Fallos del tipo CWE-407

173 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-63446HIGHSuricata app-layer: passed flows can retain transactions, causing resource exhaustionEPSS 0.4%CVE-2026-92365MEDIUMvllm-project vllm thinking_budget_state.py algorithmic complexityEPSS 0.4%CVE-2026-53550MEDIUMjs-yaml: Quadratic-complexity DoS in merge key handling via repeated aliasesEPSS 0.4%CVE-2026-84375HIGHjs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesEPSS 0.4%CVE-2026-55099HIGHicalendar: Algorithmic Complexity in EqualityEPSS 0.4%CVE-2026-53433MEDIUMDenial of Service in fzfEPSS 0.4%CVE-2026-87822HIGHt-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytesEPSS 0.4%CVE-2026-48959HIGHIO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForwardEPSS 0.4%CVE-2026-6879LOWQuadratic Behavior in xml.etree.ElementPath Index PredicatesEPSS 0.4%CVE-2026-40164HIGHjq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedEPSS 0.4%CVE-2026-13149HIGHbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number oEPSS 0.4%CVE-2026-81722HIGHnltk PorterStemmer before 3.10.3 Quadratic-time DoSEPSS 0.4%CVE-2025-30348MEDIUMencodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with reEPSS 0.4%CVE-2026-63447HIGHSuricata ftp: crafted FTP traffic can cause quadratic CPU consumptionEPSS 0.4%CVE-2026-41850HIGHSpring Framework Algorithmic Denial of Service via SpEL ExpressionsEPSS 0.4%CVE-2026-13311HIGHshell-quote parse() is quadratic in token count, enabling denial of serviceEPSS 0.4%CVE-2026-92987HIGHroxmltree through 0.21.1 Denial of Service via Quadratic ParsingEPSS 0.4%CVE-2026-31937HIGHSuricata dcerpc: quadratic complexity in dcerpc bufferingEPSS 0.4%CVE-2026-83614HIGHxmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text mergeEPSS 0.4%CVE-2025-14822LOWDoS from quadratic complexity in model.ParseHashtagsEPSS 0.4%