Fallos del tipo CWE-407

173 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-75596HIGHNetty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsingEPSS 0.4%CVE-2026-31933HIGHSuricata stream: quadratic complexity in stream inspectionEPSS 0.4%CVE-2026-71418HIGHSuricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumptionEPSS 0.4%CVE-2026-85446HIGHMOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of ServiceEPSS 0.4%CVE-2026-33123MEDIUMpypdf has inefficient decoding of array-based streamsEPSS 0.3%CVE-2026-35599MEDIUMVikunja has an Algorithmic Complexity DoS in Repeating Task HandlerEPSS 0.3%CVE-2026-71488HIGHleague/commonmark: Quadratic-time denial of service when parsing crafted MarkdownEPSS 0.3%CVE-2026-83613HIGHxmldom: Quadratic-time attribute deduplicationEPSS 0.3%CVE-2026-73643HIGHjs-yaml: Exponential parsing time in the flow collections leads to denial of serviceEPSS 0.3%CVE-2026-77680MEDIUMLibsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fixEPSS 0.3%CVE-2026-42923MEDIUMDegradation of service with unbounded NSEC3 hash calculationsEPSS 0.3%CVE-2026-44639LOWNanoMQ: O(N²) Denial of Service in MQTT v5 Property ParsingEPSS 0.3%CVE-2026-73413HIGHShescape: Quadratic-time denial of service in flag-protectionEPSS 0.3%CVE-2026-59885HIGHpyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceEPSS 0.3%CVE-2026-58436HIGHParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsEPSS 0.3%CVE-2023-54395MEDIUMPocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacketEPSS 0.3%CVE-2026-44378MEDIUMBotan: Quadratic complexity decoding BER indefinite length encodingsEPSS 0.3%CVE-2026-55206HIGHpy7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()EPSS 0.3%CVE-2026-84378MEDIUMHTTPX2: Quadratic SSE line buffering can cause CPU denial of serviceEPSS 0.3%CVE-2024-29916MEDIUMThe dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged kEPSS 0.3%