Fallos del tipo CWE-407

173 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-68750HIGHQuadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of serviceEPSS 0.5%CVE-2026-45186LOWIn libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crEPSS 0.5%CVE-2026-53539HIGHPython-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of serviceEPSS 0.5%CVE-2026-13064HIGHMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of ServiceEPSS 0.5%CVE-2026-45664MEDIUMImageMagick: Policy Bypass in MNG coder couldEPSS 0.4%CVE-2026-63448MEDIUMSuricata smb: some SMB flows can cause resource exhaustionEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-59887HIGHlinkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker textEPSS 0.4%CVE-2026-42304HIGHTwisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer ChainsEPSS 0.4%CVE-2026-49329HIGHOpenshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpointsEPSS 0.4%CVE-2026-34230MEDIUMRack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerEPSS 0.4%CVE-2026-67216HIGHcJSON cJSON_Compare Exponential Complexity Denial of ServiceEPSS 0.4%CVE-2026-71321HIGHNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationEPSS 0.4%CVE-2026-42245LOWnet-imap: Quadratic complexity when reading response literalsEPSS 0.4%CVE-2026-48516MEDIUMMessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settingsEPSS 0.4%CVE-2026-48511MEDIUMMessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted mapsEPSS 0.4%CVE-2026-19668MEDIUMResource Exhaustion via Excessive DNSSEC Cryptographic Material MatchingEPSS 0.4%CVE-2026-55685HIGHReact Router: Unauthenticated Denial of Service via Inefficient Route MatchingEPSS 0.4%CVE-2026-28804MEDIUMpypdf: Inefficient decoding of ASCIIHexDecode streamsEPSS 0.4%CVE-2026-65623HIGHQuadratic CPU blow-up reassembling fragmented WebSocket messages in BanditEPSS 0.4%