Fallos del tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2024-11828MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%CVE-2024-8237MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%CVE-2026-83613HIGHxmldom: Quadratic-time attribute deduplicationEPSS 0.6%CVE-2026-96640HIGHPillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionEPSS 0.6%CVE-2026-108529HIGHSETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in BanditEPSS 0.6%CVE-2026-113436HIGHQuadratic bignum parsing of Content-Length and Host port values in BanditEPSS 0.6%CVE-2026-75507HIGHGraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation ruleEPSS 0.6%CVE-2026-114138HIGHDjango REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationEPSS 0.6%CVE-2026-112894HIGHPillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)EPSS 0.6%CVE-2026-111759HIGHmarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotesEPSS 0.6%CVE-2026-73413HIGHShescape: Quadratic-time denial of service in flag-protectionEPSS 0.6%CVE-2025-29908MEDIUMNetty QUIC hash collision DoS attackEPSS 0.6%CVE-2026-57480HIGHParse Server: Denial of service via exponential-time processing of deeply nested query operatorsEPSS 0.6%CVE-2026-83614HIGHxmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text mergeEPSS 0.6%CVE-2026-59869HIGHjs-yaml: YAML merge-key chains can force quadratic CPU consumptionEPSS 0.6%CVE-2025-23020MEDIUMAn issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote aEPSS 0.6%CVE-2026-27903HIGHminimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsEPSS 0.6%CVE-2026-58226HIGHUnauthenticated denial-of-service via unbounded HPACK integer decoding in hpaxEPSS 0.6%CVE-2026-92091MEDIUMJwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops arrayEPSS 0.6%CVE-2024-8177MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%