate verificationEPSS 0.7%CVE-2026-59928HIGHMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsEPSS 0.7%CVE-2026-112401MEDIUMPillow: Quadratic GIF comment concatenation allows DoS in Image.open()EPSS 0.6%