Fallos del tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-44390MEDIUMUnbounded name compression in certain cases causes degradation of serviceEPSS 0.6%CVE-2026-67216HIGHcJSON cJSON_Compare Exponential Complexity Denial of ServiceEPSS 0.6%CVE-2026-59868MEDIUMjs-yaml: YAML merge-key chains can force quadratic CPU consumptionEPSS 0.6%CVE-2026-49293HIGHCPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literalsEPSS 0.6%CVE-2026-59925HIGHinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsEPSS 0.6%CVE-2026-59922HIGHMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)EPSS 0.6%CVE-2026-34573HIGHParse Server: GraphQL complexity validator exponential fragment traversal DoSEPSS 0.6%CVE-2026-40476MEDIUMgraphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validationEPSS 0.6%CVE-2026-92987HIGHroxmltree through 0.21.1 Denial of Service via Quadratic ParsingEPSS 0.6%CVE-2026-56669HIGHElysia: Inefficient Algorithmic Complexity and Interpretation ConflictEPSS 0.6%CVE-2026-71488HIGHleague/commonmark: Quadratic-time denial of service when parsing crafted MarkdownEPSS 0.6%CVE-2026-63447HIGHSuricata ftp: crafted FTP traffic can cause quadratic CPU consumptionEPSS 0.6%CVE-2023-36810MEDIUMQuadratic runtime with malformed PDF missing xref marker in pypdfEPSS 0.6%CVE-2026-55099HIGHicalendar: Algorithmic Complexity in EqualityEPSS 0.6%CVE-2026-119741HIGHrsync < 3.5.2 Denial of Service via hash_search() Checksum CollisionsEPSS 0.6%CVE-2026-43967HIGHQuadratic fragment-name uniqueness check causes denial of service in absintheEPSS 0.6%CVE-2026-71418HIGHSuricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumptionEPSS 0.6%CVE-2026-121437HIGHMistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimitersEPSS 0.6%CVE-2026-59885HIGHpyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceEPSS 0.6%CVE-2026-58436HIGHParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsEPSS 0.6%